During the compliance determination phase, you discover that a legacy application lacks multi-factor authentication (MFA) but is isolated within a physically secured enclave. Which action should you take to document this in the Security Assessment Report (SAR)?
An Authorizing Official (AO) is reviewing a Plan of Action and Milestones (POA&M) for a high-impact system. What is the AO's primary responsibility regarding this document?
You are utilizing the NIST SP 800-37 R2 process for an Authorization to Operate (ATO). At what point is the Security Assessment Report (SAR) presented to the Authorizing Official?
You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?
While reviewing a system's compliance, you notice the Security Control Assessor (SCA) used an interview method for a technical control that requires automated testing. How should you address this in your review?
An information system security officer (ISSO) is preparing the Security Assessment Plan (SAP) in the NIST Risk Management Framework. Which component must be identified first to ensure the assessment coverage is adequate?
A system is found to have a critical vulnerability that cannot be patched. You are documenting a risk acceptance request. What is the most critical piece of information to include for the AO?
During a system compliance review, the Security Control Assessor (SCA) issues a finding that a critical security control is only partially implemented. The system owner disagrees and wants to proceed with authorization. As the Information System Security Officer (ISSO), what should you do FIRST?
You are preparing a continuous monitoring strategy for a federal information system in accordance with NIST SP 800-137. Which TWO activities are essential components of the continuous monitoring program? (Choose two.)
A system owner is preparing to authorize a system for operation. The Security Assessment Report (SAR) contains a finding that a high-impact security control is not implemented. The Authorizing Official (AO) decides to accept the risk and grant an Authorization to Operate (ATO). What document must the AO sign to formally accept the risk?
You are the Information System Security Officer (ISSO) for a federal system undergoing a periodic security control assessment. During the assessment, the assessor identifies that a high-impact security control is only partially implemented. According to NIST SP 800-37 Rev. 2, what should be your immediate next step?
A federal agency is preparing for an Authorization to Operate (ATO) for a new cloud-based system. The system owner wants to leverage a FedRAMP authorization from the cloud service provider (CSP) to reduce assessment effort. Which document should the system owner obtain from the CSP to understand the security controls inherited and those that require agency assessment?
You are the Information System Security Officer (ISSO) for a federal financial system undergoing an annual assessment. The Security Control Assessor (SCA) has completed the assessment and documented several controls as 'Other than Satisfied' in the Security Assessment Report (SAR). According to NIST SP 800-37 Revision 2, what is the primary next step the Authorizing Official (AO) must take before making an authorization decision?
You are the Information System Security Officer (ISSO) for a federal system undergoing an annual assessment. The assessor reports that a boundary protection control is only partially implemented: the firewall ruleset is outdated, and several unnecessary ports are open. The system owner asks how this should be reflected in the System Security Plan (SSP). What is the most appropriate action?
You are the ISSO for a system that has just received an Authorization to Operate (ATO). To maintain the authorization, you must implement continuous monitoring. Which TWO activities are essential components of a continuous monitoring program according to NIST SP 800-137? (Choose two.)
During a security assessment of a cloud-based system, the Security Control Assessor (SCA) determines that a cryptographic module used for data at rest does not meet FIPS 140-2 validation requirements. The system owner argues that the module is provided by the cloud service provider (CSP) and is therefore outside their control. As the ISSO, what should you do first to address this finding?
You are the Information System Security Officer (ISSO) for a federal payroll system undergoing an annual assessment. The Security Control Assessor (SCA) reports that a firewall rule allowing inbound RDP from any source is in place, contradicting the documented configuration in the System Security Plan (SSP). The system owner argues the rule is temporary for a migration. What is the most appropriate immediate action?
A system owner is preparing to submit a system for authorization. The system processes sensitive but unclassified information. The Authorizing Official (AO) requires a formal document that describes the system's security controls and how they are implemented. Which document should the system owner provide?
An organization is preparing for a security control assessment of a high-impact system. The assessment team plans to use a combination of methods. Which TWO actions should the assessment team take to ensure the assessment is reliable and repeatable? (Choose two.)
You are developing a continuous monitoring strategy for a federal information system as part of the Risk Management Framework (RMF) process. According to NIST SP 800-137, which TWO of the following are essential components of an effective continuous monitoring program? (Choose two.)
A federal agency is preparing for a continuous monitoring assessment of a high-impact system. The Information System Security Officer (ISSO) must ensure that the security assessment plan (SAP) includes appropriate methods for assessing a new encryption control. Which combination of assessment methods should the ISSO verify are included to provide the most reliable evidence?
During a security control assessment, the assessor finds that a system uses encryption that does not meet the required FIPS 140-2 validation. The system owner argues that the encryption is stronger but not validated. According to NIST SP 800-53, what is the most appropriate action?
A system owner is preparing to transition a system into the operations and maintenance phase. The Authorizing Official has granted an Authorization to Operate (ATO). What is the primary compliance activity that must continue during this phase?
An organization is using a FedRAMP-authorized cloud service provider (CSP) for a new system. The ISSO must determine how to leverage the CSP's authorization to reduce the assessment burden for the new system. Which approach is most appropriate according to FedRAMP guidance?
An organization is implementing a continuous monitoring program for its information systems in accordance with NIST SP 800-137. Which TWO activities are essential components of this program? (Choose two.)
During a security assessment, the assessor discovers that a system's audit logging control is implemented but the logs are not being reviewed regularly. The control is technically configured correctly. How should the assessor document this finding in the Security Assessment Report (SAR)?
A system owner is preparing to accept a risk for a low-impact information system. The system has a minor weakness that cannot be remediated in the next 30 days. Which document must the system owner sign to formally accept the risk?
An organization is using a cloud service provider (CSP) for a system that processes moderate-impact data. The CSP has a FedRAMP authorization. What is the most efficient way for the organization to leverage the CSP's authorization to support its own system's authorization?
An Information System Security Officer (ISSO) is reviewing the Security Assessment Report (SAR) for a system that is undergoing initial authorization. The SAR indicates that a high-impact system has a control that is only partially implemented. What should the ISSO recommend to the Authorizing Official (AO)?
You are the Information System Security Officer (ISSO) for a federal system that has an approved Authority to Operate (ATO). During a continuous monitoring review, the system owner asks you to explain why a new vulnerability scan finding must be documented in the Plan of Action and Milestones (POA&M) rather than simply fixed and closed. What is the most appropriate reason?
You are the Information System Security Officer (ISSO) for a system undergoing a security control assessment. The assessor has completed testing and provided results. As part of the compliance determination process, you must review the assessment findings and determine the overall compliance status. Which TWO factors are most critical when determining whether a security control is compliant? (Choose two.)
You are the Information System Security Officer (ISSO) for a federal system that has just completed a security control assessment. The assessor identified several findings, and you are now preparing the Plan of Action and Milestones (POA&M). The system owner asks you to explain the primary purpose of the POA&M in the context of continuous monitoring. What should you say?