Control Selection

You are selecting controls for a system that must comply with both NIST SP 800-53 and the Payment Card Industry Data Security Standard (PCI DSS). The system processes credit card transactions. You have identified overlapping controls, but some PCI DSS requirements are more prescriptive than the NIST controls. What is the most effective approach to reconcile these differences during control selection?

During a control audit, you find that the organization has documented a 'common control' for password complexity. What does this imply for individual systems?

You are a security architect selecting controls for a new federal payroll system categorized as MODERATE impact. The system will be hosted in a government-operated data center. Your organization has already implemented a robust physical security program at the facility, including 24/7 guards, biometric access, and CCTV monitoring. You must select the most appropriate control for physical access authorization. Which action best aligns with NIST SP 800-53 control selection and tailoring guidance?

You are a risk practitioner for a healthcare organization. You are selecting controls for a system that processes electronic protected health information (ePHI). You need to ensure compliance with the HIPAA Security Rule while using NIST SP 800-53 as a framework. What is the most effective approach?

An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?

You are a security analyst at a hospital that must comply with HIPAA and NIST SP 800-53. You are selecting controls for a new patient portal. Your manager asks you to reduce unnecessary duplication by identifying controls that are already provided by the hospital's centralized identity management system. Which type of control should you document for the portal's authentication requirements?

You are a security architect for a federal agency. You are selecting controls for a new high-impact system that processes sensitive personnel data. During the initial selection process, you determine that a specific NIST SP 800-53 control is not applicable because the system does not use wireless networking. According to NIST guidance, what is the most appropriate action?

A security architect is selecting controls for a system that will be deployed in a virtualized environment. The architect notes that many controls in the NIST SP 800-53 baseline assume physical separation. Which tailoring action is most appropriate to address this?

Which THREE actions are essential to correctly manage assignments in NIST 800-53 controls?

You are selecting controls for a federal information system categorized as LOW impact. The system owner wants to use NIST SP 800-53B low baseline but also needs to address a specific threat from a recent vulnerability scan that is not covered by the baseline. What is the most appropriate action?

You are a security architect for a federal agency. A new system is categorized as LOW impact. The system owner wants to reduce the number of controls to only those that are strictly required. According to NIST SP 800-53B, which of the following is the most appropriate action?

Which TWO of the following are considered 'common controls'?

You are a security manager for a federal agency. You are selecting controls for a new information system using NIST SP 800-53 Rev. 5. You need to determine which controls are required based on the system's impact level. Which NIST publication provides the control baselines for low, moderate, and high-impact systems?

Your organization has decided to use a 'Control Overlay' for a cloud environment. What is the primary benefit of using an overlay?

Which THREE factors should an organization consider when applying control overlays?

A security analyst is selecting controls for a new web application hosted in a public cloud IaaS environment. The organization wants to reduce the number of controls that are not applicable due to the cloud provider's inherited controls. Which action should the analyst take FIRST according to NIST SP 800-53?

You are tailoring a NIST SP 800-53 baseline for a new system. The system owner asks you to identify the reasons why a control might be marked as 'Not Applicable' during tailoring. Which two of the following are valid reasons for marking a control as 'Not Applicable'? (Choose two.)

You are preparing a security plan for a federal information system categorized as MODERATE impact. According to NIST SP 800-53B, what is the primary objective of the initial control baseline selection process?

You are selecting controls for a cloud-based system that will be used by a government agency. The cloud service provider (CSP) has a FedRAMP authorization. You need to determine which controls are inherited from the CSP. What should you review to understand the CSP's control implementation and inheritance details?

You are tailoring the NIST SP 800-53 Rev. 5 Moderate baseline for a system that will be deployed in a tactical edge environment with limited network connectivity. The system processes sensitive but unclassified information. Which TWO of the following actions are appropriate when scoping and tailoring controls for this environment? (Choose two.)

What is the primary role of the authorization official (AO) during the Control Selection phase?

A security manager is tailoring a NIST SP 800-53 control baseline for a system that processes sensitive but unclassified information. The system owner proposes to remove a control that requires continuous monitoring because the system is in a low-risk environment. What should the security manager do?

When selecting controls for a system that uses mobile devices, you apply an overlay. What is the correct relationship between the baseline and the overlay?

Which THREE of the following are benefits of using the NIST 800-53 control framework?

You are a risk analyst reviewing a system's security plan. The system inherits a control from a common control provider. The control is documented in the system security plan as 'Inherited'. What is the most critical item to verify during assessment?

When utilizing the NIST 800-53 control catalog, which field identifies the specific family to which a control belongs?

Which THREE of the following are components that must be included when documenting a compensating control?

A security analyst is selecting controls for a new information system based on NIST SP 800-53 Rev. 5. The system has been categorized as LOW impact. The analyst proposes using the LOW baseline but wants to add a control from the MODERATE baseline to address a specific risk identified in the risk assessment. What is the most appropriate action?

You are a security consultant helping a financial institution select controls for a new mobile banking application. The institution must comply with PCI DSS and NIST SP 800-53. During control selection, you identify that a NIST SP 800-53 control has a parameter that must be defined, such as the frequency of reviews. What should you do to ensure the control is properly implemented?

Which TWO of the following statements regarding the 'Tailoring' process are accurate?

A security team is selecting controls for a system that will use a cloud-based infrastructure. They need to determine which controls can be inherited from the cloud provider. Which TWO of the following are appropriate actions to take during this process? (Choose two.)

If a control is determined to be 'system-specific', what does that mean?

An organization is selecting controls for a new information system. The system is categorized as low impact. According to NIST SP 800-53B, which baseline should be used as the starting point?

During tailoring, what is the 'Refinement' process?

You are assessing a system. You find a control that is marked as 'Inherited'. What is the most critical item to verify?

You are selecting controls for a high-impact system that processes sensitive law enforcement data. The system uses a commercial cloud service provider (CSP) for infrastructure as a service (IaaS). The CSP has a FedRAMP authorization at the Moderate impact level. Your system requires additional controls beyond the CSP's baseline. Which action should you take first to address the gap?

You are tailoring controls for a system that does not process PII. Which action should you take regarding the Privacy (PRIV) family controls in the NIST 800-53 catalog?

Which document defines the security control baselines (Low, Moderate, High) for federal information systems?

A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is your responsibility as the system owner?

You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation approach?

Which TWO of the following are valid reasons for tailoring a NIST 800-53 control baseline?

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of utilizing the 'Control Catalog'?

A security architect is selecting controls for a new payroll processing system that handles PII and is deployed on-premises. The system owner wants to maximize efficiency by reducing duplicate documentation. The organization already has an enterprise-wide access control policy and a centralized identity management system. When developing the system security plan, what is the most appropriate approach for addressing the access control family controls?

When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the purpose of these statements?

You are developing a security plan for a system that uses a NIST SP 800-53 control baseline. During control selection, you determine that a particular control is not applicable because the system does not have the relevant technology. How should you document this decision?