Courseiva

CCNA Scope OF System Questions

38 questions · Scope OF System · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQeasy

What is the primary risk of having an inaccurately defined authorization boundary?

A.Increased cost of hardware procurement.
B.Violation of the System Development Life Cycle (SDLC).
C.Inability to perform annual performance reviews.
D.Unprotected assets or vulnerabilities left outside the scope of assessment.
AnswerD

An inaccurate authorization boundary omits systems, data or interconnections from the assessment scope, so those assets receive no security evaluation and their vulnerabilities remain unaddressed. This directly matches the risk of unprotected assets falling outside assessment scope.

Why this answer

The authorization boundary defines exactly which systems, components, and data are included in a security assessment and authorization decision. If that boundary is drawn inaccurately — too narrow or misaligned with the actual system — assets and vulnerabilities that should have been assessed fall outside the scope. Those excluded assets remain unprotected and unmitigated, which is the core risk the question is testing.

Exam trap

CGRC often tests the misconception that authorization boundary issues are procedural or administrative concerns, when the actual risk is always about assets and vulnerabilities escaping security assessment and oversight.

How to eliminate wrong answers

Option A is wrong because hardware procurement cost is a budgeting concern, not a security risk tied to boundary definition; an inaccurate boundary does not inherently increase hardware spend. Option B is wrong because the SDLC is a development process framework — a poorly defined authorization boundary does not constitute an SDLC violation, and the two concepts are unrelated in this context. Option C is wrong because annual performance reviews are an HR function with no technical or security linkage to authorization boundary definition.

Practice this question →
2
MCQmedium

A security analyst is defining the authorization boundary for a new financial system hosted entirely within a commercial cloud Infrastructure as a Service (IaaS) environment. The system consists of virtual machines, a managed database service, and a load balancer, all provisioned by the organization's cloud team. The cloud provider's physical data center and hypervisor layer are outside the organization's direct control. According to NIST SP 800-37 Rev. 2, which statement best describes how the authorization boundary should be defined?

A.The boundary must include the entire cloud region, because all resources in a region share the same physical network and management plane.
B.The boundary includes only the virtual machines and the managed database, because the load balancer is a shared network device and must be excluded.
C.The boundary includes the virtual machines, managed database, load balancer, and the underlying cloud infrastructure because the system cannot operate without it.
D.The boundary includes the virtual machines, managed database service, and load balancer, but excludes the cloud provider's hypervisor and physical infrastructure.
AnswerD

NIST SP 800-37 Rev. 2 defines the authorization boundary as the set of system components under the organization's direct control. The VMs, managed database, and load balancer are provisioned and managed by the organization, so they are inside. The hypervisor and physical data center are the provider's responsibility and are covered by the provider's own authorization, such as a FedRAMP package.

Why this answer

The authorization boundary is defined by the components the organization directly controls and that are necessary for the system's operation. In an IaaS deployment, the organization controls the virtual machines, managed database, and load balancer, so these belong inside. The cloud provider's hypervisor and physical infrastructure are outside the boundary and are covered by the provider's own authorizations and FedRAMP packages.

Exam trap

The trap here is assuming that any underlying infrastructure the system depends on must be inside the authorization boundary, when in fact only components under the organization's direct control are included.

Practice this question →
3
MCQeasy

A program manager is preparing to categorize a new information system under FIPS 199. The system will handle financial data, and the program manager wants to ensure the categorization is accurate. Which document should the program manager reference to identify the potential impact levels for confidentiality, integrity, and availability?

A.NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations
B.FIPS 199, Standards for Security Categorization of Federal Information and Information Systems
C.NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories
D.NIST SP 800-37, Risk Management Framework for Information Systems and Organizations
AnswerB

FIPS 199 is the standard that defines the security objectives (confidentiality, integrity, availability) and the potential impact levels (low, moderate, high). It requires agencies to categorize information and information systems based on the potential impact of a security breach. The program manager should use FIPS 199 to assess the financial data and determine the overall security category. This is the correct starting point for the RMF.

Why this answer

FIPS 199 establishes the security categorization standard, defining the potential impact levels for confidentiality, integrity, and availability. It is the authoritative document for determining the security category of an information system. While SP 800-37 describes the RMF process and SP 800-60 offers mapping guidance, FIPS 199 is the specific standard that provides the impact criteria.

Using it ensures the categorization is compliant and accurate.

Exam trap

The trap here is confusing the RMF process document with the categorization standard, leading to selection of SP 800-37 instead of FIPS 199.

Practice this question →
4
MCQeasy

A federal agency is initiating the authorization process for a new information system. The system owner is working with the information system security officer (ISSO) to define the system boundary. Which of the following best describes the purpose of defining the system boundary?

A.To identify the physical location of all hardware components to ensure they are within the agency's facilities.
B.To determine the budget required for securing the system by counting the number of components.
C.To establish the scope of the system for the purpose of applying security controls and assessing risk.
D.To list all users who will have access to the system for the purpose of background checks.
AnswerC

Defining the system boundary establishes what is included in the system, thereby determining the scope for security control implementation, assessment, and risk management. It ensures that all components processing, storing, or transmitting information are protected and that the authorization decision covers the correct set of assets. This is essential for effective risk management and compliance.

Why this answer

The system boundary defines the scope of the system for security control implementation and risk assessment. It delineates what components, processes, and people are part of the system, ensuring that the authorization covers all necessary elements. This scoping is critical for applying the appropriate security controls, assessing risk accurately, and making informed authorization decisions.

Exam trap

The trap here is confusing the system boundary with physical inventory, budgeting, or user access lists, rather than understanding it as the logical and physical scope for security and risk management.

Practice this question →
5
MCQhard

A security manager is leading an effort to define the authorization boundary for a system that uses a virtualized environment. The system consists of multiple virtual machines (VMs) on a hypervisor that also hosts VMs for other systems. How should the security manager address the hypervisor when defining the boundary?

A.Treat the hypervisor as a common control and document the inheritance of its security controls in the system security plan.
B.Exclude the hypervisor entirely from the boundary and from any security documentation.
C.Include the hypervisor within the system boundary because it provides essential virtualization services.
D.Include only the VMs used by the system in the boundary, and ignore the hypervisor because it is not a VM.
AnswerA

In virtualized environments, the hypervisor is often a shared infrastructure component that provides security controls to multiple systems. It should be treated as a common control, and the system security plan should document which controls are inherited from the hypervisor's authorization. This approach avoids duplicating assessments and ensures that the system relies on the hypervisor's security posture.

Why this answer

In a virtualized environment, the hypervisor is typically a shared component that provides security controls to multiple systems. It should be treated as a common control, and the system security plan should document the inheritance of its controls. This approach maintains a clear boundary for the system while ensuring that the hypervisor's security is properly assessed and managed.

The other options either incorrectly include or exclude the hypervisor without proper documentation.

Exam trap

The trap here is either including the shared hypervisor in the boundary, which expands scope inappropriately, or ignoring it completely, which leaves a security gap.

Practice this question →
6
Multi-Selecthard

A security manager is defining the authorization boundary for a system that processes Controlled Unclassified Information (CUI). The system consists of a web server, an application server, and a database server, all hosted on-premises. The system also uses a shared network switch and a shared firewall that are used by other systems in the same data center. Which two components should be included in the authorization boundary? (Choose two.)

Select 2 answers
A.The data center physical security controls, because they protect the servers.
B.The shared firewall, because it enforces security policies for the system.
C.The web server, because it directly processes CUI and is dedicated to the system.
D.The application server, because it processes CUI and is dedicated to the system.
E.The shared network switch, because it carries CUI traffic for the system.
AnswersC, D

The web server directly processes CUI and is dedicated to the system, so it must be included in the authorization boundary. NIST SP 800-37 requires that all components that process, store, or transmit CUI be within the boundary. Including dedicated components ensures that security controls are assessed and authorized for the system, and that the boundary accurately reflects the system's scope.

Why this answer

The authorization boundary should include dedicated components that process, store, or transmit CUI, such as the web server and application server. Shared components like the network switch and firewall are common controls and are inherited, not included in the boundary. This approach aligns with NIST SP 800-37's guidance on defining boundaries around system-specific components.

Exam trap

The trap here is including shared infrastructure components in the authorization boundary, when they should be treated as common controls and inherited.

Practice this question →
7
MCQmedium

A security analyst is preparing to categorize a new human resources system that will store PII for 5,000 employees. The system will be hosted in a government cloud environment. According to FIPS 199, what is the FIRST step the analyst should take to determine the security category?

A.Conduct a vulnerability assessment to identify weaknesses in the cloud hosting environment.
B.Identify the information types processed, stored, or transmitted by the system and determine the potential impact of a security breach.
C.Select the appropriate security controls from NIST SP 800-53 based on the system's processing environment.
D.Document the system boundary and obtain approval from the Authorizing Official before assigning impact levels.
AnswerB

FIPS 199 requires categorization based on the potential impact to the organization if the information is compromised. The analyst must first identify information types and then assess impact levels (low, moderate, high) for confidentiality, integrity, and availability. This foundational step ensures the security category accurately reflects the system's criticality before any technical controls are selected.

Why this answer

FIPS 199 mandates that security categorization begins with identifying the information types the system handles and assessing the potential impact of a breach on confidentiality, integrity, and availability. This impact analysis drives the overall security category, which then informs control selection and other RMF activities. The other options describe later RMF phases or actions that depend on the categorization outcome.

Exam trap

The trap here is assuming that technical activities like vulnerability assessment or control selection come before impact analysis, when FIPS 199 requires impact determination first.

Practice this question →
8
MCQmedium

You have determined that a system's data is publicly available, but the system is responsible for providing critical government services. If the system goes offline, the loss of availability is catastrophic. How should the FIPS 199 categorization be adjusted?

A.Exclude the system from FIPS 199 requirements.
B.Categorize only based on Confidentiality.
C.Confidentiality=Low, Integrity=Low, Availability=High.
D.Confidentiality=Low, Integrity=Low, Availability=Low.
AnswerC

FIPS 199 rates each security objective separately at Low, Moderate or High based on the potential impact of loss. Public data means confidentiality and integrity breaches cause limited harm, so both stay Low, but catastrophic loss of availability for a critical government service raises that objective to High.

Why this answer

FIPS 199 requires separate categorization of the three security objectives: confidentiality, integrity, and availability. Because the data is publicly available, confidentiality impact is Low; because the question gives no indication of integrity requirements, integrity defaults to Low. However, the system provides critical government services and catastrophic loss of availability means the availability impact must be High, producing Confidentiality=Low, Integrity=Low, Availability=High.

Exam trap

CGRC often tests the misconception that publicly available data automatically makes a system Low impact overall, causing candidates to ignore the independent High availability impact and choose the all-Low option.

How to eliminate wrong answers

Option A is wrong because FIPS 199 applies to all federal information and information systems except those specifically excluded by statute or policy; public data and criticality do not exempt a system from categorization. Option B is wrong because FIPS 199 never permits categorizing only one objective; confidentiality, integrity, and availability must each be assessed independently, and availability is clearly High here. Option D is wrong because it assigns Availability=Low, directly contradicting the stated catastrophic loss of availability and ignoring the high-impact availability requirement.

Practice this question →
9
MCQhard

Your organization is transitioning to a 'System of Systems' architecture. When defining the boundary for one sub-system, what is the best practice to avoid scope creep?

A.Define the boundary based on the specific services and data flows owned by the sub-system.
B.Include only the database tier.
C.Include the entire enterprise infrastructure to be safe.
D.Include all internal network segments regardless of use.
AnswerA

Anchoring the boundary to services and data flows the sub-system actually owns creates an explicit, verifiable interface contract. This constrains scope to defined responsibilities, preventing adjacent capabilities from being absorbed and satisfying the System of Systems need to avoid scope creep.

Why this answer

When defining the boundary for a sub-system within a System of Systems architecture, the best practice is to define it based on the specific services and data flows owned by that sub-system. This approach ensures a clear, manageable scope that aligns with the sub-system's responsibilities and avoids including unrelated components that would cause scope creep. It also facilitates independent authorization and risk management for each sub-system.

Exam trap

CGRC often tests the tendency to over-include (entire enterprise) or under-include (only database) when defining boundaries, tempting candidates to choose extremes rather than the balanced, service-and-data-flow-based approach.

How to eliminate wrong answers

Option B is wrong because including only the database tier is too narrow; it ignores application servers, interfaces, and other components that are part of the sub-system's services and data flows. Option C is wrong because including the entire enterprise infrastructure is overbroad and defeats the purpose of defining a sub-system boundary; it would lead to massive scope creep and an unmanageable authorization effort. Option D is wrong because including all internal network segments regardless of use is also overbroad and may include segments not relevant to the sub-system, again causing scope creep and unnecessary complexity.

Practice this question →
10
MCQmedium

A federal agency is deploying a new cloud-based case management system. The system consists of a web front end, an application server, and a database, all hosted in a single virtual private cloud (VPC). The system owner must define the authorization boundary for the system. Which of the following best describes the authorization boundary in this context?

A.The authorization boundary includes the agency's entire network infrastructure, including all other systems and applications that share the same network.
B.The authorization boundary includes only the database, because it stores the sensitive case data, while the web and application servers are considered external interfaces.
C.The authorization boundary includes only the physical servers within the agency's data center that host the virtual machines.
D.The authorization boundary includes all components of the system within the VPC, including the web front end, application server, and database, as well as the supporting infrastructure managed by the cloud provider.
AnswerD

The authorization boundary defines the set of system components (hardware, software, and firmware) that are authorized to operate as a system. In a cloud environment, the boundary typically includes the resources within the VPC and the supporting infrastructure provided by the cloud service provider (CSP), which may be covered under the CSP's own authorization or a shared responsibility model. This ensures comprehensive coverage of the system.

Why this answer

The authorization boundary must include all components that comprise the system, including those in a cloud environment. For a cloud-based system, the boundary typically encompasses the virtual private cloud resources and the underlying infrastructure provided by the cloud service provider, often addressed through a shared responsibility model. This ensures that all parts processing, storing, or transmitting data are within the scope of the authorization.

Exam trap

The trap here is assuming the authorization boundary is limited to physically owned hardware or only the most sensitive component, rather than including all logical and physical components that constitute the system.

Practice this question →
11
MCQeasy

An organization is beginning the RMF process for a new human resources system. The Information System Owner (ISO) needs to identify the system boundary. Which of the following best describes the purpose of defining the authorization boundary?

A.To identify the physical location of all servers and network devices that process organizational data.
B.To list all external organizations that will connect to the system and require interconnection agreements.
C.To establish the scope of the system for which the organization will implement and assess security controls.
D.To determine which data is sensitive and requires encryption both at rest and in transit.
AnswerC

The authorization boundary defines the components, processes, and personnel that make up the system. It establishes what the organization must protect and assess. This scope ensures that all necessary controls are implemented and that the assessment covers the entire system. Without a clear boundary, the security evaluation would be incomplete or misdirected.

Why this answer

The authorization boundary establishes the scope of the system for which the organization is responsible. It defines which components, processes, and personnel are included so that security controls can be implemented and assessed appropriately. This scope is fundamental to the RMF process, ensuring that the assessment covers all relevant parts of the system.

Exam trap

The trap here is confusing the boundary with data sensitivity or interconnection documentation, when the boundary is specifically about scoping the system for control implementation and assessment.

Practice this question →
12
MCQhard

You are assessing a system that utilizes a shared service for identity management. How should this be reflected in the system's authorization boundary?

A.Force the service provider to sign a full system authorization for you.
B.List the identity service as an external provider and inherit the controls.
C.The identity service must be fully assessed as part of your system.
D.Exclude the identity service from the documentation entirely.
AnswerB

A shared identity service sits outside the system's direct control, so it must be documented as an external provider, with its controls inherited rather than re-assessed. This satisfies the boundary constraint by keeping the authorisation boundary accurate and avoiding duplicated control testing.

Why this answer

When a system relies on a shared service for identity management, that service is typically outside the system's authorization boundary. The correct approach is to list the identity service as an external provider and inherit its controls, documenting the reliance and the controls it provides. This reflects the shared responsibility model and avoids duplicating assessments.

Exam trap

CGRC often tests the misconception that shared services must be fully assessed within your own boundary, when in fact they should be documented as external providers with inherited controls.

How to eliminate wrong answers

Option A is wrong because forcing the service provider to sign a full system authorization for your system is not feasible or appropriate; the provider has its own authorization. Option C is wrong because fully assessing the identity service as part of your system would incorrectly expand your authorization boundary and duplicate effort. Option D is wrong because excluding the identity service from documentation entirely would leave a critical dependency undocumented, violating assessment requirements.

Practice this question →
13
Multi-Selectmedium

Which THREE artifacts are commonly used by the Authorizing Official (AO) to validate the system boundary? (Select THREE)

Select 3 answers
A.The janitorial service contract for the building.
B.Network architecture diagrams.
C.Data flow diagrams illustrating external interfaces.
D.System Security Plan (SSP) boundary description.
E.The organization's holiday schedule.
AnswersB, C, D

Network architecture diagrams show the physical and logical placement of components, enclaves and connections, letting the Authorizing Official verify which assets sit inside the accreditation boundary. They expose boundary crossings and external links that textual descriptions may omit.

Why this answer

The Authorizing Official validates the system boundary using artifacts that define what is inside the authorization boundary and how it connects to external systems. Option B, network architecture diagrams, is correct because they show the topology, subnetting, and placement of components (routers, firewalls, servers) that delineate where the boundary begins and ends. Option C, data flow diagrams illustrating external interfaces, is correct because they trace information entering and leaving the system, making explicit which external connections and interconnections cross the boundary.

Option D, the System Security Plan (SSP) boundary description, is correct because the SSP formally documents the authorization boundary, including the components, users, and interconnections covered by the authorization. Options A and E are incorrect because a janitorial service contract and a holiday schedule are administrative/logistical documents unrelated to the technical or documented definition of an information system boundary.

Exam trap

CGRC often tests the distinction between artifacts that define technical scope (diagrams, SSP) and administrative documents (contracts, schedules), so candidates who pick any 'official-looking' document without asking 'does this define the boundary?' get trapped.

Practice this question →
14
MCQmedium

A federal agency is deploying a cloud-based case management system. The system uses a virtual private cloud (VPC) for compute, a managed database service, and an external identity provider for authentication. The security team must define the authorization boundary. Which approach best aligns with NIST SP 800-37 and FIPS 199?

A.Include only the physical servers and network devices located in the agency's data center, treating all cloud services as external dependencies.
B.Define the boundary to include all components that process, store, or transmit system data, including the identity provider if it enforces access to the system.
C.Include only the VPC and managed database, since the identity provider is a separate external service and always outside the boundary.
D.Use the cloud provider's existing FedRAMP authorization for the entire infrastructure and exclude all components from the agency's boundary.
AnswerB

NIST SP 800-37 and FIPS 199 require the boundary to encompass all components that process, store, or transmit information, as well as those that enforce security controls for the system. The identity provider enforces authentication and access, so it is part of the system's security posture. Including it ensures a complete risk assessment and accurate categorization. This approach correctly reflects the system's true scope.

Why this answer

The authorization boundary must include every component that processes, stores, or transmits system data, as well as those that enforce security controls. The identity provider enforces authentication, so it belongs within the boundary. Excluding it or relying solely on a provider's authorization would leave the agency unable to assess its own risk.

A correct boundary ensures accurate FIPS 199 categorization and a valid authorization decision.

Exam trap

The trap here is assuming that any external service is automatically outside the authorization boundary, when in fact services that enforce security controls or handle system data must be included.

Practice this question →
15
MCQhard

A large federal agency is modernizing its benefits processing system. The new architecture will integrate a legacy mainframe system, a commercial off-the-shelf (COTS) case management product hosted on-premises, and a new cloud-based document repository. The legacy mainframe and the COTS product are owned by the agency, while the cloud repository is provided by a FedRAMP-authorized cloud service provider. The agency's Information System Owner (ISO) must define the authorization boundary for the overall benefits processing capability. Which approach is most appropriate?

A.Define three separate authorization boundaries, one for each component, and require each to undergo a full RMF process independently, including the cloud repository.
B.Define a single authorization boundary that encompasses the mainframe, the COTS product, and the cloud repository, because they collectively deliver the benefits processing capability.
C.Define a boundary for the mainframe and COTS product as one system, and treat the cloud repository as a separate system, documenting the interconnection and relying on the cloud provider's FedRAMP authorization.
D.Define the boundary to include only the new cloud repository, because the legacy mainframe and COTS product are already accredited under earlier authority to operate (ATO) decisions.
AnswerC

NIST SP 800-37 Rev. 2 allows for multiple authorization boundaries when components are managed by different entities. The mainframe and COTS product are under the agency's direct control and can form one system. The cloud repository is a separate system with its own FedRAMP authorization. The agency should document the interconnection and inherit controls from the cloud provider's package, avoiding unnecessary duplication.

Why this answer

The authorization boundary should group components under the same management control. The mainframe and COTS product are both agency-owned and can be assessed as one system. The cloud repository is managed by a FedRAMP-authorized provider and should be treated as a separate system, with the agency documenting the interconnection and inheriting controls from the provider's authorization package.

Exam trap

The trap here is assuming that all components delivering a capability must be in a single authorization boundary, when in fact separate boundaries are appropriate when components are managed by different entities.

Practice this question →
16
MCQmedium

A federal agency is using FIPS 199 to categorize a system that processes public health data. The confidentiality impact is Low, integrity is Moderate, and availability is Moderate. What is the overall system categorization?

A.Not Categorized
B.Low
C.High
D.Moderate
AnswerD

FIPS 199 applies the high-water mark rule: the overall categorisation equals the highest impact value across confidentiality, integrity and availability. Integrity and availability are both Moderate, exceeding the Low confidentiality rating, so the system is categorised Moderate.

Why this answer

Per FIPS 199, the overall security categorization of an information system is determined by the high-water mark of the three security objectives: confidentiality, integrity, and availability. Since integrity and availability are both Moderate and confidentiality is Low, the highest impact level is Moderate, making the overall system categorization Moderate. This ensures that the system is protected at the level of its most critical security objective.

Exam trap

CGRC often tests the high-water mark rule by presenting mixed impact levels (e.g., Low/Moderate/Moderate) and tempting candidates to average them or pick the lowest, rather than selecting the highest impact level as the overall categorization.

How to eliminate wrong answers

Option A is wrong because 'Not Categorized' is not a valid FIPS 199 categorization outcome; every system must be categorized as Low, Moderate, or High. Option B is wrong because the overall categorization must reflect the highest impact among the three objectives — since integrity and availability are Moderate, the system cannot be Low. Option C is wrong because High would only apply if at least one objective had a High impact; here all objectives are Low or Moderate, so High is incorrect.

Practice this question →
17
MCQmedium

An Information System Owner (ISO) is defining the authorization boundary for a system that will be deployed in a government cloud environment. The cloud provider offers infrastructure as a service (IaaS). Which of the following should the ISO consider as part of the system boundary?

A.The cloud provider's customer support personnel who manage the IaaS platform.
B.The cloud provider's hypervisor and network infrastructure.
C.The virtual machines, applications, and data that the organization deploys and manages in the cloud.
D.The cloud provider's physical data center security controls.
AnswerC

In an IaaS model, the organization is responsible for securing the virtual machines, applications, and data it deploys. These components are under the organization's control and should be included in the authorization boundary. The ISO must ensure that these components are assessed and authorized as part of the system, while inheriting controls from the cloud provider for the underlying infrastructure.

Why this answer

In an IaaS cloud deployment, the organization is responsible for the security of the virtual machines, applications, and data it deploys. These components should be included in the authorization boundary because they are under the organization's direct control. The underlying infrastructure, such as physical data centers, hypervisors, and network components, is managed by the cloud provider and should be treated as common controls, with their controls inherited and documented in the system security plan.

Exam trap

The trap here is assuming that all cloud components, including the provider's infrastructure, must be included in the boundary, when in fact only the organization's own components should be included.

Practice this question →
18
MCQhard

When a system boundary is complex and spans multiple geographic locations, what should the practitioner focus on to ensure security consistency?

A.Categorizing each site as a separate information system.
B.Excluding remote offices from the authorization boundary.
C.Allowing each site to define its own unique security policy.
D.Implementing consistent security controls across all boundary nodes regardless of location.
AnswerD

Applying uniform controls at every boundary node directly addresses the stem's constraint: a boundary spanning multiple geographic locations. Consistency across all nodes prevents location-specific gaps or weaker configurations that attackers could exploit, ensuring the same security posture regardless of where each node physically resides.

Why this answer

When a system boundary spans multiple geographic locations, the practitioner must ensure that consistent security controls are implemented across all boundary nodes, regardless of location. This maintains a uniform security posture and ensures that the authorization boundary is protected end-to-end. FIPS 199 and NIST SP 800-37 emphasize that the boundary defines what is included in the authorization, and all components within it must meet the same control baseline.

Exam trap

CGRC often tests the misconception that geographic dispersion justifies splitting the boundary or excluding remote sites, when in fact the exam expects consistent controls across all boundary nodes to maintain a unified security posture.

How to eliminate wrong answers

Option A is wrong because categorizing each site as a separate information system fragments the boundary and may lead to inconsistent controls, defeating the purpose of a unified authorization; it is only appropriate if the sites are truly independent systems. Option B is wrong because excluding remote offices from the authorization boundary creates security gaps and is not permitted if those offices process or store system data; they must be included if they are part of the system. Option C is wrong because allowing each site to define its own security policy undermines consistency and violates the principle of a unified security control baseline across the boundary.

Practice this question →
19
MCQeasy

A program manager is working with the Information System Owner (ISO) to determine the scope of a new payroll system. The system will interface with an external banking system for direct deposits. What should the ISO do regarding the external banking system when defining the authorization boundary?

A.Include the external banking system within the authorization boundary because it processes payroll data.
B.Document the external banking system as an external interface and establish a formal agreement for data exchange.
C.Require the external banking system to undergo a full security assessment by the payroll system's assessment team.
D.Exclude the external banking system entirely from all RMF documentation since it is not part of the boundary.
AnswerB

External systems that interface with the system under consideration are not part of the authorization boundary but must be documented as external interfaces. The ISO should establish an interconnection security agreement (ISA) or similar document to define security responsibilities and data exchange requirements. This ensures that the interface is managed securely without expanding the boundary.

Why this answer

When an external system interfaces with the system being authorized, it is not included in the boundary but must be documented as an external interface. A formal agreement, such as an ISA, defines the security responsibilities and data exchange rules. This approach maintains a clear boundary while ensuring that the interface is securely managed.

The other options either incorrectly include the external system or fail to document it.

Exam trap

The trap here is assuming that an external system must be included in the boundary because it processes the same data, when in fact it should be treated as an external interface with a formal agreement.

Practice this question →
20
MCQmedium

When classifying an information system under FIPS 199, which stakeholder should typically sign off on the final categorization?

A.The Lead System Administrator.
B.The Information System Owner (ISO).
C.The Chief Information Security Officer (CISO).
D.The Third-Party Auditor.
AnswerB

The Information System Owner holds operational accountability for the system and its security posture, so they formally approve the FIPS 199 categorization. Authorising officials and security officers contribute input, but the ISO signs off on the final impact level.

Why this answer

Under FIPS 199 and the NIST RMF, the Information System Owner (ISO) is the stakeholder responsible for the overall procurement, development, integration, modification, operation, and maintenance of the system, and is therefore the appropriate person to sign off on the final security categorization. The ISO ensures the categorization aligns with the system's mission and data sensitivity.

Exam trap

CGRC often tests the confusion between the CISO (who sets policy) and the Information System Owner (who is accountable for the system), so candidates may incorrectly choose the CISO for sign-off.

How to eliminate wrong answers

Option A is wrong because the Lead System Administrator is a technical role focused on day-to-day operations and does not have the authority or responsibility for formal system categorization sign-off. Option C is wrong because the CISO provides oversight and policy but typically does not sign the final categorization; that responsibility rests with the system owner. Option D is wrong because a Third-Party Auditor assesses compliance but does not own the system or have the authority to approve its categorization.

Practice this question →
21
MCQmedium

An organization is defining the authorization boundary for a system that will use a shared database service managed by a different business unit. The database will store sensitive data for multiple systems. What should the security manager do to properly address this shared service in the authorization process?

A.Exclude the shared database entirely and document it as an external interface without any control inheritance.
B.Treat the shared database as a common control provider and inherit its controls via a customer responsibility matrix.
C.Define the boundary to include only the database schema and exclude the underlying infrastructure.
D.Include the shared database within the system boundary and assess all its controls.
AnswerB

When a service is shared across systems, it is often best treated as a common control provider. The organization can inherit the controls implemented by the service provider, documented in a customer responsibility matrix. This avoids redundant assessments and ensures that the controls protecting the shared database are properly evaluated and accepted by the Authorizing Official.

Why this answer

Shared services are optimally handled as common control providers, allowing systems to inherit controls rather than reassess them. A customer responsibility matrix documents which controls are inherited and which remain the system's responsibility. This approach reduces duplication and ensures the Authorizing Official has visibility into the shared controls.

Exam trap

The trap here is assuming that a shared service must either be fully inside the boundary or completely ignored, rather than using a common control provider model with inheritance.

Practice this question →
22
MCQmedium

A security architect is defining the authorization boundary for a new cloud-hosted financial system. The system uses a managed database service and a serverless compute service from the cloud provider. The provider's infrastructure (hypervisor, physical network, data center) is outside the boundary. According to NIST SP 800-37, which statement best describes how the shared responsibility model affects the authorization boundary?

A.The authorization boundary must be expanded to include all cloud provider data centers that host the system, regardless of ownership.
B.The authorization boundary includes only the organization's account, its data, and the configured services, while the provider's underlying infrastructure is inherited and assessed separately.
C.The authorization boundary must include the provider's hypervisor and physical network because they process the organization's data.
D.The authorization boundary is irrelevant in cloud environments because the provider assumes all security responsibilities.
AnswerB

Under the shared responsibility model, the organization's authorization boundary encompasses the components it configures and operates, such as its cloud account, data, and service configurations. The provider's underlying infrastructure is assessed by the provider and inherited by the organization, as described in NIST SP 800-37. This approach avoids duplicating assessments and maintains a clear separation of responsibilities.

Why this answer

In cloud environments, the authorization boundary should encompass the components the organization configures and operates, such as its account, data, and service configurations. The provider's infrastructure is assessed separately and inherited. This aligns with NIST SP 800-37's guidance on defining boundaries and leveraging shared responsibility to avoid unnecessary duplication of assessments.

Exam trap

The trap here is assuming that the authorization boundary must include the cloud provider's infrastructure, when in fact those components are inherited and assessed separately.

Practice this question →
23
MCQhard

You are documenting the system inventory in the Security Assessment Plan (SAP). Which artifact is most effective for demonstrating that all system interconnections have been properly inventoried?

A.The system's latest vulnerability scan report.
B.A comprehensive network topology diagram showing external service endpoints.
C.The organization's enterprise risk register.
D.A listing of all installed software patches.
AnswerB

A network topology diagram maps every interconnection and external service endpoint, directly satisfying the SAP requirement to demonstrate complete interconnection inventory. Unlike prose lists, its visual structure exposes undocumented links and data flows, making omissions immediately apparent during assessment. This evidentiary completeness is what proves all system interconnections have been properly inventoried.

Why this answer

A network topology diagram that shows external service endpoints, connection paths, and system boundaries is the most effective artifact for demonstrating that all system interconnections have been inventoried, because it visually and explicitly maps every connection into and out of the system. The SAP references this diagram to support the interconnection inventory required by NIST 800-53 controls like CA-3 and SA-9. Vulnerability scans, risk registers, and patch lists do not enumerate interconnections.

Exam trap

CGRC often tests the difference between artifacts that describe 'what the system is' (topology, SSP) versus 'what is wrong with it' (scan reports, risk register) — candidates who focus on security posture pick the vulnerability scan instead of the topology diagram.

How to eliminate wrong answers

Option A is wrong because a vulnerability scan report identifies weaknesses in software and configurations, not the set of system interconnections. Option C is wrong because the enterprise risk register tracks risks and mitigations, not the inventory of connections between systems. Option D is wrong because a patch listing shows software update status, which is unrelated to documenting interconnections.

Practice this question →
24
MCQeasy

Which NIST publication provides the definitive guidance on FIPS 199 security categorization?

A.NIST SP 800-37.
B.NIST SP 800-60.
C.NIST SP 800-53.
D.FIPS 140-3.
AnswerB

NIST SP 800-60 provides the definitive guidance for mapping information types to FIPS 199 security categories. It supplies the impact-level assignments that organisations apply when categorising systems, making it the authoritative companion to FIPS 199 itself.

Why this answer

NIST SP 800-60, 'Guide for Mapping Types of Information and Information Systems to Security Categories,' is the definitive guidance that operationalizes FIPS 199. FIPS 199 defines the categorization model (low/moderate/high for confidentiality, integrity, availability), while SP 800-60 provides the actual mapping tables and methodology for assigning those impact levels to specific information types. Together they form the categorization foundation of the RMF.

Exam trap

CGRC often tests the confusion between the publication that defines the categorization model (FIPS 199) and the publication that provides the mapping guidance (SP 800-60), causing candidates to select SP 800-37 or SP 800-53 based on familiarity rather than the specific 'definitive guidance' wording.

How to eliminate wrong answers

Option A is wrong because NIST SP 800-37 is the Risk Management Framework guide—it describes the six-step RMF process (Categorize, Select, Implement, Assess, Authorize, Monitor), not the detailed categorization mapping. Option C is wrong because NIST SP 800-53 is the security and privacy control catalog (the 'what controls to implement'), which comes after categorization. Option D is wrong because FIPS 140-3 is the cryptographic module validation standard, entirely unrelated to information categorization.

Practice this question →
25
Multi-Selectmedium

When defining the system boundary, which TWO of the following factors should be considered? (Select TWO)

Select 2 answers
A.The information types processed, stored, or transmitted by the system.
B.The organizational personnel who have access to the system.
C.The fiscal budget allocated for hardware replacement.
D.The interconnections with other internal and external systems.
E.The physical location of the cloud data center.
AnswersA, D

Information types processed, stored, or transmitted determine what data the system handles, which shapes where the boundary must be drawn to encompass all relevant processing. This satisfies the factor of scoping the system around its data flows.

Why this answer

Option A is correct because defining the system boundary requires identifying the information types that are processed, stored, or transmitted by the system, since the boundary must encompass all data flows and information assets subject to the applicable security controls and categorization (e.g., FIPS 199 / SP 800-60 impact levels). Option D is correct because the system boundary must account for all interconnections with other internal and external systems, as these connections define where the system ends and where external dependencies, shared services, and cross-boundary data exchanges begin (e.g., documented in the SSP's system boundary description and interconnection agreements). Option B is not a defining factor of the boundary itself; personnel access is an authorization and access-control consideration that applies within the boundary rather than determining where it lies.

Option C is incorrect because budget for hardware replacement is a lifecycle and funding concern, not a boundary-defining attribute. Option E is incorrect because the physical location of a cloud data center is a deployment and infrastructure detail; the boundary is defined by logical and data-flow scope, not by geography.

Exam trap

CGRC often tests the misconception that the system boundary is defined by physical location or organizational ownership, when it is actually defined by information types and logical interconnections.

Practice this question →
26
MCQeasy

When defining the scope of an information system, what is the primary purpose of identifying 'common controls'?

A.To ensure they are manually tested for every individual system.
B.To increase the system's FIPS 199 impact level.
C.To identify controls that are implemented once and applied to multiple systems.
D.To exclude them from the System Security Plan (SSP).
AnswerC

Common controls are security measures inherited by multiple systems from a shared provider, such as an enterprise data centre's physical access controls. Identifying them during scoping avoids duplicating assessment effort, letting each system document inheritance rather than reimplementing the same control.

Why this answer

Common controls are security controls that are implemented once — typically at the organization, facility, or shared-service level — and inherited by multiple information systems. Identifying them during scope definition lets the organization document inheritance in each system's SSP, avoid duplicative testing, and focus system-specific assessment on controls not covered by the common provider. This is a core RMF/SP 800-37 concept for efficient authorization.

Exam trap

CGRC often tests the misconception that common controls are excluded from the SSP or must be retested per system, when in fact they are documented as inherited and assessed once by the common control provider.

How to eliminate wrong answers

Option A is wrong because common controls are precisely the controls that do NOT need to be manually tested for every individual system; they are assessed once at the common provider level and inherited. Option B is wrong because identifying common controls has no effect on the FIPS 199 impact level, which is determined by the potential impact of loss of confidentiality, integrity, and availability. Option D is wrong because common controls are not excluded from the SSP; they are documented in the SSP as inherited controls with a reference to the common control provider.

Practice this question →
27
Multi-Selecthard

Which THREE of the following are essential components of an effective system inventory for a federal agency? (Select THREE)

Select 3 answers
A.System interconnections and data flow paths.
B.Hardware serial numbers and physical asset tags.
C.The employee performance evaluation score for the system admin.
D.The exact date of the last office coffee machine maintenance.
E.Software versions and patch levels.
AnswersA, B, E

Mapping interconnections and data flow paths establishes which systems exchange data and through which boundaries, a prerequisite for authorisation boundary and contingency planning. Without this, the inventory cannot show dependency chains, so it satisfies the federal requirement for a complete, security-relevant system inventory.

Why this answer

Option A is correct because an effective system inventory must document system interconnections and data flow paths, which are required by NIST SP 800-53 controls (e.g., CA-3, AC-4) to understand boundary crossings, shared interfaces, and information exchange flows for authorization and risk assessment. Option B is correct because hardware serial numbers and physical asset tags provide unique identification and traceability of assets, supporting configuration management (CM-8) and enabling accurate tracking of ownership, location, and lifecycle status. Option E is correct because recording software versions and patch levels is essential for vulnerability management (RA-5, SI-2), allowing the agency to identify outdated or unpatched components and prioritize remediation.

Option C does not belong because employee performance evaluation scores are personnel records unrelated to technical system inventory or security posture. Option D does not belong because coffee machine maintenance dates are facility trivia with no bearing on IT asset inventory, configuration management, or federal security requirements.

Exam trap

CGRC often tests the inclusion of irrelevant items (like coffee machine maintenance or employee evaluations) to see if candidates can distinguish between essential system inventory components and unrelated operational data.

Practice this question →
28
MCQeasy

Which of the following is an example of a 'System Boundary' document that assists with the RMF process?

A.The System Security Plan (SSP) boundary description.
B.The Annual Security Awareness Training log.
C.The Privacy Threshold Analysis (PTA).
D.The System Development Life Cycle (SDLC) policy.
AnswerA

The SSP's boundary description explicitly documents the authorisation boundary — the people, processes, and information systems comprising the system — which directly satisfies the RMF requirement for a defined System Boundary artefact used during categorisation and control scoping.

Why this answer

The System Security Plan (SSP) is the RMF artifact that documents the system boundary — the people, processes, and technologies that make up the system and its authorization boundary. The boundary description within the SSP defines what is inside versus outside the authorization, which directly supports categorization, control selection, and assessment scoping in the RMF process.

Exam trap

CGRC often tests the confusion between RMF artifacts — candidates must distinguish the SSP (which contains the boundary description) from privacy documents like the PTA and governance documents like SDLC policy.

How to eliminate wrong answers

Option B is wrong because an Annual Security Awareness Training log is an evidence artifact for AT-family controls (AT-2), not a boundary document. Option C is wrong because a Privacy Threshold Analysis determines whether a system processes personally identifiable information and whether a PIA is required — it is a privacy scoping document, not a system boundary definition. Option D is wrong because an SDLC policy is an organizational governance document describing how systems are developed and maintained, not a description of a specific system's authorization boundary.

Practice this question →
29
MCQmedium

An Information System Owner (ISO) is deciding whether to include a legacy database within a new application's authorization boundary. What is the deciding factor?

A.The dependency of the system on the database for operational integrity.
B.Whether the database is hosted in the same physical rack.
C.The age of the hardware.
D.The amount of data stored.
AnswerA

Inclusion depends on whether the application depends on the database for operational integrity; if the system cannot function correctly without it, the database belongs inside the authorization boundary. This dependency, not ownership or age, determines the boundary decision.

Why this answer

The deciding factor for including a legacy database in an authorization boundary is whether the system depends on it for operational integrity — that is, whether the database's confidentiality, integrity, or availability directly affects the system's security posture and mission. If the application cannot function correctly or securely without the database, the database is within the boundary (or must be treated as an interconnected system with a documented interface). Physical location, hardware age, and data volume are not boundary criteria.

Exam trap

CGRC often tests the misconception that physical location, hardware age, or data volume determines authorization boundary scope, when the actual criterion is operational and security dependency.

How to eliminate wrong answers

Option B is wrong because physical co-location in the same rack is irrelevant to authorization boundary determination; boundaries are logical and based on dependency and control, not physical proximity. Option C is wrong because the age of the hardware has no bearing on whether the database is part of the system's boundary; legacy hardware can still be in scope if the system depends on it. Option D is wrong because the amount of data stored does not determine boundary inclusion; even a small database can be in scope if the system relies on it for security-relevant functions.

Practice this question →
30
Multi-Selectmedium

A system owner is defining the authorization boundary for a new information system that will process personally identifiable information (PII). The system will use a cloud-based customer relationship management (CRM) service, an on-premises database, and a web application hosted on a government-furnished server. Which TWO components should be included within the authorization boundary? (Choose two.)

Select 2 answers
A.The web browser used by end users to access the web application.
B.The cloud-based CRM service that stores and processes PII.
C.The internet service provider (ISP) that provides connectivity to the cloud CRM service.
D.The physical security controls of the data center hosting the on-premises database, if they are provided by a separate facility management unit.
E.The on-premises database that stores PII.
AnswersB, E

The CRM service stores and processes PII, which is system data. Under FIPS 199 and NIST SP 800-37, any component that processes, stores, or transmits system data must be within the authorization boundary. Excluding it would leave a critical part of the system unassessed and could result in an incomplete risk picture. The boundary must include the CRM service to ensure its controls are evaluated and the PII is protected appropriately.

Why this answer

The authorization boundary must include all components that process, store, or transmit system data. The cloud CRM service and the on-premises database both handle PII, so they are within the boundary. Physical security controls from a separate unit are common controls, while the ISP and web browser are external to the system's data processing.

Correctly scoping the boundary ensures a complete risk assessment and accurate FIPS 199 categorization.

Exam trap

The trap here is including supporting infrastructure like ISPs or client devices in the boundary, when the focus should be on components that process, store, or transmit system data.

Practice this question →
31
MCQmedium

Which document is mandatory to finalize the system categorization and begin the RMF process?

A.The Incident Response Policy.
B.The Penetration Test Report.
C.The FIPS 199 Security Categorization document.
D.The Contingency Plan.
AnswerC

FIPS 199 categorisation assigns the confidentiality, integrity and availability impact levels that drive every subsequent RMF step, so the completed Security Categorization document is the mandatory artefact that formally closes categorisation and authorises the process to begin.

Why this answer

The FIPS 199 Security Categorization document is mandatory to finalize the system categorization and formally begin the RMF process. It documents the security category of the system based on the potential impact of a breach, and without it, the subsequent RMF steps (selecting controls, assessing, authorizing) cannot be properly executed.

Exam trap

CGRC often tests the sequence of RMF steps, and candidates may confuse later artifacts like the Contingency Plan or Penetration Test Report as prerequisites, when the FIPS 199 categorization is the mandatory first step.

How to eliminate wrong answers

Option A is wrong because an Incident Response Policy is an organizational-level policy that guides incident handling but is not a prerequisite for system categorization or starting the RMF. Option B is wrong because a Penetration Test Report is a technical assessment artifact that may inform security control assessment but is not required to finalize categorization. Option D is wrong because a Contingency Plan is a security control documentation that comes later in the RMF process, not a prerequisite for categorization.

Practice this question →
32
MCQeasy

A program manager is preparing documentation for a new system and needs to describe the system boundary. Which artifact is specifically designed to depict the system boundary and its interfaces?

A.Plan of Action and Milestones (POA&M)
B.System Security Plan (SSP)
C.Authorization Boundary Diagram
D.Privacy Impact Assessment (PIA)
AnswerC

The Authorization Boundary Diagram is a visual representation that explicitly defines the system boundary, showing components, interfaces, and data flows. It is a key artifact used by the Authorizing Official to understand what is included in the assessment. This diagram helps ensure that all necessary components are assessed and that external connections are clearly identified.

Why this answer

The Authorization Boundary Diagram is the artifact specifically created to depict the system boundary, including components and interfaces. It provides a clear visual scope for the assessment and is essential for the Authorizing Official to understand what is being authorized. Other documents like the SSP reference the boundary but do not serve as the primary depiction.

Exam trap

The trap here is confusing the SSP, which documents controls, with the diagram that actually defines the boundary scope.

Practice this question →
33
Multi-Selecthard

A federal agency is defining the authorization boundary for a new system that will process controlled unclassified information (CUI). The system will use a combination of on-premises servers, a platform as a service (PaaS) offering, and a software as a service (SaaS) application. The agency's Information System Owner (ISO) is working with the security team to determine which components should be included in the boundary. Which TWO of the following are appropriate considerations when defining this boundary? (Choose two.)

Select 2 answers
A.The boundary must include all cloud components regardless of the provider's authorization status to ensure end-to-end security.
B.The on-premises servers are included in the boundary because they are under the agency's direct control and process CUI.
C.The SaaS application is excluded from the boundary if the provider has a current FedRAMP authorization and the agency documents the inherited controls.
D.The boundary should be defined based on the physical location of the servers to ensure data sovereignty requirements are met.
E.The PaaS provider's underlying infrastructure is included in the boundary because the agency's applications run on it.
AnswersB, C

On-premises servers that are owned and managed by the agency and process CUI are clearly within the authorization boundary. The agency is responsible for implementing and assessing controls on these servers. Including them ensures that the security assessment covers all components under the agency's control that handle sensitive data.

Why this answer

The boundary should include components under the agency's direct control that process CUI, such as on-premises servers. For cloud services with FedRAMP authorizations, the agency can exclude those components if it documents inherited controls and accepts residual risk. This approach aligns with NIST guidance on leveraging external authorizations and focusing on the agency's own responsibilities.

Exam trap

The trap here is either including all cloud components regardless of authorization or excluding on-premises components, when the correct approach is to include agency-controlled components and leverage provider authorizations for cloud services.

Practice this question →
34
MCQhard

A Security Control Assessor is reviewing the authorization boundary of a high-impact system that uses a shared common control provided by a separate organizational unit. The common control's assessment was performed by that unit, and the results are documented in a shared assessment report. What should the Assessor do to support the system's authorization?

A.Review the shared assessment report to determine if it meets the system's assurance requirements and document any inheritance of the control in the system security plan.
B.Re-assess the common control independently because the system's high-impact level requires a full assessment of all controls.
C.Perform a penetration test of the common control to validate the shared assessment report before accepting it.
D.Exclude the common control from the system's assessment because it is outside the system's authorization boundary.
AnswerA

NIST SP 800-37 Rev. 2 and SP 800-53A permit leveraging assessment results from common controls if they are current, sufficient, and applicable. The Assessor should review the shared report against the system's assurance needs, then document the inheritance in the SSP. This approach avoids redundant work while ensuring the control is appropriately evaluated. It supports an efficient and accurate authorization decision.

Why this answer

Common controls can be leveraged across systems, and their assessment results can be reused if they meet the receiving system's assurance requirements. The Assessor should review the shared report for currency, scope, and relevance, then document the inheritance in the system security plan. Re-assessing or excluding the control would be inefficient or incorrect.

This practice aligns with the RMF's goal of reuse and reciprocity.

Exam trap

The trap here is thinking that high-impact systems require independent re-assessment of all common controls, when in fact leveraging valid shared assessments is encouraged.

Practice this question →
35
MCQhard

A security assessor is reviewing a system boundary for a high-impact system. The boundary includes a web server, an application server, and a database server, all located in the same data center. The system also uses an external identity provider for authentication. During the review, the assessor notices that the identity provider is not listed in the boundary diagram. What is the most significant risk of this omission?

A.The identity provider's controls will not be assessed, potentially leaving authentication vulnerabilities unaddressed.
B.The boundary diagram will be rejected by the Authorizing Official for formatting errors.
C.The system will be automatically categorized as low-impact due to the missing component.
D.The external identity provider will be required to undergo a separate full authorization, delaying the project.
AnswerA

If the identity provider is omitted from the boundary, its controls may not be included in the assessment, creating a gap in authentication security. Even if it is an external service, the system relies on it, so its controls must be either assessed or inherited. The omission could lead to unmitigated risks that affect the entire system's authorization.

Why this answer

Omitting the external identity provider from the boundary means its security controls may not be assessed or formally inherited, creating a critical gap in authentication. The Authorizing Official needs to understand all dependencies to make an informed risk decision. The most significant risk is that authentication vulnerabilities remain unaddressed, potentially compromising the entire system.

Exam trap

The trap here is focusing on procedural or documentation consequences rather than the actual security gap created by an unassessed critical dependency.

Practice this question →
36
MCQmedium

An Information System Owner (ISO) is defining the authorization boundary for a system that consists of a web front-end, an application server, and a database. The database is hosted in a separate virtual private cloud (VPC) managed by the same organization. The ISO wants to minimize the boundary while ensuring all necessary components are included. What should the ISO do?

A.Define the boundary as the entire organization's network because all components are managed by the same organization.
B.Include the web front-end, application server, and database in the boundary, and document the network segmentation and controls between the VPCs.
C.Include only the web front-end and application server, treating the database as an external service because it is in a separate VPC.
D.Include the web front-end, application server, and database, but exclude the network infrastructure that connects the VPCs.
AnswerB

The database is part of the system because it stores and processes data. Even though it resides in a separate VPC, it is managed by the same organization and supports the system's functionality. The ISO should include all three components and document the interconnections and security controls. This ensures a complete assessment and accurate categorization. The boundary should reflect the logical system, not just physical proximity.

Why this answer

The authorization boundary must include all components that process, store, or transmit system data, regardless of their location. The database, even in a separate VPC, is part of the system. Documenting the network segmentation and controls ensures that the interconnections are assessed.

Excluding the database or the network infrastructure would create gaps, while including the entire organization would be overbroad. The ISO should define a boundary that accurately reflects the system's logical and physical components.

Exam trap

The trap here is assuming that a separate VPC automatically places the database outside the authorization boundary, when data processing determines inclusion.

Practice this question →
37
MCQeasy

A security analyst is documenting the authorization boundary for a new system. The system will be deployed on a government cloud environment and will interface with an external identity provider for authentication. The identity provider is owned and operated by another agency. How should the analyst represent the external identity provider in the authorization boundary documentation?

A.Represent the identity provider as a common control that is fully inherited without further documentation.
B.Document the identity provider as an external interface and describe the trust relationship and any inherited controls.
C.Exclude the identity provider entirely from the boundary documentation because it is external.
D.Include the identity provider as an internal component of the system boundary because it is critical to authentication.
AnswerB

Documenting the identity provider as an external interface is correct because it is outside the system's direct control but is essential for authentication. NIST SP 800-37 requires that external interfaces and dependencies be described, including trust relationships and inherited controls. This ensures that the system's security posture accounts for the external service's risks and that any reliance on its controls is justified.

Why this answer

The external identity provider should be documented as an external interface, with details about the trust relationship and any inherited controls. This aligns with NIST SP 800-37, which requires external dependencies to be described in the authorization boundary documentation. This ensures that the system's risk assessment considers the provider's security posture and any reliance on its controls.

Exam trap

The trap here is either including the external identity provider as an internal component or omitting it entirely, rather than documenting it as an external interface.

Practice this question →
38
Multi-Selecteasy

When applying FIPS 199 to an information system, which TWO security objectives must be evaluated for potential impact? (Select TWO)

Select 2 answers
A.Availability.
B.Authentication.
C.Accountability.
D.Non-repudiation.
E.Confidentiality.
AnswersA, E

Availability is one of the two security objectives FIPS 199 requires you to assess, alongside integrity and confidentiality. The standard directs agencies to evaluate the potential impact on availability — ensuring timely and reliable access to information — when categorising an information system's security level.

Why this answer

FIPS 199 defines three security objectives for information types and information systems: confidentiality, integrity, and availability, so the two correct answers here are A (Availability) and E (Confidentiality). Availability (A) is correct because FIPS 199 requires assessing the potential impact of a loss of timely and reliable access to the system and its data, with the resulting categorization of low, moderate, or high. Confidentiality (E) is correct because FIPS 199 requires evaluating the impact of unauthorized disclosure of information, again producing a low, moderate, or high rating.

The unmarked options do not belong because authentication, accountability, and non-repudiation are not among the three FIPS 199 impact objectives; they are related security services or controls addressed in other standards such as FIPS 200 and NIST SP 800-53, not the FIPS 199 impact triad.

Exam trap

CGRC often tests the confusion between the FIPS 199 security objectives (confidentiality, integrity, availability) and other security services like authentication, accountability, and non-repudiation, which are not part of the categorization triad.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Scope OF System questions.

Start 20-question session