System Compliance

During a security assessment, the assessor discovers that a system's audit logging control is implemented but the logs are not being reviewed regularly. The control is technically configured correctly. How should the assessor document this finding in the Security Assessment Report (SAR)?

When a system is undergoing a major change, what is the impact on the existing ATO?

A system owner is preparing to submit a system for authorization. The system processes sensitive but unclassified information. The Authorizing Official (AO) requires a formal document that describes the system's security controls and how they are implemented. Which document should the system owner provide?

What is the purpose of the Security Assessment Report (SAR)?

You are the Information System Security Officer (ISSO) for a system undergoing a security control assessment. The assessor has completed testing and provided results. As part of the compliance determination process, you must review the assessment findings and determine the overall compliance status. Which TWO factors are most critical when determining whether a security control is compliant? (Choose two.)

You are auditing an organization's POA&M process. Which of the following indicates an ineffective process?

You are the Information System Security Officer (ISSO) for a federal system undergoing an annual assessment. The assessor reports that a boundary protection control is only partially implemented: the firewall ruleset is outdated, and several unnecessary ports are open. The system owner asks how this should be reflected in the System Security Plan (SSP). What is the most appropriate action?

You are the Information System Security Officer (ISSO) for a federal system that has just completed a security control assessment. The assessor identified several findings, and you are now preparing the Plan of Action and Milestones (POA&M). The system owner asks you to explain the primary purpose of the POA&M in the context of continuous monitoring. What should you say?

Which phase of the RMF includes the 'continuous monitoring' of security controls?

Which THREE elements are necessary for a compliant continuous monitoring program?

An Authorizing Official grants an 'ATO with Conditions.' What does this mean for the system owner?

A federal agency is preparing for a continuous monitoring assessment of a high-impact system. The Information System Security Officer (ISSO) must ensure that the security assessment plan (SAP) includes appropriate methods for assessing a new encryption control. Which combination of assessment methods should the ISSO verify are included to provide the most reliable evidence?

You are utilizing the NIST SP 800-37 R2 process for an Authorization to Operate (ATO). At what point is the Security Assessment Report (SAR) presented to the Authorizing Official?

Which TWO factors should an ISSO consider when determining if a system change requires a re-authorization?

You are developing a continuous monitoring strategy for a federal information system as part of the Risk Management Framework (RMF) process. According to NIST SP 800-137, which TWO of the following are essential components of an effective continuous monitoring program? (Choose two.)

Which TWO actions should an ISSO take when a critical security control is found to be ineffective during assessment?

A contractor provides a service for your organization. How do you ensure the contractor's system is compliant?

An Authorizing Official (AO) is reviewing a Plan of Action and Milestones (POA&M) for a high-impact system. What is the AO's primary responsibility regarding this document?

If a security control is deemed 'Not Applicable' (NA) in the System Security Plan (SSP), what must the system owner provide?

A system owner is preparing to transition a system into the operations and maintenance phase. The Authorizing Official has granted an Authorization to Operate (ATO). What is the primary compliance activity that must continue during this phase?

A system owner is preparing to authorize a system for operation. The Security Assessment Report (SAR) contains a finding that a high-impact security control is not implemented. The Authorizing Official (AO) decides to accept the risk and grant an Authorization to Operate (ATO). What document must the AO sign to formally accept the risk?

You are preparing a continuous monitoring strategy for a federal information system in accordance with NIST SP 800-137. Which TWO activities are essential components of the continuous monitoring program? (Choose two.)

When assessing a cloud service provider (CSP) using a FedRAMP-authorized solution, what is the primary benefit to your organization?

Which THREE of the following are valid components of an Authorization Package?

Which THREE categories of controls are identified in NIST SP 800-53?

You are the Information System Security Officer (ISSO) for a federal financial system undergoing an annual assessment. The Security Control Assessor (SCA) has completed the assessment and documented several controls as 'Other than Satisfied' in the Security Assessment Report (SAR). According to NIST SP 800-37 Revision 2, what is the primary next step the Authorizing Official (AO) must take before making an authorization decision?

An Information System Security Officer (ISSO) is reviewing the Security Assessment Report (SAR) for a system that is undergoing initial authorization. The SAR indicates that a high-impact system has a control that is only partially implemented. What should the ISSO recommend to the Authorizing Official (AO)?

Which TWO of the following are responsibilities of the Authorizing Official?

Which document provides the formal authority to operate a system?

During a system compliance review, the Security Control Assessor (SCA) issues a finding that a critical security control is only partially implemented. The system owner disagrees and wants to proceed with authorization. As the Information System Security Officer (ISSO), what should you do FIRST?

What is the relationship between the System Security Plan (SSP) and the Security Assessment Report (SAR)?

You are the Information System Security Officer (ISSO) for a federal payroll system undergoing an annual assessment. The Security Control Assessor (SCA) reports that a firewall rule allowing inbound RDP from any source is in place, contradicting the documented configuration in the System Security Plan (SSP). The system owner argues the rule is temporary for a migration. What is the most appropriate immediate action?

Which THREE types of information should be included in a risk acceptance memo?

A federal agency is preparing for an Authorization to Operate (ATO) for a new cloud-based system. The system owner wants to leverage a FedRAMP authorization from the cloud service provider (CSP) to reduce assessment effort. Which document should the system owner obtain from the CSP to understand the security controls inherited and those that require agency assessment?

During a security assessment of a cloud-based system, the Security Control Assessor (SCA) determines that a cryptographic module used for data at rest does not meet FIPS 140-2 validation requirements. The system owner argues that the module is provided by the cloud service provider (CSP) and is therefore outside their control. As the ISSO, what should you do first to address this finding?

An information system security officer (ISSO) is preparing the Security Assessment Plan (SAP) in the NIST Risk Management Framework. Which component must be identified first to ensure the assessment coverage is adequate?

A system owner is preparing to accept a risk for a low-impact information system. The system has a minor weakness that cannot be remediated in the next 30 days. Which document must the system owner sign to formally accept the risk?

An organization is implementing a continuous monitoring program for its information systems in accordance with NIST SP 800-137. Which TWO activities are essential components of this program? (Choose two.)

You are the Information System Security Officer (ISSO) for a federal system undergoing a periodic security control assessment. During the assessment, the assessor identifies that a high-impact security control is only partially implemented. According to NIST SP 800-37 Rev. 2, what should be your immediate next step?

An organization is using a FedRAMP-authorized cloud service provider (CSP) for a new system. The ISSO must determine how to leverage the CSP's authorization to reduce the assessment burden for the new system. Which approach is most appropriate according to FedRAMP guidance?

A system is found to have a critical vulnerability that cannot be patched. You are documenting a risk acceptance request. What is the most critical piece of information to include for the AO?

When determining compliance for a cloud-based service, which document serves as the primary evidence of the provider's security controls?

An organization is using a cloud service provider (CSP) for a system that processes moderate-impact data. The CSP has a FedRAMP authorization. What is the most efficient way for the organization to leverage the CSP's authorization to support its own system's authorization?

You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?

You are the ISSO for a system that has just received an Authorization to Operate (ATO). To maintain the authorization, you must implement continuous monitoring. Which TWO activities are essential components of a continuous monitoring program according to NIST SP 800-137? (Choose two.)

During a security control assessment, the assessor finds that a system uses encryption that does not meet the required FIPS 140-2 validation. The system owner argues that the encryption is stronger but not validated. According to NIST SP 800-53, what is the most appropriate action?

An organization is preparing for a security control assessment of a high-impact system. The assessment team plans to use a combination of methods. Which TWO actions should the assessment team take to ensure the assessment is reliable and repeatable? (Choose two.)

During the compliance determination phase, you discover that a legacy application lacks multi-factor authentication (MFA) but is isolated within a physically secured enclave. Which action should you take to document this in the Security Assessment Report (SAR)?

While reviewing a system's compliance, you notice the Security Control Assessor (SCA) used an interview method for a technical control that requires automated testing. How should you address this in your review?

You are the Information System Security Officer (ISSO) for a federal system that has an approved Authority to Operate (ATO). During a continuous monitoring review, the system owner asks you to explain why a new vulnerability scan finding must be documented in the Plan of Action and Milestones (POA&M) rather than simply fixed and closed. What is the most appropriate reason?

What is the primary role of the Security Control Assessor (SCA)?