CGRC Practice Question: When applying FIPS 199 to an information system, which TWO security objectives must be…
When applying FIPS 199 to an information system, which TWO security objectives must be evaluated for potential impact? (Select TWO)
⚠ Common exam trap
CGRC often tests the confusion between the FIPS 199 security objectives (confidentiality, integrity, availability) and other security services like authentication, accountability, and non-repudiation, which are not part of the categorization triad.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Availability.
FIPS 199 defines three security objectives for information types and information systems: confidentiality, integrity, and availability, so the two correct answers here are A (Availability) and E (Confidentiality). Availability (A) is correct because FIPS 199 requires assessing the potential impact of a loss of timely and reliable access to the system and its data, with the resulting categorization of low, moderate, or high. Confidentiality (E) is correct because FIPS 199 requires evaluating the impact of unauthorized disclosure of information, again producing a low, moderate, or high rating. The unmarked options do not belong because authentication, accountability, and non-repudiation are not among the three FIPS 199 impact objectives; they are related security services or controls addressed in other standards such as FIPS 200 and NIST SP 800-53, not the FIPS 199 impact triad.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Availability.
Why this is correct
Availability is one of the two security objectives FIPS 199 requires you to assess, alongside integrity and confidentiality. The standard directs agencies to evaluate the potential impact on availability — ensuring timely and reliable access to information — when categorising an information system's security level.
- ✗
Authentication.
Why it's wrong here
Authentication establishes identity before access; FIPS 199 instead categorises potential impact against confidentiality, integrity and availability. It is tempting because authentication is a core security service and a common control selection, but the standard's impact evaluation is performed only against the C-I-A triad.
- ✗
Accountability.
Why it's wrong here
FIPS 199 evaluates confidentiality, integrity and availability; accountability is not one of those three objectives. It is tempting because accountability underpins audit and access governance, and it appears in broader control frameworks, but impact categorisation under FIPS 199 is performed solely against the C-I-A triad.
- ✗
Non-repudiation.
Why it's wrong here
FIPS 199 categorises impact against confidentiality, integrity and availability only; non-repudiation is not one of the three objectives. It is tempting because non-repudiation is a recognised security service in other models such as ISO 7498-2, but FIPS 199 impact analysis is confined to the C-I-A triad.
- ✓
Confidentiality.
Why this is correct
FIPS 199 requires assessing potential impact on confidentiality, integrity and availability — the three security objectives. Confidentiality is one of the two objectives this question asks for, covering unauthorised disclosure of information. Selecting it satisfies the stem's requirement to identify objectives evaluated during the FIPS 199 impact categorisation.
About these practice questions
One of 341 original CGRC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- What is the primary risk of having an inaccurately defined authorization boundary?
- A security analyst is defining the authorization boundary for a new financial system hosted entirely within a commercial…
- A program manager is preparing to categorize a new information system under FIPS 199. The system will handle financial d…
- A federal agency is initiating the authorization process for a new information system. The system owner is working with…
- A security manager is leading an effort to define the authorization boundary for a system that uses a virtualized enviro…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.