CGRC Practice Question: You have determined that a system's data is publicly available, but the system is…
You have determined that a system's data is publicly available, but the system is responsible for providing critical government services. If the system goes offline, the loss of availability is catastrophic. How should the FIPS 199 categorization be adjusted?
⚠ Common exam trap
CGRC often tests the misconception that publicly available data automatically makes a system Low impact overall, causing candidates to ignore the independent High availability impact and choose the all-Low option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confidentiality=Low, Integrity=Low, Availability=High.
FIPS 199 requires separate categorization of the three security objectives: confidentiality, integrity, and availability. Because the data is publicly available, confidentiality impact is Low; because the question gives no indication of integrity requirements, integrity defaults to Low. However, the system provides critical government services and catastrophic loss of availability means the availability impact must be High, producing Confidentiality=Low, Integrity=Low, Availability=High.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Exclude the system from FIPS 199 requirements.
Why it's wrong here
FIPS 199 applies to all federal information systems; no system is exempt because its data is public. Exemption is tempting because publicly available data suggests no confidentiality impact, and would fit a system outside FIPS 199's scope, such as a privately owned system not supporting federal operations.
- ✗
Categorize only based on Confidentiality.
Why it's wrong here
FIPS 199 requires separate ratings for confidentiality, integrity and availability; categorising on confidentiality alone omits the catastrophic availability impact. Focusing on confidentiality is tempting because the data is public, and would be correct only where availability and integrity losses are negligible.
- ✓
Confidentiality=Low, Integrity=Low, Availability=High.
Why this is correct
FIPS 199 rates each security objective separately at Low, Moderate or High based on the potential impact of loss. Public data means confidentiality and integrity breaches cause limited harm, so both stay Low, but catastrophic loss of availability for a critical government service raises that objective to High.
- ✗
Confidentiality=Low, Integrity=Low, Availability=Low.
Why it's wrong here
Availability must be rated High because catastrophic loss of a critical service is the FIPS 199 definition of high impact; Low contradicts the stated outage consequence. Rating all three Low is tempting when data is public, and would be correct only if confidentiality, integrity and availability losses were all limited.
About these practice questions
Courseiva writes every CGRC question from scratch — 341 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- Your organization is transitioning to a 'System of Systems' architecture. When defining the boundary for one sub-system,…
- A federal agency is deploying a new cloud-based case management system. The system consists of a web front end, an appli…
- An organization is beginning the RMF process for a new human resources system. The Information System Owner (ISO) needs…
- You are assessing a system that utilizes a shared service for identity management. How should this be reflected in the s…
- Which THREE artifacts are commonly used by the Authorizing Official (AO) to validate the system boundary? (Select THREE)
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.