Match each NIST SP 800-53 control family to its focus area.
Drag a concept onto its matching description — or click a concept then click the description.
Access Control
Audit and Accountability
System and Communications Protection
System and Information Integrity
Physical and Environmental Protection
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Access Control: Mechanisms for limiting access to resources based on user identity and permissions
NIST SP 800-53 provides security and privacy controls; each family addresses a specific domain.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Access Control: Mechanisms for limiting access to resources based on user identity and permissions
Why this is correct
The Access Control (AC) family includes controls that enforce authorization and restrict access to system resources.
Awareness and Training: Focuses on making personnel aware of security risks and training them to follow security policies
Why this is correct
The Awareness and Training (AT) family ensures personnel receive appropriate security awareness and role-based training.
Audit and Accountability: Controls related to physical security of facilities and environmental protections
Why it's wrong here
Incorrect — this describes the Physical and Environmental Protection (PE) family, not Audit and Accountability (AU) which deals with auditing and monitoring.
Configuration Management: Controls for incident response procedures
Why it's wrong here
Incorrect — this describes the Incident Response (IR) family, not Configuration Management (CM) which focuses on managing system configurations.
Access Control: Focuses on ensuring personnel receive security awareness training
Why it's wrong here
Incorrect — this describes the Awareness and Training (AT) family, not Access Control (AC).
Go deeper
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.