Control Selection

During a control audit, you find that the organization has documented a 'common control' for password complexity. What does this imply for individual systems?

What document provides the most granular guidance on tailoring security controls for federal systems?

An organization is applying NIST SP 800-53 Rev. 5 controls to a cloud-based SaaS application. The authorization official requests that you perform 'supplementing' during the tailoring process. What is the correct action?

Which THREE actions are essential to correctly manage assignments in NIST 800-53 controls?

Which TWO of the following are considered 'common controls'?

Which TWO of the following characterize the 'Select' step in the RMF?

Your organization has decided to use a 'Control Overlay' for a cloud environment. What is the primary benefit of using an overlay?

Which THREE factors should an organization consider when applying control overlays?

You are preparing a security plan for a federal information system categorized as MODERATE impact. According to NIST SP 800-53B, what is the primary objective of the initial control baseline selection process?

What is the primary role of the authorization official (AO) during the Control Selection phase?

When selecting controls for a system that uses mobile devices, you apply an overlay. What is the correct relationship between the baseline and the overlay?

Which THREE of the following are benefits of using the NIST 800-53 control framework?

When utilizing the NIST 800-53 control catalog, which field identifies the specific family to which a control belongs?

Which THREE of the following are components that must be included when documenting a compensating control?

Which TWO of the following statements regarding the 'Tailoring' process are accurate?

If a control is determined to be 'system-specific', what does that mean?

During tailoring, what is the 'Refinement' process?

You are assessing a system. You find a control that is marked as 'Inherited'. What is the most critical item to verify?

You are tailoring controls for a system that does not process PII. Which action should you take regarding the Privacy (PRIV) family controls in the NIST 800-53 catalog?

Which document defines the security control baselines (Low, Moderate, High) for federal information systems?

A control in the NIST 800-53 catalog has a parameter that reads: '[Assignment: organization-defined frequency]'. What is your responsibility as the system owner?

You are tailoring a baseline and encounter a control marked as 'Not Applicable'. What is the correct documentation approach?

Which TWO of the following are valid reasons for tailoring a NIST 800-53 control baseline?

A system owner determines that a specific NIST 800-53 control cannot be implemented due to legacy hardware constraints. They choose to implement a different control to mitigate the same risk. This is an example of what?

Your organization is applying NIST SP 800-53 controls to a hybrid cloud infrastructure. What is the main purpose of utilizing the 'Control Catalog'?

When selecting controls, you notice that a specific NIST 800-53 control includes 'assignment' statements. What is the purpose of these statements?

Which of the following describes a 'Hybrid' control?