System Compliance

When a system is undergoing a major change, what is the impact on the existing ATO?

What is the purpose of the Security Assessment Report (SAR)?

You are auditing an organization's POA&M process. Which of the following indicates an ineffective process?

Which role is responsible for the ongoing monitoring of security controls after an ATO is granted?

Which phase of the RMF includes the 'continuous monitoring' of security controls?

Which THREE elements are necessary for a compliant continuous monitoring program?

An Authorizing Official grants an 'ATO with Conditions.' What does this mean for the system owner?

You are utilizing the NIST SP 800-37 R2 process for an Authorization to Operate (ATO). At what point is the Security Assessment Report (SAR) presented to the Authorizing Official?

Which TWO factors should an ISSO consider when determining if a system change requires a re-authorization?

Which TWO actions should an ISSO take when a critical security control is found to be ineffective during assessment?

A contractor provides a service for your organization. How do you ensure the contractor's system is compliant?

An Authorizing Official (AO) is reviewing a Plan of Action and Milestones (POA&M) for a high-impact system. What is the AO's primary responsibility regarding this document?

If a security control is deemed 'Not Applicable' (NA) in the System Security Plan (SSP), what must the system owner provide?

When assessing a cloud service provider (CSP) using a FedRAMP-authorized solution, what is the primary benefit to your organization?

Which THREE of the following are valid components of an Authorization Package?

Which THREE categories of controls are identified in NIST SP 800-53?

Which TWO of the following are responsibilities of the Authorizing Official?

Which document provides the formal authority to operate a system?

Which TWO documents are essential for an Authorizing Official to make an informed risk-based decision?

What is the relationship between the System Security Plan (SSP) and the Security Assessment Report (SAR)?

Which THREE types of information should be included in a risk acceptance memo?

An information system security officer (ISSO) is preparing the Security Assessment Plan (SAP) in the NIST Risk Management Framework. Which component must be identified first to ensure the assessment coverage is adequate?

A system is found to have a critical vulnerability that cannot be patched. You are documenting a risk acceptance request. What is the most critical piece of information to include for the AO?

When determining compliance for a cloud-based service, which document serves as the primary evidence of the provider's security controls?

You are performing a compliance determination on a system that shares data with an external partner. What is the most important factor in the authorization boundary determination?

During the compliance determination phase, you discover that a legacy application lacks multi-factor authentication (MFA) but is isolated within a physically secured enclave. Which action should you take to document this in the Security Assessment Report (SAR)?

While reviewing a system's compliance, you notice the Security Control Assessor (SCA) used an interview method for a technical control that requires automated testing. How should you address this in your review?

What is the primary role of the Security Control Assessor (SCA)?