CGRC Exam Dumps | A level of collaboration may be required between security and privacy control assessors with respect

<< Prev Question Next Question >>

Question 40/295

A level of collaboration may be required between security and privacy control assessors with respect to controls that implemented to achieve both security and privacy objectives. Assessor findings must be:
Response:

A. The results of the control assessment

B. A factual reporting on control effectiveness and discovered vulnerabilities

C. All of the above

D. Findings and recommendations for remediation

Question List (295q): Question 1: Process of controlling modifications to hardware, firmware, ...; Question 2: Testing officials should use which NIST publication as guide...; Question 3: Applying the first three steps in the RMF to legacy systems ...; Question 4: Which of the following is an example of the test assessment ...; Question 5: Common control providers have the responsibility for develop...; Question 6: Which of the following NIST documents includes components fo...; Question 7: An occurrence that actually jeopardizes the CIA of an inform...; Question 8: What is Step 6? Response:; Question 9: Which of the following are the objectives of the security ce...; Question 10: An agreement that allows two organizations to back up each o...; Question 11: What is included in a POA&M that is presented to the App...; Question 12: Which of the following is NOT an objective of the security p...; Question 13: A measure of the degree to which an organization depends on ...; Question 14: The person primarily responsible for RMF Step 1, Categorizat...; Question 15: A key part of the risk-based decision process is the recogni...; Question 16: What is the purpose for scoping guidance? Response:...; Question 17: The process by which a security control baseline is modified...; Question 18: Which of the following statements correctly describes DIACAP...; Question 19: According to NIST SP 800-37 Rev 2, step 5 of the risk manage...; Question 20: During the security impact analysis vulnerabilities were unc...; Question 21: When attempting to categorize a system, which two RMF starti...; Question 22: What are the FIPS Publication 199 defined 3 levels of potent...; Question 23: What is verifying the identity of a user, process, or device...; Question 24: Security testing that involves direct interaction with a tar...; Question 25: Which of the following processes is used to protect the data...; Question 26: Any information system (including any telecommunications sys...; Question 27: The RMF Step and task where the security controls are select...; Question 28: Which of the following publications serves as a guide for th...; Question 29: Which of the three-tiered approaches to risk management addr...; Question 30: Which of the following objectives are defined by integrity i...; Question 31: What does avoidance mean with respect to risk response? Resp...; Question 32: To help review or design security controls, they can be clas...; Question 33: System authorization programs are marked by frequent failure...; Question 34: According to NIST SP 800-37 Rev 2 appendix F, there exists s...; Question 35: The tiers of the National Institute of Standards and Technol...; Question 36: Which of the following access control models uses a predefin...; Question 37: Which of the following system security policies is used to a...; Question 38: What is NIST SP 800-37 R1? Response:...; Question 39: What are the responsibilities of a system owner? Each correc...; Question 40: A level of collaboration may be required between security an...; Question 41: This process is used to determine if the security controls i...; Question 42: Which of the following evidences are the collection of facts...; Question 43: A countermeasure or safeguard that is implemented in an info...; Question 44: Which of the following is a 1996 United States federal law, ...; Question 45: What are five primary roles associated with the system autho...; Question 46: Which NIST SP 800 series document is concerned with continuo...; Question 47: The authorizing official may determine that additional infor...; Question 48: The management, operational, and technical controls (i.e., s...; Question 49: The Information system owner should strive to test every con...; Question 50: The security controls for an information system that are pri...; Question 51: A differential backup stores files that were created or modi...; Question 52: Which reference document describes the contents of a Plan of...; Question 53: Which RMF role establishes risk management roles and respons...; Question 54: Although system authorization is important; obtaining ATO is...; Question 55: The emphasis of the revised NIST SP 800-37 process is on.......; Question 56: The security category of information 1 is determined to be: ...; Question 57: The registration of the system directly follows which RMF ta...; Question 58: Security categorization of an National Security System must ...; Question 59: Step 6 of the risk management framework can be described as:...; Question 60: Which of the following documents can be best aid in selectin...; Question 61: The authorization boundary of a system undergoing assessment...; Question 62: The Organization Level (Tier 1) strategy addresses/requires....; Question 63: A full backup captures all files on the disk or within the f...; Question 64: Which NIST special publication is the guide on continuous mo...; Question 65: Ensuring timely and reliable access to and use of informatio...; Question 66: The publication that has the Standards for Security Categori...; Question 67: The RMF Step and task where a Continuous Monitoring strategy...; Question 68: What RMF role is primarily responsible for Tasks 1, 2, and 3...; Question 69: This is a standard that sets essential requirements for asse...; Question 70: The System Owner (SO) of Colvine Tech is implementing a new ...; Question 71: Security control assessors can reuse past assessment results...; Question 72: What is the system development life cycle phase for step six...; Question 73: The level of assessor independence is determined based on ap...; Question 74: Numerous information security standards promote good securit...; Question 75: If a "war-stopper" is found; testing should be immediately h...; Question 76: NIST SP 800-53 describes a family of controls as: Response:...; Question 77: Security Test and Evaluation (ST&E) is a component of ri...; Question 78: What's another term that is synonymous with a common control...; Question 79: From a system authorization perspective, why are potential s...; Question 80: The FISMA defines three security objectives for information ...; Question 81: What does RTM stand for? Response:...; Question 82: BS 7799 is an internationally recognized ISM standard that p...; Question 83: Which one of the following publications provides details of ...; Question 84: You are the project manager for the NHH project. You are wor...; Question 85: The ability of an information system to continue to: (i) ope...; Question 86: National Institute of Standards and Technology (NIST) guidan...; Question 87: What are the four business areas of BRM? Response:...; Question 88: What are information system? Response:...; Question 89: What is the system development life cycle phase for step six...; Question 90: A certain security principle provides assurance that data ha...; Question 91: Not all deficiencies in controls or lack of security protect...; Question 92: Where can a project manager find risk-rating rules? Response...; Question 93: The security controls (i.e., safeguards or countermeasures) ...; Question 94: In which of the following phases does the change management ...; Question 95: A SCAP specification that provides unique, common names for ...; Question 96: True or False. Impacts of changes should be known in advance...; Question 97: You are the project manager of the NKJ Project for your comp...; Question 98: Actions, devices, procedures, techniques, or other measures ...; Question 99: According to NIST SP 800-37 Rev 2, What is step five of the ...; Question 100: A structured set of arguments and a body of evidence showing...; Question 101: Who is primarily responsible for the development of the syst...; Question 102: What is the process of determining the security category for...; Question 103: Which of the following tasks are identified by the Plan of A...; Question 104: Information that has been determined pursuant to Executive O...; Question 105: A security policy is an overall general statement produced b...; Question 106: During information system continuous monitoring you have to ...; Question 107: The purpose of security controls testing is to evaluate the ...; Question 108: Fred is the project manager of the PKL project. He is workin...; Question 109: A passive technique that monitors network communication, dec...; Question 110: Which of the following best defines a general support system...; Question 111: What would be the impact level due to the loss of CIA that c...; Question 112: You are the project manager for a construction project. The ...; Question 113: An environmentally conditioned workspace that is partially e...; Question 114: When SCA conducted assessments are conducted in parallel wit...; Question 115: Adrian is the project manager of the NHP Project. In her pro...; Question 116: What is FIPS 199? Response:; Question 117: What is the MOST appropriate action to take after weaknesses...; Question 118: When an authorization to operate (ATO) is issued, which of t...; Question 119: You are preparing to start the qualitative risk analysis pro...; Question 120: During which RMF step is the system security plan (SP) appro...; Question 121: An event or situation that has the potential for causing und...; Question 122: Thomas is a key stakeholder in your project. Thomas has requ...; Question 123: What type of testing is the Evaluation thru operation, movem...; Question 124: Which role in the security authorization process is responsi...; Question 125: For inherited controls, the type of authorization that the s...; Question 126: Anything that can exploit a vulnerability, intentionally or ...; Question 127: Which of the following governance bodies directs and coordin...; Question 128: Which of the following are included in Physical Controls? Ea...; Question 129: Who has the authority to divide a complex system in order to...; Question 130: An effective continuous monitoring program can be used to Re...; Question 131: Change management is initiated under which phase? Response:...; Question 132: You work as a project manager for SoftTech Inc. You are work...; Question 133: FITSAF stands for Federal Information Technology Security As...; Question 134: Which of the following relations correctly describes total r...; Question 135: Significant changes to the environment of operation may trig...; Question 136: An authentication method uses smart cards as well as usernam...; Question 137: Which of the following in an assessment plan protects the se...; Question 138: The potential impact is moderate if-The loss of confidential...; Question 139: Which of the following provides instructions for annual FISM...; Question 140: A security control for an information system that has not be...; Question 141: In which of the RMF phases (task 3) is the conduct remediati...; Question 142: _________________________ management offers a structured app...; Question 143: Which RMF role needs to be aware of id of new threats, evolv...; Question 144: What is the 2nd SDLC phase; which maps to the RMF steps 3 &a...; Question 145: According to NIST SP 800-39, Managing Information System Ris...; Question 146: Which of the following is a risk that is created by the resp...; Question 147: An organizational official responsible for the development, ...; Question 148: In what phases of the Risk Management Framework (RMF) and sy...; Question 149: You are responsible for network and information security at ...; Question 150: Which of the following techniques are used after a security ...; Question 151: Which organization is responsible for procurement, developme...; Question 152: Security testing conducted from inside the organization's se...; Question 153: Authentication ensures that system users are who they say th...; Question 154: Which of the following organizational officials have the pri...; Question 155: Which of the following individuals is responsible for prepar...; Question 156: Which of the following refers to an information security doc...; Question 157: Risk acceptance when the external subsystem owner or service...; Question 158: The term __________ relates to the system as a whole where a...; Question 159: The RMF Step and task where the Categorization of the inform...; Question 160: NIST 800-53 identifies continuous monitoring as which of the...; Question 161: Failure to authorize an operational system to process demons...; Question 162: The loss of confidentiality, integrity, or availability that...; Question 163: What is the purpose of a Privacy impact assessment? Response...; Question 164: Ongoing authorizations and reporting can be time- and event-...; Question 165: A discussion-based exercise where personnel with roles and r...; Question 166: Which Certification Level of Effort is indicated by checklis...; Question 167: What does SC stand for regarding Information Types? Response...; Question 168: The Security Category that guards against the improper modif...; Question 169: The management, operational, and technical controls (i.e., s...; Question 170: Which of the following are "not" a phase of the NIST Risk Ma...; Question 171: Any deviations from the Security Assessment plan should be__...; Question 172: Which of the following statements best describes the differe...; Question 173: The objective of status reporting & documentation is to ...; Question 174: Any information about an individual maintained by an agency,...; Question 175: Governing document that provides a comprehensive, rigorous m...; Question 176: You and your project team are identifying the risks that may...; Question 177: Which of the following recovery plans includes specific stra...; Question 178: NIST SP 800-37 defines this role as an organizational offici...; Question 179: What course of action can be taken by a party if the current...; Question 180: When an authorizing official (AO) submits the security autho...; Question 181: All components of an information system to be authorized for...; Question 182: Overlays can be implemented as part of control tailoring aft...; Question 183: Which SDLC phase can use the System Authorization package to...; Question 184: What publication provides a wide range of security controls ...; Question 185: An analysis of an information system's requirements, functio...; Question 186: Which of the following statements reflect the 'Code of Ethic...; Question 187: What is the four-step security categorization process? Respo...; Question 188: When an authorization to operate is issued, which of the fol...; Question 189: Which RMF role can be appointed at the discretion of the App...; Question 190: The RMF Step and task where the Information System (include ...; Question 191: In which type of access control do user ID and password syst...; Question 192: An occurrence that actually or potentially jeopardizes the c...; Question 193: Developmental testing and evaluation is a type of control As...; Question 194: What is the objective of the Security Accreditation Decision...; Question 195: Which of the following acts promote a risk-based policy for ...; Question 196: Updating the security plan, security assessment report, and ...; Question 197: Which NIST SP series document is concerned with continuous m...; Question 198: You are working as a project manager in your organization. Y...; Question 199: What are the three classifications for security controls for...; Question 200: What RMF artifact establishes the scope of protection for an...; Question 201: Which of the following statements about the authentication c...; Question 202: Subsequent to a security breach, which of the following tech...; Question 203: Which of the following details best define an independent as...; Question 204: During which Risk Management Framework (RMF) step is the sys...; Question 205: Information System and Environment Changes, determine the se...; Question 206: The risk transference is referred to the transfer of risks t...; Question 207: What is the comprehensive assessment of the management, oper...; Question 208: What publication provides a structured process (RMF) to full...; Question 209: An effective continuous monitoring program can be used to me...; Question 210: Certification and Accreditation (C&A or CnA) is a proces...; Question 211: Weakness in an information system, system security procedure...; Question 212: Penetration tests are sometimes called white hat attacks bec...; Question 213: When determining the applicability of a specific security co...; Question 214: When an ATO is issued, which of the following roles authorit...; Question 215: Which of the following is a standard that sets basic require...; Question 216: In 2003, NIST developed a new Certification & Accreditat...; Question 217: Which of the following assessment methods is used to review,...; Question 218: Which of the following is NOT a responsibility of a data own...; Question 219: A security assessment plan comprises of all of the following...; Question 220: Which NIST SP describes various sensitivity rankings for fed...; Question 221: The implementation of the Assessment and the authorization p...; Question 222: The transfer of risk is one of the five risk treatment metho...; Question 223: Which of the following are the types of access controls? Eac...; Question 224: According to RMF which role has a primary responsibility to ...; Question 225: Which of the following specifies security requirements for f...; Question 226: Certification and Accreditation (C&A or CnA) is a proces...; Question 227: Which of the following processes provides a standard set of ...; Question 228: Which of the following is not a risk factor as stated in NIS...; Question 229: The monitoring frequency for each security control is based ...; Question 230: Your project has several risks that may cause serious financ...; Question 231: ___________________ information is defined as any informatio...; Question 232: What essential documentation should be included in the syste...; Question 233: Information risk management (IRM) is the process of identify...; Question 234: FITSAF stands for Federal Information Technology Security As...; Question 235: Common activities within organizations can cause changes to ...; Question 236: Which of the following is a temporary approval to operate ba...; Question 237: Which of the following statements is true about residual ris...; Question 238: One of the inputs to the risk determination task is the empl...; Question 239: The official primarily responsibility for security of an Inf...; Question 240: During which RMF step is the system security plan initially ...; Question 241: The security assessment plan is prepared to provide the Auth...; Question 242: What role is an agency official responsible for providing ad...; Question 243: In which step of the NIST SP 800-30 Risk Assessment process ...; Question 244: What is the purpose of the monitor step? Response:...; Question 245: What is the first step in the process of implementing an Inf...; Question 246: Protective measures prescribed to meet the security requirem...; Question 247: Establishing an overall sensitivity level for an Information...; Question 248: Which of the following is a subset discipline of Corporate G...; Question 249: Which of the following are included in Technical Controls? c...; Question 250: Where can you find guidance for registering information syst...; Question 251: One of the main objectives of testing is to avoid __________...; Question 252: Which of the following are the tasks performed by the owner ...; Question 253: Step 7 of the risk management framework can be described as:...; Question 254: The Security Content Automation Protocol (SCAP) is a method ...; Question 255: Can a value of not applicable be assigned to any security ob...; Question 256: The primary responsibility to select control assessors rests...; Question 257: Interrelationships of system authorization processes. Respon...; Question 258: Management policy and procedures designed to maintain or res...; Question 259: Which of the following terms related to risk management repr...; Question 260: NIST SP 800-37 comports under OMB Circular A-130; but it was...; Question 261: Colvine-Tech hardware (10 computers) are located in a single...; Question 262: Security commensurate with the risk and the magnitude of har...; Question 263: NIST SP 800-39 requires that the Security Control Assessor's...; Question 264: When an AO submits the security authorization decision, what...; Question 265: Guarding against improper information modification or destru...; Question 266: DIACAP applies to the acquisition, operation, and sustainmen...; Question 267: An effective security control monitoring strategy for an inf...; Question 268: The National Information Assurance Certification and Accredi...; Question 269: Which of the following is the acronym of RTM? Response:...; Question 270: What is the purpose of the assess step? Response:...; Question 271: Which of the following is NOT a phase of the security certif...; Question 272: Which of the following control families belongs to the manag...; Question 273: Which of the following statements are true about security ri...; Question 274: Why is security control volatility an important consideratio...; Question 275: When carrying out ongoing risk response, the effectiveness o...; Question 276: POAM update frequency is at discretion of System Owner but s...; Question 277: Which of the following processes is a structured approach to...; Question 278: Who is the official with the authority to formally assume re...; Question 279: Which organizational official is responsible for the procure...; Question 280: According to FISMA and OMB policy, external subsystems are r...; Question 281: Which of the following are the common roles with regard to d...; Question 282: The registration of the system directly follows which Risk M...; Question 283: Management wants you to create a visual diagram of what reso...; Question 284: According to NIST SP 800-39, when an organization responds t...; Question 285: Penetration testing (also called pen testing) is the practic...; Question 286: Which of the following guidance documents is useful in deter...; Question 287: The change control board team at Colvine Tech has determined...; Question 288: An organizational official with statutory or operational aut...; Question 289: Which of the following NIST documents defines impact? Respon...; Question 290: Which FIPS publication specifies security requirements for f...; Question 291: What will provide a mechanism for evaluating the functions t...; Question 292: Under key roles in Continuous Monitoring; the __________ act...; Question 293: A written plan for recovering one or more information system...; Question 294: What are the three tools necessary for managing the inventor...; Question 295: One of the primary goals in conducting analysis of the test ...

Question 40/295

LEAVE A REPLY

Download PDF File