CGRC Exam Dumps | What is the comprehensive assessment of the management, operational, and technical security controls

<< Prev Question Next Question >>

Question 207/295

What is the comprehensive assessment of the management, operational, and technical security controls in an information system, made in support of security accreditation, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.
Response:

A. Operation

B. Information

C. Certification

D. Examination

Question List (295q): Question 1: Process of controlling modifications to hardware, firmware, ...; Question 2: Testing officials should use which NIST publication as guide...; Question 3: Applying the first three steps in the RMF to legacy systems ...; Question 4: Which of the following is an example of the test assessment ...; Question 5: Common control providers have the responsibility for develop...; Question 6: Which of the following NIST documents includes components fo...; Question 7: An occurrence that actually jeopardizes the CIA of an inform...; Question 8: What is Step 6? Response:; Question 9: Which of the following are the objectives of the security ce...; Question 10: An agreement that allows two organizations to back up each o...; Question 11: What is included in a POA&M that is presented to the App...; Question 12: Which of the following is NOT an objective of the security p...; Question 13: A measure of the degree to which an organization depends on ...; Question 14: The person primarily responsible for RMF Step 1, Categorizat...; Question 15: A key part of the risk-based decision process is the recogni...; Question 16: What is the purpose for scoping guidance? Response:...; Question 17: The process by which a security control baseline is modified...; Question 18: Which of the following statements correctly describes DIACAP...; Question 19: According to NIST SP 800-37 Rev 2, step 5 of the risk manage...; Question 20: During the security impact analysis vulnerabilities were unc...; Question 21: When attempting to categorize a system, which two RMF starti...; Question 22: What are the FIPS Publication 199 defined 3 levels of potent...; Question 23: What is verifying the identity of a user, process, or device...; Question 24: Security testing that involves direct interaction with a tar...; Question 25: Which of the following processes is used to protect the data...; Question 26: Any information system (including any telecommunications sys...; Question 27: The RMF Step and task where the security controls are select...; Question 28: Which of the following publications serves as a guide for th...; Question 29: Which of the three-tiered approaches to risk management addr...; Question 30: Which of the following objectives are defined by integrity i...; Question 31: What does avoidance mean with respect to risk response? Resp...; Question 32: To help review or design security controls, they can be clas...; Question 33: System authorization programs are marked by frequent failure...; Question 34: According to NIST SP 800-37 Rev 2 appendix F, there exists s...; Question 35: The tiers of the National Institute of Standards and Technol...; Question 36: Which of the following access control models uses a predefin...; Question 37: Which of the following system security policies is used to a...; Question 38: What is NIST SP 800-37 R1? Response:...; Question 39: What are the responsibilities of a system owner? Each correc...; Question 40: A level of collaboration may be required between security an...; Question 41: This process is used to determine if the security controls i...; Question 42: Which of the following evidences are the collection of facts...; Question 43: A countermeasure or safeguard that is implemented in an info...; Question 44: Which of the following is a 1996 United States federal law, ...; Question 45: What are five primary roles associated with the system autho...; Question 46: Which NIST SP 800 series document is concerned with continuo...; Question 47: The authorizing official may determine that additional infor...; Question 48: The management, operational, and technical controls (i.e., s...; Question 49: The Information system owner should strive to test every con...; Question 50: The security controls for an information system that are pri...; Question 51: A differential backup stores files that were created or modi...; Question 52: Which reference document describes the contents of a Plan of...; Question 53: Which RMF role establishes risk management roles and respons...; Question 54: Although system authorization is important; obtaining ATO is...; Question 55: The emphasis of the revised NIST SP 800-37 process is on.......; Question 56: The security category of information 1 is determined to be: ...; Question 57: The registration of the system directly follows which RMF ta...; Question 58: Security categorization of an National Security System must ...; Question 59: Step 6 of the risk management framework can be described as:...; Question 60: Which of the following documents can be best aid in selectin...; Question 61: The authorization boundary of a system undergoing assessment...; Question 62: The Organization Level (Tier 1) strategy addresses/requires....; Question 63: A full backup captures all files on the disk or within the f...; Question 64: Which NIST special publication is the guide on continuous mo...; Question 65: Ensuring timely and reliable access to and use of informatio...; Question 66: The publication that has the Standards for Security Categori...; Question 67: The RMF Step and task where a Continuous Monitoring strategy...; Question 68: What RMF role is primarily responsible for Tasks 1, 2, and 3...; Question 69: This is a standard that sets essential requirements for asse...; Question 70: The System Owner (SO) of Colvine Tech is implementing a new ...; Question 71: Security control assessors can reuse past assessment results...; Question 72: What is the system development life cycle phase for step six...; Question 73: The level of assessor independence is determined based on ap...; Question 74: Numerous information security standards promote good securit...; Question 75: If a "war-stopper" is found; testing should be immediately h...; Question 76: NIST SP 800-53 describes a family of controls as: Response:...; Question 77: Security Test and Evaluation (ST&E) is a component of ri...; Question 78: What's another term that is synonymous with a common control...; Question 79: From a system authorization perspective, why are potential s...; Question 80: The FISMA defines three security objectives for information ...; Question 81: What does RTM stand for? Response:...; Question 82: BS 7799 is an internationally recognized ISM standard that p...; Question 83: Which one of the following publications provides details of ...; Question 84: You are the project manager for the NHH project. You are wor...; Question 85: The ability of an information system to continue to: (i) ope...; Question 86: National Institute of Standards and Technology (NIST) guidan...; Question 87: What are the four business areas of BRM? Response:...; Question 88: What are information system? Response:...; Question 89: What is the system development life cycle phase for step six...; Question 90: A certain security principle provides assurance that data ha...; Question 91: Not all deficiencies in controls or lack of security protect...; Question 92: Where can a project manager find risk-rating rules? Response...; Question 93: The security controls (i.e., safeguards or countermeasures) ...; Question 94: In which of the following phases does the change management ...; Question 95: A SCAP specification that provides unique, common names for ...; Question 96: True or False. Impacts of changes should be known in advance...; Question 97: You are the project manager of the NKJ Project for your comp...; Question 98: Actions, devices, procedures, techniques, or other measures ...; Question 99: According to NIST SP 800-37 Rev 2, What is step five of the ...; Question 100: A structured set of arguments and a body of evidence showing...; Question 101: Who is primarily responsible for the development of the syst...; Question 102: What is the process of determining the security category for...; Question 103: Which of the following tasks are identified by the Plan of A...; Question 104: Information that has been determined pursuant to Executive O...; Question 105: A security policy is an overall general statement produced b...; Question 106: During information system continuous monitoring you have to ...; Question 107: The purpose of security controls testing is to evaluate the ...; Question 108: Fred is the project manager of the PKL project. He is workin...; Question 109: A passive technique that monitors network communication, dec...; Question 110: Which of the following best defines a general support system...; Question 111: What would be the impact level due to the loss of CIA that c...; Question 112: You are the project manager for a construction project. The ...; Question 113: An environmentally conditioned workspace that is partially e...; Question 114: When SCA conducted assessments are conducted in parallel wit...; Question 115: Adrian is the project manager of the NHP Project. In her pro...; Question 116: What is FIPS 199? Response:; Question 117: What is the MOST appropriate action to take after weaknesses...; Question 118: When an authorization to operate (ATO) is issued, which of t...; Question 119: You are preparing to start the qualitative risk analysis pro...; Question 120: During which RMF step is the system security plan (SP) appro...; Question 121: An event or situation that has the potential for causing und...; Question 122: Thomas is a key stakeholder in your project. Thomas has requ...; Question 123: What type of testing is the Evaluation thru operation, movem...; Question 124: Which role in the security authorization process is responsi...; Question 125: For inherited controls, the type of authorization that the s...; Question 126: Anything that can exploit a vulnerability, intentionally or ...; Question 127: Which of the following governance bodies directs and coordin...; Question 128: Which of the following are included in Physical Controls? Ea...; Question 129: Who has the authority to divide a complex system in order to...; Question 130: An effective continuous monitoring program can be used to Re...; Question 131: Change management is initiated under which phase? Response:...; Question 132: You work as a project manager for SoftTech Inc. You are work...; Question 133: FITSAF stands for Federal Information Technology Security As...; Question 134: Which of the following relations correctly describes total r...; Question 135: Significant changes to the environment of operation may trig...; Question 136: An authentication method uses smart cards as well as usernam...; Question 137: Which of the following in an assessment plan protects the se...; Question 138: The potential impact is moderate if-The loss of confidential...; Question 139: Which of the following provides instructions for annual FISM...; Question 140: A security control for an information system that has not be...; Question 141: In which of the RMF phases (task 3) is the conduct remediati...; Question 142: _________________________ management offers a structured app...; Question 143: Which RMF role needs to be aware of id of new threats, evolv...; Question 144: What is the 2nd SDLC phase; which maps to the RMF steps 3 &a...; Question 145: According to NIST SP 800-39, Managing Information System Ris...; Question 146: Which of the following is a risk that is created by the resp...; Question 147: An organizational official responsible for the development, ...; Question 148: In what phases of the Risk Management Framework (RMF) and sy...; Question 149: You are responsible for network and information security at ...; Question 150: Which of the following techniques are used after a security ...; Question 151: Which organization is responsible for procurement, developme...; Question 152: Security testing conducted from inside the organization's se...; Question 153: Authentication ensures that system users are who they say th...; Question 154: Which of the following organizational officials have the pri...; Question 155: Which of the following individuals is responsible for prepar...; Question 156: Which of the following refers to an information security doc...; Question 157: Risk acceptance when the external subsystem owner or service...; Question 158: The term __________ relates to the system as a whole where a...; Question 159: The RMF Step and task where the Categorization of the inform...; Question 160: NIST 800-53 identifies continuous monitoring as which of the...; Question 161: Failure to authorize an operational system to process demons...; Question 162: The loss of confidentiality, integrity, or availability that...; Question 163: What is the purpose of a Privacy impact assessment? Response...; Question 164: Ongoing authorizations and reporting can be time- and event-...; Question 165: A discussion-based exercise where personnel with roles and r...; Question 166: Which Certification Level of Effort is indicated by checklis...; Question 167: What does SC stand for regarding Information Types? Response...; Question 168: The Security Category that guards against the improper modif...; Question 169: The management, operational, and technical controls (i.e., s...; Question 170: Which of the following are "not" a phase of the NIST Risk Ma...; Question 171: Any deviations from the Security Assessment plan should be__...; Question 172: Which of the following statements best describes the differe...; Question 173: The objective of status reporting & documentation is to ...; Question 174: Any information about an individual maintained by an agency,...; Question 175: Governing document that provides a comprehensive, rigorous m...; Question 176: You and your project team are identifying the risks that may...; Question 177: Which of the following recovery plans includes specific stra...; Question 178: NIST SP 800-37 defines this role as an organizational offici...; Question 179: What course of action can be taken by a party if the current...; Question 180: When an authorizing official (AO) submits the security autho...; Question 181: All components of an information system to be authorized for...; Question 182: Overlays can be implemented as part of control tailoring aft...; Question 183: Which SDLC phase can use the System Authorization package to...; Question 184: What publication provides a wide range of security controls ...; Question 185: An analysis of an information system's requirements, functio...; Question 186: Which of the following statements reflect the 'Code of Ethic...; Question 187: What is the four-step security categorization process? Respo...; Question 188: When an authorization to operate is issued, which of the fol...; Question 189: Which RMF role can be appointed at the discretion of the App...; Question 190: The RMF Step and task where the Information System (include ...; Question 191: In which type of access control do user ID and password syst...; Question 192: An occurrence that actually or potentially jeopardizes the c...; Question 193: Developmental testing and evaluation is a type of control As...; Question 194: What is the objective of the Security Accreditation Decision...; Question 195: Which of the following acts promote a risk-based policy for ...; Question 196: Updating the security plan, security assessment report, and ...; Question 197: Which NIST SP series document is concerned with continuous m...; Question 198: You are working as a project manager in your organization. Y...; Question 199: What are the three classifications for security controls for...; Question 200: What RMF artifact establishes the scope of protection for an...; Question 201: Which of the following statements about the authentication c...; Question 202: Subsequent to a security breach, which of the following tech...; Question 203: Which of the following details best define an independent as...; Question 204: During which Risk Management Framework (RMF) step is the sys...; Question 205: Information System and Environment Changes, determine the se...; Question 206: The risk transference is referred to the transfer of risks t...; Question 207: What is the comprehensive assessment of the management, oper...; Question 208: What publication provides a structured process (RMF) to full...; Question 209: An effective continuous monitoring program can be used to me...; Question 210: Certification and Accreditation (C&A or CnA) is a proces...; Question 211: Weakness in an information system, system security procedure...; Question 212: Penetration tests are sometimes called white hat attacks bec...; Question 213: When determining the applicability of a specific security co...; Question 214: When an ATO is issued, which of the following roles authorit...; Question 215: Which of the following is a standard that sets basic require...; Question 216: In 2003, NIST developed a new Certification & Accreditat...; Question 217: Which of the following assessment methods is used to review,...; Question 218: Which of the following is NOT a responsibility of a data own...; Question 219: A security assessment plan comprises of all of the following...; Question 220: Which NIST SP describes various sensitivity rankings for fed...; Question 221: The implementation of the Assessment and the authorization p...; Question 222: The transfer of risk is one of the five risk treatment metho...; Question 223: Which of the following are the types of access controls? Eac...; Question 224: According to RMF which role has a primary responsibility to ...; Question 225: Which of the following specifies security requirements for f...; Question 226: Certification and Accreditation (C&A or CnA) is a proces...; Question 227: Which of the following processes provides a standard set of ...; Question 228: Which of the following is not a risk factor as stated in NIS...; Question 229: The monitoring frequency for each security control is based ...; Question 230: Your project has several risks that may cause serious financ...; Question 231: ___________________ information is defined as any informatio...; Question 232: What essential documentation should be included in the syste...; Question 233: Information risk management (IRM) is the process of identify...; Question 234: FITSAF stands for Federal Information Technology Security As...; Question 235: Common activities within organizations can cause changes to ...; Question 236: Which of the following is a temporary approval to operate ba...; Question 237: Which of the following statements is true about residual ris...; Question 238: One of the inputs to the risk determination task is the empl...; Question 239: The official primarily responsibility for security of an Inf...; Question 240: During which RMF step is the system security plan initially ...; Question 241: The security assessment plan is prepared to provide the Auth...; Question 242: What role is an agency official responsible for providing ad...; Question 243: In which step of the NIST SP 800-30 Risk Assessment process ...; Question 244: What is the purpose of the monitor step? Response:...; Question 245: What is the first step in the process of implementing an Inf...; Question 246: Protective measures prescribed to meet the security requirem...; Question 247: Establishing an overall sensitivity level for an Information...; Question 248: Which of the following is a subset discipline of Corporate G...; Question 249: Which of the following are included in Technical Controls? c...; Question 250: Where can you find guidance for registering information syst...; Question 251: One of the main objectives of testing is to avoid __________...; Question 252: Which of the following are the tasks performed by the owner ...; Question 253: Step 7 of the risk management framework can be described as:...; Question 254: The Security Content Automation Protocol (SCAP) is a method ...; Question 255: Can a value of not applicable be assigned to any security ob...; Question 256: The primary responsibility to select control assessors rests...; Question 257: Interrelationships of system authorization processes. Respon...; Question 258: Management policy and procedures designed to maintain or res...; Question 259: Which of the following terms related to risk management repr...; Question 260: NIST SP 800-37 comports under OMB Circular A-130; but it was...; Question 261: Colvine-Tech hardware (10 computers) are located in a single...; Question 262: Security commensurate with the risk and the magnitude of har...; Question 263: NIST SP 800-39 requires that the Security Control Assessor's...; Question 264: When an AO submits the security authorization decision, what...; Question 265: Guarding against improper information modification or destru...; Question 266: DIACAP applies to the acquisition, operation, and sustainmen...; Question 267: An effective security control monitoring strategy for an inf...; Question 268: The National Information Assurance Certification and Accredi...; Question 269: Which of the following is the acronym of RTM? Response:...; Question 270: What is the purpose of the assess step? Response:...; Question 271: Which of the following is NOT a phase of the security certif...; Question 272: Which of the following control families belongs to the manag...; Question 273: Which of the following statements are true about security ri...; Question 274: Why is security control volatility an important consideratio...; Question 275: When carrying out ongoing risk response, the effectiveness o...; Question 276: POAM update frequency is at discretion of System Owner but s...; Question 277: Which of the following processes is a structured approach to...; Question 278: Who is the official with the authority to formally assume re...; Question 279: Which organizational official is responsible for the procure...; Question 280: According to FISMA and OMB policy, external subsystems are r...; Question 281: Which of the following are the common roles with regard to d...; Question 282: The registration of the system directly follows which Risk M...; Question 283: Management wants you to create a visual diagram of what reso...; Question 284: According to NIST SP 800-39, when an organization responds t...; Question 285: Penetration testing (also called pen testing) is the practic...; Question 286: Which of the following guidance documents is useful in deter...; Question 287: The change control board team at Colvine Tech has determined...; Question 288: An organizational official with statutory or operational aut...; Question 289: Which of the following NIST documents defines impact? Respon...; Question 290: Which FIPS publication specifies security requirements for f...; Question 291: What will provide a mechanism for evaluating the functions t...; Question 292: Under key roles in Continuous Monitoring; the __________ act...; Question 293: A written plan for recovering one or more information system...; Question 294: What are the three tools necessary for managing the inventor...; Question 295: One of the primary goals in conducting analysis of the test ...

Question 207/295

LEAVE A REPLY

Download PDF File