Question 1

The System Owner (SO) of Colvine Tech is implementing a new system in the organization's Information Technology (IT) environment. What objectives are considered when determining possible impact to risk? Response:

A. Integrity, Confidentiality, and Availability (CIA) 
B. Common, Hybrid, and System-Specific 
C. Authentication, Authorization, and Accountability 
D. Low, Moderate, and High 

Show Answer

Question 2

Which of the following provides instructions for annual FISMA reporting and emphasizes monitoring the security state of information systems on an ongoing bases with a frequency sufficient to make ongoing, risk-based decisions? Response:

A. Clinger-Cohen Act 
B. OMB memorandum M-11-33, FY 2011 
C. OMB Circular A-130, Appendix III, 1997 
D. FISMA, 2002 

Show Answer

Question 3

Any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. Response: 

A. Personally Identifiable Information (PII) 
B. Privacy Impact Assessment (PIA) 
C. Core Nodal Switching Subsystem (CNSS) 
D. Industry Standard Architecture (ISA) 

Show Answer

Question 4

Any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. Response: 

A. Personally Identifiable Information (PII) 
B. Privacy Impact Assessment (PIA) 
C. Core Nodal Switching Subsystem (CNSS) 
D. Industry Standard Architecture (ISA) 

Show Answer

Question 5

An organizational official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal is known as the: Response:

A. Information System Owner 
B. Authorizing Official 
C. Information Owner 
D. Common Control Provider 

Show Answer

Question 6

Aggregate of directives, regulations, rules, and practices that prescribes how an organization manages, protects, and distributes information. Response: 

A. Information Security Policy 
B. National Security System 
C. Information System Owner 
D. System Security Authorization 

Show Answer

Question 7

The management, operational, and technical controls (i.e., safeguards or countermeasures) employed by an organization in lieu of the recommended controls in the baselines described in NIST Special Publication 800-53 and CNSS Instruction 1253, that provide equivalent or comparable protection for an information system. Response: 

A. Compensating Security Controls 
B. Common Security Controls 
C. Network Security Controls 
D. Hybrid Security Controls 

Show Answer

Question 8

Security control assessors can reuse past assessment results to satisfy the annual FISMA security assessment requirement provided the assessment results are: CHOOSE ALL THAT APPLY Response: 

A. Relevant to the determination of control effectivemess 
B. Obtained by assessors with the required degree of independence 
C. Current 
D. Complete 

Show Answer

Question 9

What may Colvine Tech do if they determine that the root cause of an unauthorized change is an adversarial attack? Response: 

A. Implement additional controls to reduce the risk of future attacks 
B. Adjust intrusion detection and prevention system 
C. Invoke incident response 
D. All of the above  

Show Answer

Question 10

The security controls (i.e., safeguards or countermeasures) for an information system that primarily are implemented and executed by people (as opposed to systems). Response:

A. Operational Controls 
B. Common Control 
C. Visual controls 
D. Embedded controls 

Show Answer