Question 1

Which of the following is NOT a best practice for implementing security controls according to NIST SP 800-53?

Options :

A : Implementing security controls in a phased approach

B : Providing security awareness training to personnel

C : Using automated tools to monitor security controls

D : Implementing only those security controls that are required by regulation or policy

Answer: D

Question 2

What should be included in the security control assessment plan?

Options :

A : The names of all authorized users who will be involved in the assessment

B : The specific security controls that will be assessed and the criteria for their evaluation

C : The timeline for completing the assessment and any required reporting deadlines

D : The location of all data centers and server rooms that will be assessed

Answer: B

Question 3

The purpose of the asset identification task is to identify assets that require protection. Which of the following is not a potential input for this task?

Options :

A : Internal stakeholders

B : System information

C : System security plan

D : Business impact analysis

Answer: C

Question 4

Which of the following is NOT typically included in the system description for the purpose of authorizing an information system in the NIST RMF process?

Options :

A : The system-s hardware and software components

B : The system-s information flows and processing activities

C : The system-s network architecture and connectivity

D : The organization-s information security policies and procedures

Answer: D

Question 5

What are the objectives of the Prepare step in the NIST RMF framework?

Options :

A : Facilitating better communication between senior leaders and executives at the organization and mission and business process levels and system owners

B : Facilitating organization-wide identification of common controls and the development of organizationally tailored control baselines, reducing the workload on individual system owners and the cost of system development and asset protection

C : Reducing the complexity of the information technology and operations technology infrastructure using enterprise architecture concepts and models to consolidate, optimize, and standardize organizational systems, applications, and services

D : Ensuring that the implemented security controls continue to provide the intended level of protection for the information system and its data throughout the system-s lifecycle.

E : Identifying, prioritizing, and focusing resources on the organizationâ€™s high-value assets and high impact systems that require increased levels of protection and taking steps commensurate with the risk to such assets.

Answer: A,B,C,E

Free CGRC Mock Exam – Practice Online Confidently

Buying Options: