Question 1

During a system authorization process, the authorizing official is not satisfied with the risk assessment report's level of detail. What should the system owner do in this situation?

Options :

A : Proceed with the authorization process without addressing the concern.

B : Revise the risk assessment report to address the authorizing official-s concerns.

C : Request a third-party assessment of the system-s risks.

D : Consult the information security officer for guidance.

Answer: B

Question 2

What should be included in the security control assessment plan?

Options :

A : The names of all authorized users who will be involved in the assessment

B : The specific security controls that will be assessed and the criteria for their evaluation

C : The timeline for completing the assessment and any required reporting deadlines

D : The location of all data centers and server rooms that will be assessed

Answer: B

Question 3

What are the types of authorization decisions that can be given by an authorizing official? Select all that apply.

Options :

A : Authorization to operate

B : Interim authorization to operate

C : Common control authorization

D : Authorization to use

E : Denial of authorization

Answer: A,C,D,E

Question 4

Ratio Corp is in the process of selecting security controls for a new information system. Which of the following is NOT a valid control selection method according to NIST guidelines?

Options :

A : Using a risk-based approach to determine the appropriate controls

B : Selecting controls based solely on cost-effectiveness

C : Implementing controls that are required by law, regulation, or policy

D : Adopting controls that are consistent with industry standards and best practices

Answer: B

Question 5

Which of the following tasks are included in the categorize step of the NIST RMF process? (Select all that apply.)

Options :

A : Defining the system-s operational context and environment

B : Identifying and documenting the system-s hardware and software components

C : Evaluating the potential impact of a system security breach

D : Selecting and implementing appropriate security controls for the system

E : Determining the system-s risk tolerance and security categorization

Answer: B,E

Free CGRC Mock Exam – Practice Online Confidently

Buying Options: