Question 1

Which of the following is NOT typically included in the system description for the purpose of authorizing an information system in the NIST RMF process?

Options :

A : The system-s hardware and software components

B : The system-s information flows and processing activities

C : The system-s network architecture and connectivity

D : The organization-s information security policies and procedures

Answer: D

Question 2

Which of the following is the MOST challenging aspect of asset identification in the context of information security risk management?

Options :

A : Identifying all assets within the organization-s network

B : Determining the value of each asset in terms of its importance to the organization

C : Identifying and categorizing assets based on their criticality to the organization-s operations

D : Determining the level of risk associated with each asset

Answer: A

Question 3

DEF Corporation is considering the implementation of a new software application. What is the role of security requirements in the SDLC?

Options :

A : To ensure that the software application is reliable and performs as intended

B : To identify and mitigate security risks associated with the software application

C : To design the software application and its features

D : To test the software application for defects and errors

Answer: B

Question 4

ABC Corporation is considering implementing a new information system that will be critical to its business operations. The system is expected to cost $1 million to implement, and will be used to process sensitive customer information. The chief information officer (CIO) is concerned about the risks associated with the new system, and wants to ensure that the organization's risk appetite is taken into account. Which of the following factors should be considered when determining the risk appetite for the new system?

Options :

A : The cost of implementing additional security controls

B : The impact on the organization-s reputation if the system is compromised

C : The risk management knowledge of the system owners

D : The level of risk tolerance among the organization-s employees

Answer: B

Question 5

True or False: Risk response is the final step in the NIST Risk Management Framework and involves implementing security controls to address identified risks.

Options :

A : TRUE

B : FALSE

Answer: B

Free CGRC Mock Exam – Practice Online Confidently

Buying Options: