Question 1

In the prepare step of the NIST RMF, which of the following should be established to ensure an effective risk management process?

Options :

A : A communication process for risk-related information

B : A continuous monitoring strategy

C : A system security plan

D : An incident response plan

Answer: A

Question 2

During a system authorization process, the authorizing official is not satisfied with the risk assessment report's level of detail. What should the system owner do in this situation?

Options :

A : Proceed with the authorization process without addressing the concern.

B : Revise the risk assessment report to address the authorizing official-s concerns.

C : Request a third-party assessment of the system-s risks.

D : Consult the information security officer for guidance.

Answer: B

Question 3

Your organization is preparing to authorize a new information system. As part of the Prepare phase of the NIST SP 800-37 Risk Management Framework, your team is working to identify the system's stakeholders and their roles. Which of the following stakeholders would be responsible for ensuring that the system's security controls are properly implemented and maintained?

Options :

A : The system owner

B : The authorizing official

C : The system administrator

D : The security manager

Answer: C

Question 4

Which of the following is NOT a best practice for implementing security controls according to NIST SP 800-53?

Options :

A : Implementing security controls in a phased approach

B : Providing security awareness training to personnel

C : Using automated tools to monitor security controls

D : Implementing only those security controls that are required by regulation or policy

Answer: D

Question 5

What should be included in the security control assessment plan?

Options :

A : The names of all authorized users who will be involved in the assessment

B : The specific security controls that will be assessed and the criteria for their evaluation

C : The timeline for completing the assessment and any required reporting deadlines

D : The location of all data centers and server rooms that will be assessed

Answer: B

Confidently Practice Online with Free CGRC Exam Cram

Buying Options: