Question 1

Which of the following is NOT typically included in the system registration process in the NIST RMF?

Options :

A : System identification information, such as the system name and owner

B : The security categorization of the system

C : Organizational policy on system registration

D : The selection and implementation of security controls for the system

Answer: D

Question 2

True or False: Risk response is the final step in the NIST Risk Management Framework and involves implementing security controls to address identified risks.

Options :

A : TRUE

B : FALSE

Answer: B

Question 3

A small organization has limited resources and is struggling to implement all of the necessary NIST SP 800-53 security controls. Which of the following is the BEST approach for the organization?

Options :

A : Implement only those controls that are required by regulation or policy

B : Implement only those controls that are relevant to the organization-s risk management strategy

C : Implement only those controls that are easy to implement

D : Outsource the implementation of all security controls to a third-party vendor

Answer: B

Question 4

What are the objectives of the Prepare step in the NIST RMF framework?

Options :

A : Facilitating better communication between senior leaders and executives at the organization and mission and business process levels and system owners

B : Facilitating organization-wide identification of common controls and the development of organizationally tailored control baselines, reducing the workload on individual system owners and the cost of system development and asset protection

C : Reducing the complexity of the information technology and operations technology infrastructure using enterprise architecture concepts and models to consolidate, optimize, and standardize organizational systems, applications, and services

D : Ensuring that the implemented security controls continue to provide the intended level of protection for the information system and its data throughout the system-s lifecycle.

E : Identifying, prioritizing, and focusing resources on the organizationâ€™s high-value assets and high impact systems that require increased levels of protection and taking steps commensurate with the risk to such assets.

Answer: A,B,C,E

Question 5

Which of the following is the MOST challenging aspect of asset identification in the context of information security risk management?

Options :

A : Identifying all assets within the organization-s network

B : Determining the value of each asset in terms of its importance to the organization

C : Identifying and categorizing assets based on their criticality to the organization-s operations

D : Determining the level of risk associated with each asset

Answer: A

Confidently Practice Online with Free CGRC Exam Cram

Buying Options: