Question 1

Which of the following is the MOST challenging aspect of asset identification in the context of information security risk management?

Options :

A : Identifying all assets within the organization-s network

B : Determining the value of each asset in terms of its importance to the organization

C : Identifying and categorizing assets based on their criticality to the organization-s operations

D : Determining the level of risk associated with each asset

Answer: A

Question 2

A small organization has limited resources and is struggling to implement all of the necessary NIST SP 800-53 security controls. Which of the following is the BEST approach for the organization?

Options :

A : Implement only those controls that are required by regulation or policy

B : Implement only those controls that are relevant to the organization-s risk management strategy

C : Implement only those controls that are easy to implement

D : Outsource the implementation of all security controls to a third-party vendor

Answer: B

Question 3

Your organization is preparing to authorize a new information system. As part of the Prepare phase of the NIST SP 800-37 Risk Management Framework, your team is working to identify the system's stakeholders and their roles. Which of the following stakeholders would be responsible for ensuring that the system's security controls are properly implemented and maintained?

Options :

A : The system owner

B : The authorizing official

C : The system administrator

D : The security manager

Answer: C

Question 4

Which of the following is NOT typically included in the system description for the purpose of authorizing an information system in the NIST RMF process?

Options :

A : The system-s hardware and software components

B : The system-s information flows and processing activities

C : The system-s network architecture and connectivity

D : The organization-s information security policies and procedures

Answer: D

Question 5

Which of the following statements about OMB Circular A-130 is true?

Options :

A : It provides guidance on cybersecurity risk management for federal information systems.

B : It requires organizations to use the RMF to manage privacy risks.

C : It is applicable only to federal agencies in the United States.

D : It does not cover the management of federal information resources.

Answer: B

Confidently Practice Online with Free CGRC Exam Cram

Buying Options: