Question 1

DEF Corporation is considering the implementation of a new software application. What is the role of security requirements in the SDLC?

Options :

A : To ensure that the software application is reliable and performs as intended

B : To identify and mitigate security risks associated with the software application

C : To design the software application and its features

D : To test the software application for defects and errors

Answer: B

Question 2

ABC Corporation is considering implementing a new information system that will be critical to its business operations. The system is expected to cost $1 million to implement, and will be used to process sensitive customer information. The chief information officer (CIO) is concerned about the risks associated with the new system, and wants to ensure that the organization's risk appetite is taken into account. Which of the following factors should be considered when determining the risk appetite for the new system?

Options :

A : The cost of implementing additional security controls

B : The impact on the organization-s reputation if the system is compromised

C : The risk management knowledge of the system owners

D : The level of risk tolerance among the organization-s employees

Answer: B

Question 3

Which of the following tasks are included in the categorize step of the NIST RMF process? (Select all that apply.)

Options :

A : Defining the system-s operational context and environment

B : Identifying and documenting the system-s hardware and software components

C : Evaluating the potential impact of a system security breach

D : Selecting and implementing appropriate security controls for the system

E : Determining the system-s risk tolerance and security categorization

Answer: B,E

Question 4

What NIST special publication provides guidance on continuous monitoring?

Options :

A : NIST SP 800-53

B : NIST SP 800-37

C : NIST SP 800-137

D : NIST SP 800-160

Answer: C

Question 5

A small organization has limited resources and is struggling to implement all of the necessary NIST SP 800-53 security controls. Which of the following is the BEST approach for the organization?

Options :

A : Implement only those controls that are required by regulation or policy

B : Implement only those controls that are relevant to the organization-s risk management strategy

C : Implement only those controls that are easy to implement

D : Outsource the implementation of all security controls to a third-party vendor

Answer: B

Confidently Practice Online with Free CGRC Exam Cram

Buying Options: