Question 1

A large organization has recently implemented a new system to manage its financial transactions. The system includes several components, such as a database server, web server, and application server, which are all connected to a local network. The organization's IT team has configured the system according to best practices and security policies and has performed several security assessments to ensure its compliance. However, the organization's security team wants to implement continuous monitoring of the system configurations to enhance its security posture. What is the main benefit of implementing continuous monitoring of the system configurations in the scenario described above?

Options :

A : To identify any vulnerabilities or misconfigurations in the system that could lead to security breaches

B : To ensure that the system is operating at optimal performance and efficiency

C : To provide a comprehensive view of the organization-s security posture

D : To eliminate the need for periodic security assessments and audits

Answer: A

Question 2

Ratio Corp is in the process of selecting security controls for a new information system. Which of the following is NOT a valid control selection method according to NIST guidelines?

Options :

A : Using a risk-based approach to determine the appropriate controls

B : Selecting controls based solely on cost-effectiveness

C : Implementing controls that are required by law, regulation, or policy

D : Adopting controls that are consistent with industry standards and best practices

Answer: B

Question 3

What is the purpose of a security control baseline?

Options :

A : To establish a standard set of security controls that can be applied to all federal information systems and organizations

B : To define the criticality of information assets and systems within an organization

C : To establish the requirements for compliance with legal and regulatory frameworks

D : To define the rules for incident response and reporting

Answer: A

Question 4

RydSecure is assessing the security controls of a multinational corporation's complex information system. The corporation has several subsidiaries, and the information system contains sensitive financial and customer data. As an authorization professional, you understand the importance of assessor independence in ensuring an unbiased and objective assessment. You have narrowed down the selection to four potential assessors. Each assessor has their own set of circumstances that could potentially affect their independence. Based on the information provided, which assessor is MOST LIKELY to maintain the highest level of independence during the evaluation of the multinational corporation's information system?

Options :

A : An assessor who recently completed a consulting engagement for one of the corporation-s subsidiaries, during which they reviewed and provided recommendations for improving the subsidiary-s security controls

B : An assessor who is married to a high-ranking executive working for one of the corporation-s main competitors in the same industry

C : An assessor who has a sibling working in the corporation-s IT department, but the sibling is not involved in the development, implementation, or management of the information system-s security controls

D : An assessor who, three years ago, worked as an internal auditor for the corporation and was responsible for auditing the information system-s security controls but left on good terms

Answer: C

Question 5

Which of the following tasks are included in the categorize step of the NIST RMF process? (Select all that apply.)

Options :

A : Defining the system-s operational context and environment

B : Identifying and documenting the system-s hardware and software components

C : Evaluating the potential impact of a system security breach

D : Selecting and implementing appropriate security controls for the system

E : Determining the system-s risk tolerance and security categorization

Answer: B,E

Confidently Practice Online with Free CGRC Exam Cram

Buying Options: