I85PREP
⌘ K
CASp study materials
CASp study resources

CASp practice questions

One question at a time. Build your CASp understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Security Risk Management Framework

Which statement best describes the primary purpose of an information security risk management framework?

  1. It guarantees that an organization will never experience a security incident
  2. It provides a repeatable structure for identifying, assessing, treating, and monitoring risk Correct answer.
  3. It certifies that all employees have completed awareness training
  4. It replaces the need for security policies and technical controls

Explanation

A risk management framework supplies a structured, repeatable process that ties risk identification, analysis, treatment, and ongoing monitoring together. It is a governance and decision-support tool, not a guarantee of immunity or a substitute for controls.

Question 2Information Security Risk Management Framework

In risk management terminology, what does the term 'risk appetite' represent?

  1. The amount and type of risk an organization is willing to pursue or retain Correct answer.
  2. The total count of vulnerabilities found during a scan
  3. The list of regulations the organization must comply with
  4. The annual budget allocated to security tooling

Explanation

Risk appetite expresses the level and nature of risk an organization chooses to accept in pursuit of its objectives. It guides treatment decisions and tolerance thresholds rather than describing findings, obligations, or spending.

Question 3Information Security Risk Management Framework

Which pairing correctly matches a risk concept with its definition?

  1. Impact: the probability an event occurs
  2. Residual risk: risk that has been fully eliminated
  3. Likelihood: the magnitude of harm from an event
  4. Inherent risk: risk before controls are applied Correct answer.

Explanation

Inherent risk is the exposure that exists before any mitigating controls are considered. Residual risk is what remains after treatment, and it is rarely zero, while likelihood and impact describe probability and consequence respectively.

Question 4Information Security Risk Management Framework

Which activity belongs to the risk identification phase rather than the risk treatment phase?

  1. Documenting threat events and asset exposures that could affect objectives Correct answer.
  2. Selecting a compensating control for a known gap
  3. Purchasing cyber insurance to transfer financial loss
  4. Accepting a documented risk with management sign-off

Explanation

Identification is about discovering and documenting the threats, vulnerabilities, and exposures that could affect objectives. Selecting controls, transferring loss, and formally accepting risk are all treatment decisions made after assessment.

Question 5Information Security Risk Management Framework

What is the main distinction between a qualitative and a quantitative risk assessment?

  1. Qualitative assessment uses descriptive scales while quantitative assessment uses numeric monetary or frequency values Correct answer.
  2. Qualitative assessment is always more accurate than quantitative assessment
  3. Qualitative assessment can only be performed by external auditors
  4. Quantitative assessment does not require any asset inventory

Explanation

Qualitative methods rank risk using descriptive categories such as high or medium, while quantitative methods assign numeric values such as annualized loss expectancy. Accuracy depends on data quality and method fit, not on the label alone.

Question 6Information Security Risk Management Framework

Which element is essential when documenting a risk register entry?

  1. The vendor's marketing brochure
  2. The name of the analyst's manager
  3. The full source code of the affected application
  4. A description of the risk, its likelihood, impact, and current treatment status Correct answer.

Explanation

A usable risk register entry captures what the risk is, how likely and severe it is, and where it stands in the treatment lifecycle, along with an owner. Supporting artifacts may be referenced but are not required fields.

Question 7Information Security Risk Management Framework

What does a risk tolerance statement define for an organization?

  1. The schedule for penetration testing
  2. The maximum acceptable level of variation from risk appetite for specific objectives Correct answer.
  3. The list of employees authorized to approve firewall changes
  4. The technical configuration baseline for servers

Explanation

Risk tolerance translates appetite into concrete acceptable thresholds for particular objectives or categories. It sets boundaries for decision-making rather than prescribing technical configuration or operational schedules.

Question 8Information Security Risk Management Framework

Which statement correctly describes the role of senior management in a risk management framework?

  1. They delegate all risk decisions to the IT help desk
  2. They personally perform every technical vulnerability scan
  3. They are excluded from risk reporting to preserve objectivity
  4. They set direction, approve appetite and tolerance, and accept significant residual risk Correct answer.

Explanation

Governing bodies establish risk direction and formally accept residual risk that exceeds delegated thresholds. Execution of technical activities is delegated, but accountability for significant risk decisions stays with leadership.

Question 9Information Security Risk Management Framework

An organization rates a risk as high likelihood and high impact but decides to proceed because the potential benefit is strategically important. Which treatment option is being applied?

  1. Risk transfer
  2. Risk mitigation
  3. Risk acceptance Correct answer.
  4. Risk avoidance

Explanation

Acceptance means consciously retaining a risk, typically with documented justification and management authorization. Because the organization chose to proceed despite the exposure rather than reduce, avoid, or shift it, acceptance is the correct classification.

Question 10Information Security Risk Management Framework

A team estimates that a threat event occurs about twice per year and each occurrence costs roughly $50,000. What is the annualized loss expectancy?

  1. $200,000
  2. $100,000 Correct answer.
  3. $50,000
  4. $25,000

Explanation

Annualized loss expectancy equals the single loss expectancy multiplied by the annualized rate of occurrence. Here $50,000 times two occurrences per year yields $100,000.

Question 11Information Security Risk Management Framework

A control costs $20,000 per year and is expected to reduce annualized loss expectancy from $90,000 to $30,000. What is the net benefit of implementing the control?

  1. $70,000
  2. $20,000
  3. $60,000
  4. $40,000 Correct answer.

Explanation

The control reduces expected loss by $60,000 per year. Subtracting the $20,000 annual cost leaves a net benefit of $40,000, which supports a positive return on the security investment.

Question 12Information Security Risk Management Framework

During assessment, a team discovers that a critical server has an unpatched vulnerability but no known exploit exists and the server is isolated. How should likelihood most reasonably be characterized?

  1. Low, because exploitation requires conditions that are currently absent Correct answer.
  2. Irrelevant, because likelihood never affects risk ratings
  3. High, because any vulnerability must be treated as certain exploitation
  4. Certain, because the vulnerability is documented

Explanation

Likelihood reflects the probability that a threat will actually exploit a weakness given existing conditions. An isolated host with no known exploit has reduced exposure, so likelihood is reasonably assessed as low even though the vulnerability is real.

Question 13Information Security Risk Management Framework

Which scenario best illustrates risk transfer?

  1. Documenting and accepting a low-severity finding
  2. Purchasing a cyber insurance policy that covers breach costs Correct answer.
  3. Adding multifactor authentication to reduce account compromise
  4. Disabling an unnecessary network service to remove exposure

Explanation

Transfer shifts the financial consequences of a risk to another party, most commonly through insurance or contractual arrangements. Reducing exposure or adding controls mitigates risk, while acceptance retains it.

Question 14Information Security Risk Management Framework

Why is a baseline comparison useful when monitoring risk over time?

  1. It proves that no new threats can emerge after approval
  2. It removes the need to reassess risks after major changes
  3. It converts qualitative ratings into guaranteed financial figures
  4. It provides a reference point against which changes in risk posture can be measured Correct answer.

Explanation

A baseline captures an approved state so that deviations and trends can be detected and evaluated. Monitoring depends on comparing current conditions to that reference, and baselines must be refreshed as the environment changes.

Question 15Information Security Risk Management Framework

An organization operates in a jurisdiction with mandatory breach notification rules. How should this obligation influence the risk management process?

  1. It should be ignored because compliance is separate from risk
  2. It should be treated as a compliance driver that shapes impact analysis and treatment priorities Correct answer.
  3. It should replace the organization's own risk appetite
  4. It should be handled only by the legal team without informing risk owners

Explanation

Legal and regulatory obligations are inputs that affect impact assessment, because noncompliance can create financial, legal, and reputational consequences. They inform treatment priorities alongside the organization's own appetite rather than replacing it.

Question 16Information Security Risk Management Framework

A risk assessment team is choosing between a scenario-based approach and an asset-based approach. Which consideration most directly favors the scenario-based approach?

  1. The organization has no information about its business processes
  2. The organization wants to avoid documenting any assumptions
  3. The organization only cares about counting hardware devices
  4. The organization wants to focus on how adverse events could unfold against key objectives Correct answer.

Explanation

Scenario-based assessment starts from plausible adverse events and traces their effects on objectives, which suits organizations focused on mission or business impact. Asset-based approaches instead inventory and value assets first.

Question 17Information Security Risk Management Framework

A vendor hosts a payroll application and the contract assigns responsibility for data protection controls to the vendor. What is the organization's most appropriate risk management action?

  1. Remove the application from the asset inventory
  2. Transfer all internal audit obligations to the vendor
  3. Assume no risk remains because a contract exists
  4. Monitor vendor performance and retain accountability for outsourced risk Correct answer.

Explanation

Outsourcing shifts operational responsibility but not accountability, so the organization must monitor vendor controls and retain oversight. Contracts allocate duties; they do not erase residual risk or audit obligations.

Question 18Information Security Risk Management Framework

Which statement accurately describes the relationship between a risk assessment and a risk treatment plan?

  1. The assessment ranks and characterizes risk, and the treatment plan defines actions, owners, and timelines Correct answer.
  2. The assessment authorizes spending while the treatment plan sets appetite
  3. The treatment plan must be completed before any assessment begins
  4. The two documents are identical in content and purpose

Explanation

Assessment produces an understanding of risk magnitude and priority, which the treatment plan converts into concrete actions with accountability and deadlines. Sequencing assessment before treatment ensures decisions are evidence-based.

Question 19Information Security Risk Management Framework

A risk owner proposes accepting a risk whose rating exceeds the delegated acceptance threshold. What is the most appropriate next step?

  1. The risk owner records acceptance unilaterally and closes the item
  2. The risk is reclassified as low without new evidence
  3. The risk is deleted from the register to avoid audit findings
  4. The risk is escalated to the authority empowered to accept risk at that level Correct answer.

Explanation

Acceptance authority is delegated with limits, so a risk above a risk owner's threshold must be escalated to the appropriate decision-maker. Altering or deleting records to avoid scrutiny undermines the integrity of the process.

Question 20Information Security Risk Management Framework

Which set of factors best supports prioritizing remediation of one vulnerability over another?

  1. The scanner's alphabetical ordering of plugin identifiers
  2. The date the vulnerability was first published alone
  3. Exploitability, asset criticality, potential business impact, and existing compensating controls Correct answer.
  4. The number of words in the vendor advisory

Explanation

Prioritization should reflect how easily a weakness can be exploited, how important the affected asset is, the resulting business impact, and what controls already reduce exposure. Single arbitrary attributes do not capture risk.

Question 21Information Security Risk Management Framework

An organization defines a key risk indicator for failed login attempts against privileged accounts. What characteristic makes this a useful indicator?

  1. It is measurable over time and plausibly linked to a threat that affects objectives Correct answer.
  2. It is unrelated to any known threat
  3. It is chosen because the data is difficult to collect
  4. It is reviewed once every five years

Explanation

Useful indicators are quantifiable, trackable, and meaningfully connected to threats and objectives so that trends signal changing risk. Indicators that are hard to collect, rarely reviewed, or unrelated to threats provide little decision value.

Question 22Information Security Risk Management Framework

A regulated firm must demonstrate that its risk decisions are defensible to an external examiner. Which practice most strengthens defensibility?

  1. Maintaining documented methodology, assumptions, evidence, and approvals for risk decisions Correct answer.
  2. Relying on undocumented expert intuition for each decision
  3. Restricting risk records to verbal briefings
  4. Recalculating all ratings annually without recording changes

Explanation

Defensibility depends on showing a consistent method, stated assumptions, supporting evidence, and authorized sign-off. This creates an auditable trail that explains why each decision was reasonable at the time.

Question 23Information Security Risk Management Framework

An organization applies a control that reduces impact but not likelihood, and separately applies one that reduces likelihood but not impact. How should the combined effect on residual risk be reasoned about?

  1. The two effects always multiply to zero residual risk
  2. Residual risk is unaffected by either control
  3. Only the impact-reducing control matters for residual risk
  4. Each control addresses a different factor, so the combined reduction should be assessed jointly rather than assumed additive Correct answer.

Explanation

Likelihood and impact are distinct dimensions of risk, and controls may act on one or both. The combined residual exposure must be evaluated as a whole, because reductions along different dimensions do not simply add and never reach zero automatically.

Question 24Information Security Risk Management Framework

A risk assessment relies on historical incident frequency to estimate likelihood, but the operating environment has changed substantially since that data was collected. What is the most significant limitation?

  1. Past frequency may not represent future conditions when the environment has materially changed Correct answer.
  2. Frequency data is only valid for qualitative assessments
  3. Historical data is always more reliable than expert judgment
  4. Incident data cannot be expressed numerically

Explanation

Frequency-based estimates assume the conditions that produced past events will persist. When technology, threats, or business processes change materially, historical data may systematically misstate current likelihood.

Question 25Information Security Risk Management Framework

Two business units rate the same enterprise risk differently because they use separate scales and definitions. Which governance action best improves consistency across the organization?

  1. Restrict risk reporting to the unit with the highest rating
  2. Eliminate the risk register and rely on individual judgment
  3. Adopt a common risk taxonomy, rating scale, and defined criteria applied organization-wide Correct answer.
  4. Allow each unit to keep its own scale and aggregate ratings by simple averaging

Explanation

Comparable ratings require shared definitions, scales, and criteria so that similar exposures receive similar scores across units. Averaging incompatible scales produces misleading aggregates and undermines enterprise prioritization.

Question 26Information Security Risk Management Framework

Which document establishes the organization's overall direction and commitment for managing information security risk across all business units?

  1. The enterprise risk management policy approved by executive leadership Correct answer.
  2. The vulnerability scan report produced each quarter
  3. The firewall configuration standard for the data center
  4. The disaster recovery runbook maintained by the operations team

Explanation

A risk management policy is issued at the top of the organization and expresses management's intent, scope, and commitment, giving authority to lower-level procedures. Operational artifacts such as runbooks, scan reports, and configuration standards implement that direction but cannot establish it.

Question 27Information Security Risk Management Framework

In a risk management framework, what distinguishes a threat from a vulnerability?

  1. A threat is an internal control gap, while a vulnerability is an external actor with hostile intent
  2. A threat exists only after an incident, while a vulnerability exists only before an incident
  3. A threat is a potential cause of harm, while a vulnerability is a weakness that the threat could exploit Correct answer.
  4. A threat is measured in monetary loss, while a vulnerability is measured in elapsed time

Explanation

Threats are potential sources of harm such as attackers, malware, or natural events, whereas vulnerabilities are weaknesses in assets, processes, or controls. Risk arises from the interaction of a threat with a vulnerability, often expressed through likelihood and impact.

Question 28Information Security Risk Management Framework

Which activity occurs during the risk identification step of a risk assessment?

  1. Reporting residual risk to the board after treatment is complete
  2. Selecting the treatment option that offers the lowest residual risk
  3. Assigning a monetary value to each identified risk for the annual budget
  4. Compiling an inventory of assets, threats, and existing controls that could affect objectives Correct answer.

Explanation

Risk identification is about discovering and recording what could affect objectives, including assets, threat sources, vulnerabilities, and current controls. Valuation, treatment selection, and reporting happen in later steps of the risk management process.

Question 29Information Security Risk Management Framework

An organization wants to express risk using a five-point likelihood scale multiplied by a five-point impact scale. Which property must the framework define so that two assessors score the same scenario consistently?

  1. The criteria that anchor each point on both scales Correct answer.
  2. The job title of the person who approves the register
  3. The frequency with which the risk register is archived
  4. The name of the software tool used to record the score

Explanation

Consistency in scoring depends on calibrated scale definitions that describe what each level means in observable terms. Without anchored criteria, assessors interpret levels differently and the resulting scores cannot be compared or aggregated reliably.

Question 30Information Security Risk Management Framework

A risk assessment concludes that a risk falls within the organization's risk appetite and no further action is justified. Which treatment option has been selected?

  1. Risk sharing
  2. Risk avoidance
  3. Risk modification
  4. Risk retention Correct answer.

Explanation

Retention, also called acceptance, means the organization consciously keeps the risk because it lies within appetite or because treatment cost outweighs benefit. Avoidance, sharing, and modification all involve changing the risk exposure in some way.

Question 31Information Security Risk Management Framework

Which factor most directly determines whether a residual risk must be escalated to executive management?

  1. Whether the risk was identified by an internal audit rather than by the business unit
  2. Whether the residual level exceeds the acceptance authority delegated to the risk owner Correct answer.
  3. Whether the risk register entry was created before or after the last policy review
  4. Whether the affected system runs on premises or in a cloud environment

Explanation

Escalation is driven by delegated authority: a risk owner may only accept risk up to an assigned threshold. When residual risk exceeds that threshold, the decision must move to the level holding sufficient authority.

Question 32Information Security Risk Management Framework

An organization adopts a framework and then tailors its control set to reflect its legal obligations, technology stack, and risk profile. Why is this tailoring step important?

  1. It removes the need to reassess risk once the controls have been documented
  2. It aligns generic framework guidance with the organization's actual context while preserving traceability to the source framework Correct answer.
  3. It reduces the number of controls to zero so that residual risk becomes negligible
  4. It guarantees that no audit finding can be raised against the control environment

Explanation

Frameworks are written for broad audiences, so organizations must adapt them to their own obligations, architecture, and risk tolerance while documenting the mapping back to the source. This preserves traceability and defensibility without pretending that a generic control set fits every environment.

Question 33Information Security Risk Management Framework

A risk analysis uses a qualitative rating of low, medium, or high. Which limitation should decision makers understand when comparing results across business units?

  1. Qualitative analysis requires more data collection effort than a full quantitative simulation
  2. Qualitative ratings always overstate impact and therefore systematically inflate treatment budgets
  3. Qualitative ratings cannot be recorded in a risk register and must be converted to currency first
  4. Ordinal labels carry no inherent numeric distance, so aggregation and arithmetic comparison can be misleading Correct answer.

Explanation

Ordinal scales rank order but do not establish equal intervals, so treating low, medium, and high as numbers 1, 2, 3 can distort totals and averages. Decision makers should compare within a calibrated scale and avoid arithmetic on labels across units with different definitions.

Question 34Information Security Risk Management Framework

A risk register shows that a treatment plan has slipped past its target date while the underlying threat activity has increased. Which monitoring response best reflects sound risk management?

  1. Reassess the risk with current threat data and report the changed exposure and treatment status to accountable management Correct answer.
  2. Extend the target date silently and keep the original risk rating unchanged
  3. Close the register entry so that the overdue plan no longer appears as an open item
  4. Reclassify the risk as accepted on the assumption that the plan will eventually be completed

Explanation

Monitoring must reflect changes in both treatment progress and the external environment, because a delayed plan combined with rising threat activity can increase exposure. Reassessing and reporting to accountable management keeps decisions informed and documented.

Question 35Categorization of Information Systems

Which data classification typically carries the highest risk if disclosed without authorization?

  1. Semi-public
  2. Restricted Correct answer.
  3. Internal use only
  4. Public

Explanation

Restricted information is limited to specifically authorized individuals because unauthorized disclosure could cause severe harm to the organization or to individuals. Classification levels rank sensitivity, and the most sensitive category requires the strictest controls.

Question 36Categorization of Information Systems

An organization must decide whether a system is a federal information system based on who funds and controls it. Which criterion is most decisive?

  1. Whether the system has a public-facing website
  2. Whether the system stores any personal data
  3. Whether a federal agency or contractor acting for it controls the system Correct answer.
  4. Whether the system is hosted in a commercial cloud

Explanation

A federal information system is defined by federal agency ownership or control, including systems operated by contractors on the agency's behalf. Hosting location, data type, and public exposure do not by themselves determine federal status.

Question 37Categorization of Information Systems

Which term describes combining data from multiple sources so that the aggregate reveals sensitive information not available from any single source?

  1. Tokenization
  2. Declassification
  3. Aggregation Correct answer.
  4. Redaction

Explanation

Aggregation risk arises when individually low-sensitivity data elements are combined to produce a sensitive composite. Controls often include reviewing collections as a whole rather than element by element.

Question 38Categorization of Information Systems

A system processes only publicly available marketing material and no personal or proprietary data. Which classification is most appropriate?

  1. Public Correct answer.
  2. Restricted
  3. Secret
  4. Confidential

Explanation

Information approved for release to the general public belongs in the public category and needs the fewest confidentiality controls. Assigning a higher label would impose unnecessary handling burdens without a corresponding risk.

Question 39Categorization of Information Systems

Which factor most directly determines the impact level assigned to a federal information system?

  1. The vendor that supplied the software
  2. The number of employees who use the system
  3. The age of the hardware hosting the system
  4. The potential harm from loss of confidentiality, integrity, or availability Correct answer.

Explanation

Impact levels are derived from the adverse effects on organizational operations, assets, and individuals if confidentiality, integrity, or availability is compromised. User counts, hardware age, and vendor identity are inputs at most, not the determining criterion.

Question 40Categorization of Information Systems

Which statement best distinguishes a major application from a general support system?

  1. A major application always costs more than a general support system
  2. A major application is always internet-facing
  3. A general support system never stores sensitive data
  4. A major application performs a specific mission function, while a general support system provides shared services to multiple users or systems Correct answer.

Explanation

Major applications execute clearly defined mission or business functions, whereas general support systems such as networks and data centers provide common infrastructure supporting many users and applications. Cost, data sensitivity, and internet exposure are not the defining distinction.

Question 41Categorization of Information Systems

An information system is described as a set of resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Which element is essential to this definition?

  1. A dedicated physical data center
  2. Purposeful organization of information resources Correct answer.
  3. An internet connection
  4. A staffed help desk

Explanation

The definition centers on an organized collection of resources serving information handling purposes, not on particular infrastructure. Physical facilities, support staff, and connectivity are optional implementation details.

Question 42Categorization of Information Systems

Which categorization outcome is required when a system contains data of differing sensitivity levels?

  1. Ignore the most sensitive data if it is a small percentage
  2. Average the sensitivity levels of all data sets
  3. Classify the system as public to simplify controls
  4. Classify the system at the highest impact level among the data it processes Correct answer.

Explanation

When a system handles mixed sensitivity, the overall categorization reflects the highest impact of any information processed, stored, or transmitted. Averaging or ignoring minority data would understate risk and weaken required controls.

Question 43Categorization of Information Systems

Which practice best supports maintaining an accurate inventory of an organization's information systems?

  1. Maintaining a registry updated through configuration management and change control Correct answer.
  2. Reviewing the inventory once every five years
  3. Relying on administrators to report systems voluntarily
  4. Tracking only systems that connect to the internet

Explanation

An authoritative inventory is sustained when system registration is tied to configuration management and change control processes, so new and retired systems are captured promptly. Voluntary reporting and infrequent reviews allow the inventory to drift out of date.

Question 44Categorization of Information Systems

Which boundary consideration is most important when defining an information system's scope?

  1. Limiting the boundary to a single server room
  2. Clearly identifying the people, processes, and technology under the same management authority Correct answer.
  3. Including every network device on the enterprise campus
  4. Excluding all third-party services regardless of function

Explanation

A system boundary should group components under common management control, including people, processes, and technology that support the same function. Overly broad or arbitrarily narrow boundaries distort risk assessment and control selection.

Question 45Categorization of Information Systems

Which security objective is most directly threatened when an unauthorized user alters financial records?

  1. Confidentiality
  2. Integrity Correct answer.
  3. Availability
  4. Non-repudiation

Explanation

Integrity concerns the accuracy and completeness of information, so unauthorized modification of records is an integrity violation. Confidentiality addresses disclosure, and availability addresses timely access.

Question 46Categorization of Information Systems

A system is categorized with a high availability impact but low confidentiality and integrity impacts. Which control emphasis follows?

  1. Prioritize eliminating all audit logging
  2. Prioritize public release of system documentation
  3. Prioritize contingency planning and redundancy Correct answer.
  4. Prioritize encryption of all data at rest

Explanation

Categorization by objective directs control selection toward the objectives rated highest. A high availability impact calls for contingency planning, backup, and redundancy, while confidentiality-focused controls are less central.

Question 47Categorization of Information Systems

Which scenario best illustrates a system of record?

  1. The authoritative database that is the official source for a data element Correct answer.
  2. A backup tape stored offsite
  3. A public website that republishes press releases
  4. A temporary spreadsheet used for a single meeting

Explanation

A system of record is the authoritative source for a given data element, and other systems should reference rather than duplicate it. Temporary files, backups, and republished content are not authoritative sources.

Question 48Categorization of Information Systems

Which characteristic most strongly suggests that a platform should be treated as a general support system rather than a major application?

  1. It provides enterprise email and directory services used by many mission applications Correct answer.
  2. It issues permits through a dedicated public portal
  3. It manages a single agency's case-tracking workflow
  4. It calculates monthly benefit payments for citizens

Explanation

General support systems deliver shared infrastructure and services, such as enterprise email and directory services, that many applications depend on. Mission-specific processing functions are typical of major applications.

Question 49Categorization of Information Systems

Which action is appropriate when a legacy system's owner cannot be identified during inventory review?

  1. Classify the system as public to avoid documentation
  2. Assign an accountable owner before continuing categorization Correct answer.
  3. Assume the system is low risk and exclude it from the inventory
  4. Immediately decommission the system without analysis

Explanation

Every system in the inventory needs an accountable owner who accepts risk and authorizes operation. Ownership must be established before categorization and control selection can proceed responsibly.

Question 50Categorization of Information Systems

Which pair correctly matches a data category with a typical handling requirement?

  1. Personally identifiable information - protections limiting access and use Correct answer.
  2. Declassified data - permanent prohibition on any release
  3. Public data - encrypted storage with access limited to cleared staff
  4. Proprietary data - unrestricted distribution to external partners

Explanation

Personally identifiable information requires access and use limitations to protect individuals from harm. Public data needs no such restriction, proprietary data is not freely distributed, and declassified data is by definition released.