I85PREP
⌘ K
CAP1 study materials
CAP1 study resources

CAP1 practice questions

One question at a time. Build your CAP1 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security and Privacy Governance, Risk Management, and Compliance

Which NIST publication serves as the catalog of security and privacy controls from which controls are selected during the Risk Management Framework?

  1. NIST SP 800-37
  2. FIPS 199
  3. NIST SP 800-53 Correct answer.
  4. FIPS 200

Explanation

NIST SP 800-53 provides the control catalog and the baselines used during the Select step of the RMF. SP 800-37 describes the RMF process itself, FIPS 199 defines security categorization, and FIPS 200 states minimum security requirements.

Question 2Security and Privacy Governance, Risk Management, and Compliance

FIPS 199 expresses a security category in terms of potential impact on which three objectives?

  1. Confidentiality, integrity, and availability Correct answer.
  2. Confidentiality, integrity, and accountability
  3. Confidentiality, privacy, and integrity
  4. Authentication, authorization, and availability

Explanation

FIPS 199 defines the security category using potential impact on confidentiality, integrity, and availability for each information type and for the system as a whole. The overall category is the high-water mark of those impacts.

Question 3Security and Privacy Governance, Risk Management, and Compliance

Who is accountable for accepting the residual risk of a system and granting its authority to operate?

  1. The security control assessor
  2. The authorizing official Correct answer.
  3. The information system security officer
  4. The system owner

Explanation

The authorizing official is the senior official who weighs assessment results against the organization's risk tolerance and formally accepts residual risk by issuing an authorization decision. Other roles support that decision but cannot make it.

Question 4Security and Privacy Governance, Risk Management, and Compliance

Which privacy principle limits the collection of personal data to what is directly relevant and necessary for a specified purpose?

  1. Data minimization Correct answer.
  2. Accountability
  3. Storage limitation
  4. Purpose limitation

Explanation

Data minimization requires that only personal data adequate, relevant, and necessary for the stated purpose be collected. Purpose limitation restricts how data may be used after collection, and storage limitation governs retention periods.

Question 5Security and Privacy Governance, Risk Management, and Compliance

What is the primary purpose of a Plan of Action and Milestones (POA&M)?

  1. To document how identified weaknesses will be remediated and when Correct answer.
  2. To record completion of security awareness training by staff
  3. To schedule annual control assessments across the enterprise
  4. To log security incidents reported to the authorizing official

Explanation

A POA&M records each identified weakness along with the planned corrective action, assigned resources, and milestone dates. It is the tracking mechanism used through the Monitor step to show remediation progress to the authorizing official.

Question 6Security and Privacy Governance, Risk Management, and Compliance

Which U.S. law establishes the statutory framework for federal agency information security programs, including the requirement to authorize systems before operation?

  1. FISMA Correct answer.
  2. GDPR
  3. SOX
  4. HIPAA

Explanation

FISMA requires federal agencies to develop, document, and implement information security programs and to authorize systems before they operate, relying on NIST standards and guidelines. HIPAA governs health information, GDPR governs EU personal data, and SOX addresses financial reporting controls.

Question 7Security and Privacy Governance, Risk Management, and Compliance

Which RMF step covers ongoing control assessments, POA&M tracking, and decisions to continue authorizing operation?

  1. Assess
  2. Authorize
  3. Monitor Correct answer.
  4. Implement

Explanation

The Monitor step maintains ongoing situational awareness through continuous control assessment, change and configuration management, and POA&M tracking. Results feed back to the authorizing official to support ongoing authorization decisions.

Question 8Security and Privacy Governance, Risk Management, and Compliance

Which metric expresses the maximum acceptable amount of data loss, measured in time, after a disruption?

  1. Recovery time objective (RTO)
  2. Mean time to repair (MTTR)
  3. Recovery point objective (RPO) Correct answer.
  4. Maximum tolerable downtime (MTD)

Explanation

The recovery point objective defines how far back recovery must restore data, which is the tolerable data loss expressed in time. The recovery time objective is the target duration to restore service, and maximum tolerable downtime is the total outage the mission can survive.

Question 9Security and Privacy Governance, Risk Management, and Compliance

A system's information types are rated Moderate for confidentiality and Low for integrity and availability. What is the system's overall FIPS 199 security category?

  1. Low
  2. High
  3. It cannot be determined from the information given
  4. Moderate Correct answer.

Explanation

FIPS 199 sets the overall impact level as the highest value among confidentiality, integrity, and availability across all information types processed by the system. A single Moderate rating therefore raises the system category to Moderate.

Question 10Security and Privacy Governance, Risk Management, and Compliance

During control selection, a team removes a control that does not apply to its isolated, stand-alone system and records the justification. This activity is best described as:

  1. Tailoring Correct answer.
  2. Supplementation
  3. Categorization
  4. Continuous monitoring

Explanation

Tailoring adjusts a baseline by scoping out controls that are not applicable and documenting the rationale for each decision. Supplementation instead adds controls beyond the baseline, and categorization determines impact levels before selection begins.

Question 11Security and Privacy Governance, Risk Management, and Compliance

Which arrangement best preserves the independence required of a security control assessor?

  1. An assessor employed by the same engineering team that built the system
  2. An assessor who also serves as the deputy system owner for the system
  3. An assessor who approves the remediation budget for the system each year
  4. An assessor from an independent team with no operational role Correct answer.

Explanation

Assessor independence requires that the people testing controls are free from operational responsibility for those controls and from pressure to reach a favorable result. Reporting outside the system's management chain prevents a conflict of interest.

Question 12Security and Privacy Governance, Risk Management, and Compliance

An asset is valued at $200,000, a threat would destroy 25 percent of that value, and the threat is expected once every four years. What is the annualized loss expectancy?

  1. $200,000
  2. $25,000
  3. $50,000
  4. $12,500 Correct answer.

Explanation

The single loss expectancy is $200,000 multiplied by 0.25, or $50,000. The annualized rate of occurrence is 1 divided by 4, or 0.25, so the annualized loss expectancy is $50,000 multiplied by 0.25, or $12,500.

Question 13Security and Privacy Governance, Risk Management, and Compliance

An organization buys cyber insurance to cover potential breach costs. Which risk response does this represent?

  1. Avoidance
  2. Mitigation
  3. Acceptance
  4. Transfer Correct answer.

Explanation

Transferring risk shifts the financial consequence to a third party, typically through insurance or contractual indemnification. The risk event can still occur; only the financial burden is shared with another party.

Question 14Security and Privacy Governance, Risk Management, and Compliance

In the NIST three-tier risk management hierarchy, at which tier are risk appetite, governance, and enterprise policy established?

  1. Tier 0, executive oversight
  2. Tier 1, organization Correct answer.
  3. Tier 2, mission and business process
  4. Tier 3, information system

Explanation

Tier 1 addresses organization-level governance, including risk appetite, risk tolerance, policy, and investment decisions. Tiers 2 and 3 apply that direction to mission processes and to individual systems.

Question 15Security and Privacy Governance, Risk Management, and Compliance

Which program provides standardized security authorizations for cloud services that federal agencies can reuse?

  1. FedRAMP Correct answer.
  2. FISMA
  3. The Privacy Act
  4. The NIST RMF

Explanation

FedRAMP applies a standardized baseline and assessment process to cloud service offerings so that one authorization can be reused by many agencies. This reduces duplicated assessments across government.

Question 16Security and Privacy Governance, Risk Management, and Compliance

Before deploying a new system that will collect personal information, an agency should complete which analysis to evaluate privacy risks and compliance obligations?

  1. Security control assessment
  2. Benefit-cost analysis
  3. Business impact analysis
  4. Privacy impact assessment Correct answer.

Explanation

A privacy impact assessment analyzes how personal information is collected, used, shared, and retained, and identifies privacy risks and mitigation. It is distinct from the security control assessment, which tests safeguards.

Question 17Security and Privacy Governance, Risk Management, and Compliance

Which documents form the core of the authorization package that an authorizing official reviews?

  1. The system security plan, security assessment report, and POA&M Correct answer.
  2. The contingency plan and the incident response plan
  3. The FIPS 199 categorization and the privacy threshold analysis
  4. The configuration management plan and functional test results

Explanation

The authorization package combines the security plan describing the controls, the assessment report giving independent findings, and the POA&M listing remediation commitments. The authorizing official uses these to weigh residual risk against tolerance.

Question 18Security and Privacy Governance, Risk Management, and Compliance

Under the GDPR, within what period must a data controller generally notify the supervisory authority of a personal data breach?

  1. 72 hours Correct answer.
  2. 24 hours
  3. 48 hours
  4. 30 days

Explanation

The GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to individuals. Notification to affected individuals is required without undue delay where there is a high risk.

Question 19Security and Privacy Governance, Risk Management, and Compliance

Under the U.S. Privacy Act, what must an agency publish in the Federal Register when it maintains a system of records containing personal information?

  1. A privacy impact assessment
  2. An authority to operate
  3. A system of records notice Correct answer.
  4. A records retention schedule

Explanation

The Privacy Act requires publication of a system of records notice describing the system, the categories of individuals and records, routine uses, and safeguards. This gives the public notice of how records about them are maintained.

Question 20Security and Privacy Governance, Risk Management, and Compliance

An organization receives a SOC 2 Type II report from a prospective cloud provider. What does the report primarily provide?

  1. A point-in-time list of the provider's security configurations
  2. A certification that the provider complies with federal security law
  3. Assurance that specified controls operated effectively over an audit period Correct answer.
  4. An opinion on the provider's financial statements

Explanation

A Type II report tests the operating effectiveness of controls against the trust services criteria over a defined period. A Type I report addresses only the suitability of control design at a point in time.

Question 21Security and Privacy Governance, Risk Management, and Compliance

A system relies on an enterprise identity service that holds its own authorization. How should the controls implemented by that service be treated in the relying system's security plan?

  1. Reassessed and reimplemented by the system's own security team
  2. Excluded from the plan because the service is authorized separately
  3. Documented as inherited common controls citing the provider's evidence Correct answer.
  4. Listed as an open POA&M item until the system receives its own separate authorization

Explanation

Controls implemented by a provider and relied on by a system are documented as common controls, and the provider's assessment evidence is leveraged rather than duplicated. The authorizing official still confirms the evidence is current and sufficient for the relying system.

Question 22Security and Privacy Governance, Risk Management, and Compliance

Which activity is characteristic of the Prepare step of the NIST RMF?

  1. Setting organization-wide risk tolerance, roles, and monitoring strategy Correct answer.
  2. Assessing the implemented controls against the approved security plan and reporting results
  3. Recording the authorizing official's formal decision to accept residual risk
  4. Categorizing each information type by its potential impact on the organization

Explanation

The Prepare step establishes the context for the entire lifecycle, including roles, risk tolerance, the monitoring strategy, and common control identification. The remaining steps then operate within that prepared environment.

Question 23Security and Privacy Governance, Risk Management, and Compliance

A senior executive group sets the organization's risk tolerance before system owners perform assessments. Which function does this describe?

  1. The security control assessment function
  2. The ongoing authorization process
  3. The system owner's risk acceptance role
  4. The risk executive function Correct answer.

Explanation

The risk executive function sets strategic direction and risk tolerance at the organization tier, which constrains trade-offs made at lower tiers. A system owner cannot accept risk that exceeds the stated tolerance without escalation.

Question 24Security and Privacy Governance, Risk Management, and Compliance

An agency removes direct identifiers from a dataset before sharing it. Which statement about the residual risk is most accurate?

  1. The data must be destroyed rather than shared with any other party
  2. Re-identification remains possible by combining quasi-identifiers Correct answer.
  3. Residual risk ends once names and addresses are removed from the data
  4. The data is no longer personal information under any privacy law

Explanation

Removing direct identifiers reduces but does not eliminate risk, because quasi-identifiers such as dates, locations, and demographics can be combined to re-identify individuals. Agencies therefore add protections such as aggregation, suppression, or noise injection and assess residual re-identification risk.

Question 25Security and Privacy Governance, Risk Management, and Compliance

How does ongoing authorization differ from a one-time authorization decision?

  1. It keeps the authorization current using continuous monitoring results Correct answer.
  2. It replaces the need for a security assessment report
  3. It moves authority from the authorizing official to the system owner
  4. It requires a full reassessment of every control each year

Explanation

Ongoing authorization uses continuous monitoring outputs, such as control assessment results, change data, and POA&M status, so the authorizing official can confirm that risk remains acceptable between formal reauthorizations. It does not transfer decision authority or eliminate assessment evidence.

Question 26Security and Privacy Governance, Risk Management, and Compliance

Which role is accountable for formally accepting the residual risk of operating an information system and issuing the authorization decision?

  1. Privacy officer
  2. Authorizing official Correct answer.
  3. Information system security officer
  4. System owner

Explanation

The authorizing official is the senior official who weighs the assessment results and accepts residual risk on behalf of the organization. System owners support the process by maintaining the system and its documentation, but they do not hold the authority to accept risk at that level.

Question 27Security and Privacy Governance, Risk Management, and Compliance

Which term describes the risk that remains after security and privacy controls have been implemented?

  1. Inherent risk
  2. Risk appetite
  3. Residual risk Correct answer.
  4. Risk tolerance

Explanation

Residual risk is what is left over once controls have been applied and their effectiveness considered. It is this remaining level of risk that decision makers must accept, mitigate further, or avoid.

Question 28Security and Privacy Governance, Risk Management, and Compliance

A cloud provider gives a prospective customer a completed security questionnaire and a signed self-attestation, but no independent audit report. How should the customer treat this evidence?

  1. It reflects only the provider's own assertions. Correct answer.
  2. It eliminates the need for customer monitoring.
  3. It is a reusable FedRAMP authorization.
  4. It provides assurance equal to a SOC 2 Type II report.

Explanation

Self-attestations and completed questionnaires are unaudited statements made by the provider, so they carry only limited assurance. Independent examination or authorized assessment is needed before the evidence can support reliance at the level of an audit report or an authorization.

Question 29Security and Privacy Governance, Risk Management, and Compliance

Which fair information practice principle limits the use of personal information to the purposes stated at the time of collection?

  1. Integrity and confidentiality
  2. Data minimization
  3. Storage limitation
  4. Purpose limitation Correct answer.

Explanation

Purpose limitation requires that personal information be collected for specified and legitimate purposes and not used incompatibly with those purposes. Data minimization addresses how much is collected, while storage limitation addresses how long it is kept.

Question 30Security and Privacy Governance, Risk Management, and Compliance

After an incident is detected and validated, which action should the incident response team take first?

  1. Notify every affected individual
  2. Conduct a lessons-learned review
  3. Contain the incident to limit damage Correct answer.
  4. Eradicate the root cause

Explanation

Response proceeds from detection and analysis into containment so that the scope and impact stop growing before eradication and recovery begin. Lessons learned and most notifications follow once the incident is under control and facts are established.

Question 31Security and Privacy Governance, Risk Management, and Compliance

A risk register still lists a threat as low likelihood based on an assessment completed two years ago, but the same threat has caused two incidents in the past quarter. What should the risk manager do first?

  1. Accept the risk until the next scheduled assessment cycle.
  2. Close the risk entry because the incidents were handled.
  3. Raise the impact rating to reflect the two incidents.
  4. Re-evaluate the likelihood estimate using the recent incident data. Correct answer.

Explanation

Likelihood estimates must reflect current conditions, and repeated recent incidents are direct evidence that the prior estimate is stale. Updating the likelihood input keeps the risk register accurate before any decision to treat, transfer, or accept the risk is made.

Question 32Security and Privacy Governance, Risk Management, and Compliance

An agency is retiring servers that stored sensitive data. Which action best satisfies media protection requirements before disposal?

  1. Sanitize media and record the sanitization. Correct answer.
  2. Move the servers to a locked storage room.
  3. Delete the files and empty the recycle bin.
  4. Reformat the drives and reinstall the operating system.

Explanation

Media that have held sensitive data must be sanitized using approved methods before release, and the sanitization should be documented for accountability. Simple deletion or reformatting leaves recoverable data on the media.

Question 33Scope of the System

In the risk management process, what is the primary purpose of defining an authorization boundary?

  1. To record the personal security clearances held by each system administrator
  2. To establish which components, data, and interconnections fall within the scope Correct answer.
  3. To list every asset the organization owns across all of its facilities and business units
  4. To document the annual security budget allocated to each business unit's IT program

Explanation

The authorization boundary identifies the set of components, information, and interconnections that the authorizing official is accepting risk for. Everything inside the boundary must be assessed and described in the security plan; everything outside it is addressed through other agreements. The boundary is therefore the anchor for scoping, categorization, and assessment work.

Question 34Scope of the System

Under FIPS 199, how is the overall security category of an information system determined from its three impact ratings?

  1. By averaging the individual confidentiality, integrity, and availability impact ratings
  2. By using the confidentiality rating, since it is the most sensitive attribute
  3. By selecting the rating assigned to the most business-critical application
  4. By taking the highest impact value among confidentiality, integrity, and availability Correct answer.

Explanation

FIPS 199 uses a high-water mark approach: the system's security category is the most severe impact value assigned to any of the three objectives. This reflects that a single severe consequence is enough to drive the required protection level. Averaging or prioritizing one objective would understate risk.

Question 35Scope of the System

Which statement best describes a general support system?

  1. A shared set of interconnected resources providing common services to multiple applications Correct answer.
  2. A system dedicated to processing a single category of highly sensitive mission data
  3. A system that performs a single major application's business function for one program office
  4. A system that exists only during development and is retired before operations begin

Explanation

A general support system provides common infrastructure or services, such as network, email, or directory services, on which multiple applications depend. It is authorized once and then leveraged by the applications that sit on top of it. A major application, by contrast, directly supports a specific mission or business function.

Question 36Scope of the System

Who is accountable for determining the classification level of an information asset and approving access to it?

  1. The facilities manager who controls physical access to the server room
  2. The authorizing official who signs the authority to operate for the system
  3. The information owner accountable for the data's protection requirements Correct answer.
  4. The information system security officer assigned to the hosting data center

Explanation

The information owner, usually a business or mission official, decides the sensitivity of the data and who may use it. Custodians such as system administrators implement those decisions but do not set classification. Keeping this accountability with the business prevents technical staff from making risk acceptance decisions they are not authorized to make.

Question 37Scope of the System

For authorization purposes, which best describes what constitutes an information system?

  1. A documented business process that appears in the organization's strategic plan and budget request
  2. A discrete set of information resources organized to collect, process, and share information Correct answer.
  3. The complete inventory of software licenses and maintenance contracts owned by the IT department
  4. Any server, workstation, or network device that is physically located within a data center or wiring closet

Explanation

An information system is defined by its organized collection of resources performing information-processing functions, not by physical location or procurement records. This definition lets organizations group related components into a single authorization that can be assessed and managed. Business processes and license inventories are inputs to, but not substitutes for, that grouping.

Question 38Scope of the System

An outage of a system would have a serious adverse effect on an agency's operations but would not threaten human life or national assets. Which FIPS 199 impact level applies?

  1. Low
  2. Not applicable
  3. High
  4. Moderate Correct answer.

Explanation

FIPS 199 defines moderate impact as a serious adverse effect on organizational operations, assets, or individuals. Low is limited impact, while high covers severe or catastrophic effects such as major mission failure or loss of life. The rating follows the described consequence, not the system's dollar value.

Question 39Scope of the System

An agency's application runs on a virtual server that shares physical hardware with other tenants managed by the hosting provider. How should the shared physical host be treated when the agency scopes its authorization?

  1. It is duplicated into both boundaries and assessed separately by each organization
  2. It must be excluded because another organization's data resides on the same hardware
  3. It becomes a separate major application requiring its own independent authorization
  4. It is inside the hosting provider's boundary, and its controls are inherited Correct answer.

Explanation

The provider owns and assesses the underlying infrastructure, so the customer's boundary typically stops at its own workloads and configurations. The customer documents the provided controls as inherited rather than re-assessing them. Duplicating the assessment wastes effort and blurs accountability.

Question 40Scope of the System

Two systems exchange production data over a direct network connection and are owned by different organizations. What is the most appropriate way to document this relationship?

  1. A privacy impact assessment covering the combined user population
  2. A memorandum of understanding that lists the system's hardware inventory
  3. An interconnection security agreement covering the connection and its terms Correct answer.
  4. An entry in the contingency plan describing backup tape rotation

Explanation

An interconnection security agreement records the security requirements, responsibilities, and technical safeguards for a connection between two systems. Each system retains its own authorization, and the agreement keeps both sides accountable for the shared link. Hardware inventories and contingency entries do not address the security terms of the connection.

Question 41Scope of the System

An organization-wide incident response team supports many systems under a single enterprise assessment. How should a system owner treat this capability when scoping an individual system?

  1. Mark the control as not applicable because it sits outside the boundary
  2. Inherit the control from the common provider and document the inheritance Correct answer.
  3. Assess the control once at the organization level and omit it from the SSP
  4. Reimplement the control locally within the system boundary at additional cost

Explanation

Capabilities delivered consistently across systems are common controls, assessed once at the provider level and inherited by each consuming system. The system's security plan must still identify the control as inherited and name its provider. Treating the control as not applicable or omitting it entirely leaves a gap in the documented control set.

Question 42Scope of the System

Which element is part of a system's environment of operation for authorization purposes?

  1. The personal devices that employees use at home for activities unrelated to work
  2. The source code repository maintained by the vendor that supplies the database license
  3. The marketing plan describing how the system's outputs will be promoted
  4. The facility, infrastructure, and personnel that host and operate the system Correct answer.

Explanation

The environment of operation covers the physical, technical, and human context in which the system runs, including hosting facilities, supporting infrastructure, and operating personnel. These factors affect the controls that must be selected and assessed. Vendor repositories and unrelated personal devices fall outside that operational context.

Question 43Scope of the System

An analyst must identify the information types that a system processes in order to support categorization. What should the analyst rely on most heavily?

  1. The most recent penetration test report and remediation tracker for the system
  2. The opinions of end users collected through an informal convenience survey
  3. The vendor's product brochure and the terms of its software licensing agreement
  4. NIST SP 800-60 and the organization's mission and business descriptions Correct answer.

Explanation

NIST SP 800-60 provides the catalog of information types and provisional impact assignments, while the organization's mission and business descriptions show which types actually apply. That combination supports a defensible provisional categorization. Vendor materials and test reports do not describe information types.

Question 44Scope of the System

Midway through a security assessment, a new module is added that processes a data type not previously handled by the system. What should the assessor do?

  1. Revisit the boundary and categorization, then update the scope and plan Correct answer.
  2. Continue the assessment as planned and note the new module in the final report
  3. Remove the module from the inventory until the next full authorization cycle
  4. Treat the module as out of scope because an authority to operate is already issued

Explanation

A change in data types or components can alter the boundary and the impact ratings, which in turn affects the control baseline and the assessment plan. Scope must be re-confirmed before continuing so the authorization decision covers the real system. Deferring the change to a later cycle leaves the current authorization inaccurate.

Question 45Scope of the System

A payroll system runs on dedicated servers and directly supports the agency's compensation business function. How should it be classified for authorization purposes?

  1. An interconnected system, because it exchanges data with the HR system
  2. A major application, because it performs a specific business function Correct answer.
  3. A minor application, because payroll is a routine administrative activity
  4. A general support system, because it serves users across the whole agency

Explanation

A major application directly supports a specific mission or business function and is authorized on its own. Serving many users does not make a system a general support system, which instead provides shared common services. The label depends on the system's role, not on how routine the function seems.

Question 46Scope of the System

A system stores records that are individually rated low for confidentiality, but in aggregate the full data set reveals a pattern whose disclosure would cause serious harm. How should the categorization be handled?

  1. Rate the system moderate for availability to offset the confidentiality gap
  2. Assign the higher rating to reflect the aggregate impact of the full data set Correct answer.
  3. Split the data set across two systems so that each one remains rated low
  4. Keep the low rating, because FIPS 199 requires each record to be rated on its own

Explanation

Categorization considers the impact of disclosure of the information as a whole, not record by record in isolation. Aggregation can produce a higher sensitivity than any single element suggests, and the higher value governs. Splitting data to preserve a lower label ignores the underlying risk.

Question 47Scope of the System

An agency deploys its workload on a cloud provider that already holds a FedRAMP authorization. How should the agency scope its own authorization?

  1. No agency authorization is needed, because the provider's authorization covers all of its customers
  2. The agency scopes a boundary around its workloads and inherits the provider's assessed controls Correct answer.
  3. The agency's boundary automatically expands to include other customers' data on the same host
  4. The agency must repeat the provider's infrastructure assessment inside its own boundary

Explanation

The provider's authorization covers the provider's infrastructure and services; the customer remains accountable for its own configuration, data, and applications. The customer defines a boundary around its workload and documents inherited controls per the shared responsibility split. Repeating the provider's assessment duplicates work without adding assurance.

Question 48Scope of the System

A program consists of several subsystems with different owners and different data types. What is the most defensible scoping approach?

  1. Decline to authorize, because only single-owner systems can be scoped and assessed
  2. Authorize the entire program as one system and disregard the subsystem differences
  3. Define boundaries by ownership and data, authorize each, and note interconnections Correct answer.
  4. Authorize each subsystem only after all of the other subsystems have an authorization

Explanation

Splitting a complex program into boundaries that follow ownership and data sensitivity keeps accountability clear and lets each authorization move at its own pace. The interconnections between the resulting systems must still be documented. Waiting for all subsystems or refusing to scope leaves the organization without an authorization path.

Question 49Selection and Approval of Security and Privacy Controls

Which publication serves as the centralized NIST catalog of security and privacy controls from which control baselines are drawn?

  1. NIST SP 800-30
  2. NIST SP 800-37
  3. NIST SP 800-53 Correct answer.
  4. FIPS 200

Explanation

SP 800-53 is the NIST catalog of security and privacy controls, organized into families, from which baselines and tailored control sets are built. SP 800-37 describes the Risk Management Framework process itself, FIPS 200 states minimum security requirements, and SP 800-30 provides risk assessment guidance.

Question 50Selection and Approval of Security and Privacy Controls

FIPS 199 expresses the potential impact of a security breach using which set of levels?

  1. Basic, focused, comprehensive
  2. Tier 1, tier 2, tier 3
  3. Low, medium, high
  4. Low, moderate, high Correct answer.

Explanation

FIPS 199 defines exactly three potential impact levels - low, moderate, and high - applied separately to confidentiality, integrity, and availability. Other scales such as tiers or maturity levels come from different frameworks and are not part of FIPS 199.