I85PREP
⌘ K
NSPM-C study materials
NSPM-C study resources

NSPM-C practice questions

One question at a time. Build your NSPM-C understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1NIST Security and Privacy Management

Which NIST publication is the foundational catalog of security and privacy controls for federal information systems and organizations?

  1. NIST SP 800-171
  2. NIST SP 800-53 Correct answer.
  3. NIST SP 800-30
  4. NIST SP 800-37

Explanation

SP 800-53, Security and Privacy Controls for Information Systems and Organizations, is the master control catalog from which many other NIST documents derive tailored baselines. SP 800-37 describes the RMF process, SP 800-30 covers risk assessment, and SP 800-171 addresses protecting controlled unclassified information in nonfederal systems.

Question 2NIST Security and Privacy Management

In the NIST Risk Management Framework, which step immediately follows 'Categorize the system'?

  1. Assess the controls
  2. Authorize the system
  3. Monitor the controls
  4. Select the controls Correct answer.

Explanation

The RMF sequence is Categorize, Select, Implement, Assess, Authorize, and Monitor. Control selection follows categorization because the assigned impact level determines which baseline applies. Assessment and authorization come later, after implementation.

Question 3NIST Security and Privacy Management

Under FIPS 199, what are the three security objectives used to categorize information and information systems?

  1. Confidentiality, integrity, and availability Correct answer.
  2. Identification, authentication, and nonrepudiation
  3. Authentication, authorization, and accounting
  4. Confidentiality, privacy, and safety

Explanation

FIPS 199 defines the potential impact on confidentiality, integrity, and availability to determine the overall security category. Privacy is addressed separately in NIST privacy guidance rather than as one of the three FIPS 199 objectives. The other option sets describe access-control functions, not categorization objectives.

Question 4NIST Security and Privacy Management

What is the primary purpose of a security control baseline in NIST SP 800-53B?

  1. To provide a starting set of controls for a given impact level Correct answer.
  2. To certify products against a common criteria scheme
  3. To define the cryptographic algorithms approved for federal use
  4. To replace the need for a system security plan

Explanation

SP 800-53B supplies low, moderate, and high baselines that organizations tailor to their systems based on impact level. Baselines are starting points, not certifications, and they do not eliminate the need for a system security plan. Approved cryptography is defined in FIPS publications.

Question 5NIST Security and Privacy Management

Which NIST privacy framework function is concerned with developing the organizational understanding needed to manage privacy risk?

  1. Identify-P
  2. Protect-P
  3. Govern-P Correct answer.
  4. Control-P

Explanation

The NIST Privacy Framework core functions are Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P. Govern-P was added to emphasize organizational risk management strategy, roles, and policy. Identify-P focuses on inventorying data and understanding the environment rather than governance.

Question 6NIST Security and Privacy Management

A system processes data whose loss would cause severe or catastrophic harm to organizational operations. Under FIPS 199, which impact level applies?

  1. High Correct answer.
  2. Low
  3. Not categorized
  4. Moderate

Explanation

FIPS 199 assigns High when the potential impact is severe or catastrophic, Moderate when it is serious, and Low when it is limited. The overall system category is the highest impact assigned across confidentiality, integrity, and availability.

Question 7NIST Security and Privacy Management

In NIST terminology, what distinguishes a security control's 'implementation' from its 'assessment'?

  1. Implementation is applying the control; assessment is evaluating whether it operates as intended Correct answer.
  2. Implementation is documenting the control; assessment is authorizing the system
  3. Implementation is selecting the control; assessment is categorizing the system
  4. Implementation is monitoring the control; assessment is decommissioning the system

Explanation

Implementation is the act of putting a control in place, while assessment evaluates whether the implemented control is effective and operating as intended. Assessment relies on methods such as examine, interview, and test. Categorization and authorization are separate RMF steps.

Question 8NIST Security and Privacy Management

Which assessment method set does NIST SP 800-53A define for evaluating controls?

  1. Identify, protect, detect, respond, and recover
  2. Examine, interview, and test Correct answer.
  3. Plan, do, check, and act
  4. Prevent, detect, and correct

Explanation

SP 800-53A specifies examine, interview, and test as the three assessment methods used to gather evidence about control effectiveness. The other option sets describe improvement cycles, the Cybersecurity Framework functions, and generic control categories.

Question 9NIST Security and Privacy Management

How does the NIST Cybersecurity Framework organize its outcomes?

  1. Into functions, categories, and subcategories Correct answer.
  2. Into control families and enhancements
  3. Into privacy notices and consent records
  4. Into impact levels and baselines

Explanation

The CSF core is structured as functions, categories, and subcategories that describe cybersecurity outcomes. Control families and enhancements belong to SP 800-53, and impact levels and baselines belong to FIPS 199 and SP 800-53B.

Question 10NIST Security and Privacy Management

An organization wants to tailor its moderate baseline by removing a control that is not applicable. What NIST term describes this adjustment?

  1. Enhancing
  2. Supplementing
  3. Scoping Correct answer.
  4. Compensating

Explanation

Scoping is the tailoring action of determining that a control is not applicable and removing it, with justification. Supplementing adds controls, enhancing strengthens a control, and compensating substitutes an alternative control when the original cannot be met.

Question 11NIST Security and Privacy Management

What role does a system security plan (SSP) play in the NIST RMF?

  1. It replaces the need for continuous monitoring
  2. It lists only the vulnerabilities found during testing
  3. It serves as the formal authorization to operate
  4. It documents the system boundary, controls, and implementation details Correct answer.

Explanation

The SSP describes the system, its boundary, the selected controls, and how they are implemented, providing the basis for assessment and authorization. The authorization decision itself is an authorization to operate, not the SSP. Continuous monitoring remains required.

Question 12NIST Security and Privacy Management

Which NIST control family addresses the process of identifying, reporting, and responding to incidents?

  1. Configuration Management (CM)
  2. Audit and Accountability (AU)
  3. Access Control (AC)
  4. Incident Response (IR) Correct answer.

Explanation

The Incident Response family covers establishing capabilities, handling incidents, reporting, and testing response. Audit and Accountability concerns logging and record review, Configuration Management concerns baselines and change control, and Access Control concerns authorization of access.

Question 13NIST Security and Privacy Management

Under NIST guidance, what is the purpose of a Plan of Action and Milestones (POA&M)?

  1. To authorize the system to operate with no residual risk
  2. To track remediation of identified weaknesses with assigned milestones Correct answer.
  3. To replace the security assessment report
  4. To define the system categorization impact level

Explanation

A POA&M documents weaknesses, planned remediation actions, resources, and milestone dates so that residual risk can be tracked and managed. It does not eliminate residual risk or replace the assessment report. Categorization is a separate RMF activity.

Question 14NIST Security and Privacy Management

What does NIST SP 800-37 require regarding authorization decisions and continuous monitoring?

  1. Authorization is ongoing and informed by continuous monitoring results Correct answer.
  2. Authorization is a one-time event that never needs revisiting
  3. Authorization is performed by the system owner alone
  4. Authorization is granted only after all risk is eliminated

Explanation

Under the RMF, authorization is maintained through continuous monitoring, and significant changes or new risk findings can trigger reauthorization. Residual risk is accepted rather than eliminated, and the authorizing official, not the system owner, makes the decision.

Question 15NIST Security and Privacy Management

Which statement best describes the relationship between FIPS 200 and NIST SP 800-53?

  1. FIPS 200 replaces SP 800-53 for national security systems
  2. FIPS 200 defines the RMF steps, and SP 800-53 defines assessment methods
  3. FIPS 200 lists privacy controls, and SP 800-53 lists cryptographic algorithms
  4. FIPS 200 specifies minimum security requirements, and SP 800-53 provides controls to satisfy them Correct answer.

Explanation

FIPS 200 establishes minimum security requirements for federal information systems, and SP 800-53 supplies the controls used to meet those requirements. The RMF steps come from SP 800-37, and assessment methods come from SP 800-53A.

Question 16NIST Security and Privacy Management

An organization is selecting controls for a moderate-impact system. Which NIST resource provides the moderate baseline it should start from?

  1. SP 800-63
  2. SP 800-53B Correct answer.
  3. SP 800-30
  4. SP 800-61

Explanation

SP 800-53B contains the low, moderate, and high control baselines that organizations tailor. SP 800-30 covers risk assessment, SP 800-61 covers incident handling, and SP 800-63 covers digital identity.

Question 17NIST Security and Privacy Management

What is the role of the authorizing official in the NIST RMF?

  1. To implement all technical controls personally
  2. To accept residual risk and formally authorize system operation Correct answer.
  3. To conduct the system categorization
  4. To write the privacy impact assessment

Explanation

The authorizing official reviews assessment results and accepts residual risk on behalf of the organization, issuing the authorization decision. Implementation is performed by system personnel, categorization is a separate activity, and privacy assessments are prepared by the organization's privacy staff.

Question 18NIST Security and Privacy Management

In the NIST Privacy Framework, which function is most directly concerned with managing data processing to meet privacy requirements?

  1. Identify-P
  2. Control-P Correct answer.
  3. Protect-P
  4. Communicate-P

Explanation

Control-P covers the policies, processes, and procedures used to manage data processing so it meets privacy objectives. Identify-P inventories data and environment, Protect-P applies safeguards, and Communicate-P addresses transparency and stakeholder communication.

Question 19NIST Security and Privacy Management

Which NIST publication provides guidance on conducting risk assessments that feed the RMF?

  1. SP 800-137
  2. SP 800-30 Correct answer.
  3. SP 800-171
  4. SP 800-53A

Explanation

SP 800-30 provides guidance for conducting risk assessments, including threat identification, vulnerability analysis, and likelihood and impact determination. SP 800-53A covers control assessment, SP 800-171 covers CUI protection, and SP 800-137 covers continuous monitoring.

Question 20NIST Security and Privacy Management

A control is marked as 'not applicable' in a system's control selection. What should accompany that decision in NIST practice?

  1. Silent removal so the baseline stays clean
  2. A documented justification explaining why the control does not apply Correct answer.
  3. A waiver that eliminates the need for monitoring
  4. An automatic upgrade to the high baseline

Explanation

Tailoring decisions such as scoping out a control must be justified and documented in the SSP so the reasoning is transparent to assessors and authorizing officials. Silent removal undermines accountability, and scoping does not change the baseline or eliminate monitoring.

Question 21NIST Security and Privacy Management

Which statement accurately describes the NIST Cybersecurity Framework's intended use?

  1. It is a voluntary framework for managing cybersecurity risk applicable across sectors Correct answer.
  2. It replaces FIPS 199 categorization for all agencies
  3. It provides the binding control catalog for national security systems
  4. It is a mandatory certification scheme for federal systems only

Explanation

The CSF is voluntary and designed to help organizations across sectors understand, manage, and reduce cybersecurity risk. It does not replace FIPS 199 categorization or the SP 800-53 catalog, and it is not a certification scheme.

Question 22NIST Security and Privacy Management

What distinguishes a compensating control from a supplemental control in NIST tailoring?

  1. A compensating control applies only to privacy; a supplemental control applies only to security
  2. A compensating control removes a control; a supplemental control renames it
  3. A compensating control substitutes for one that cannot be met; a supplemental control adds controls beyond the baseline Correct answer.
  4. A compensating control strengthens a control; a supplemental control weakens it

Explanation

Compensating controls provide an alternative means of satisfying a requirement when the prescribed control cannot be implemented directly. Supplemental controls are extra controls added beyond the baseline to address specific risks. Enhancing and scoping are different tailoring actions.

Question 23NIST Security and Privacy Management

An assessor finds that an implemented control exists but is not operating consistently. How should this be characterized under NIST assessment concepts?

  1. The control is a baseline enhancement
  2. The control is not applicable
  3. The control is a compensating control
  4. The control is implemented but not effective Correct answer.

Explanation

Assessment distinguishes whether a control is implemented from whether it is effective. A control that exists but does not operate as intended is implemented but ineffective, which should be documented as a finding and tracked. Not applicable, compensating, and enhancement are tailoring concepts, not effectiveness findings.

Question 24NIST Security and Privacy Management

Which NIST document establishes the continuous monitoring process that supports ongoing authorization?

  1. SP 800-50
  2. SP 800-137 Correct answer.
  3. SP 800-18
  4. SP 800-60

Explanation

SP 800-137 provides guidance on information security continuous monitoring, which feeds ongoing authorization decisions. SP 800-18 covers security plans, SP 800-60 covers mapping information types to impact levels, and SP 800-50 covers awareness and training.

Question 25NIST Security and Privacy Management

How does NIST SP 800-60 relate to the categorization step of the RMF?

  1. It defines the assessment procedures for each control
  2. It specifies incident response team structures
  3. It guides mapping information types to impact levels for categorization Correct answer.
  4. It lists the controls needed for each baseline

Explanation

SP 800-60 provides guidance on mapping information and information system types to the impact levels used in FIPS 199 categorization. Control baselines appear in SP 800-53B, assessment procedures in SP 800-53A, and incident response guidance in SP 800-61.

Question 26NIST Security and Privacy Management

Which NIST RMF step immediately follows the categorization of a system and results in a set of controls documented in the system security plan?

  1. Authorization to operate
  2. Continuous monitoring
  3. Control selection and tailoring Correct answer.
  4. Decommissioning

Explanation

After categorizing the system, the RMF step of selecting controls uses the applicable baseline and tailors it to the system's environment, documenting the result in the SSP. Authorization and monitoring come later in the lifecycle.

Question 27NIST Security and Privacy Management

Which NIST publication is the primary catalog of security and privacy controls for federal information systems and organizations?

  1. NIST SP 800-18
  2. NIST SP 800-61
  3. NIST SP 800-30
  4. NIST SP 800-53 Correct answer.

Explanation

NIST SP 800-53 contains the consolidated control catalog and baselines used across the RMF. The other publications address risk assessment, system security plans, and incident handling respectively.

Question 28NIST Security and Privacy Management

Under FIPS 199, which set of potential impact levels is used to express the security category of an information type?

  1. Confidential, secret, top secret
  2. Tier 1, tier 2, tier 3
  3. Minor, major, severe
  4. Low, moderate, high Correct answer.

Explanation

FIPS 199 defines three potential impact levels-low, moderate, and high-for each of the three security objectives. The overall security category is derived from the highest impact across objectives.

Question 29NIST Security and Privacy Management

Which NIST framework function groups outcomes for identifying, protecting, detecting, responding to, and recovering from cybersecurity events?

  1. The NIST Cybersecurity Framework core functions Correct answer.
  2. The NIST Privacy Framework profiles
  3. The FIPS 200 minimum requirements
  4. The RMF authorization package

Explanation

The NIST Cybersecurity Framework organizes outcomes into functions such as Identify, Protect, Detect, Respond, and Recover. These functions describe what an organization does to manage cybersecurity risk.

Question 30NIST Security and Privacy Management

What is the primary purpose of a security assessment report in the NIST assessment process?

  1. To authorize the system to operate
  2. To document assessment findings and the effectiveness of implemented controls Correct answer.
  3. To list the organization's privacy notices
  4. To categorize the system's information types

Explanation

The security assessment report records the results of control assessments, including findings and the assessor's determination of effectiveness. It supports the authorizing official's risk decision but does not itself grant authorization.

Question 31NIST Security and Privacy Management

In the NIST Privacy Framework, which function focuses on developing and implementing activities to manage privacy risk from data processing?

  1. Protect-P Correct answer.
  2. Identify-P
  3. Govern-P
  4. Control-P

Explanation

The Protect-P function covers safeguards to manage privacy risk arising from data processing, such as access controls and data minimization. Govern-P sets strategy, while Identify-P develops understanding of privacy risk.

Question 32NIST Security and Privacy Management

Which term describes the NIST RMF step in which an authorizing official accepts the risk of operating a system based on the assessment evidence?

  1. Categorization
  2. Monitoring
  3. Authorization Correct answer.
  4. Tailoring

Explanation

Authorization is the decision by a senior official to accept risk and permit system operation. It relies on the assessment package and supporting evidence.

Question 33NIST Security and Privacy Management

Which document provides the minimum security requirements that federal agencies must meet when categorizing and selecting controls?

  1. NIST SP 800-60
  2. NIST SP 800-137
  3. NIST SP 800-53A
  4. FIPS 200 Correct answer.

Explanation

FIPS 200 establishes minimum security requirements for federal information and information systems. It directs agencies to select controls from the NIST catalog.

Question 34NIST Security and Privacy Management

An organization must select a control baseline for a system categorized as high impact. Which NIST resource provides that baseline?

  1. The moderate baseline in FIPS 199
  2. The high baseline in NIST SP 800-53B Correct answer.
  3. The low baseline in NIST SP 800-53A
  4. The privacy baseline in NIST SP 800-37

Explanation

NIST SP 800-53B provides low, moderate, and high security control baselines. A high-impact system starts with the high baseline, which is then tailored as appropriate. SP 800-53 contains the control catalog, while FIPS 199 defines impact levels.

Question 35NIST Security and Privacy Management

An assessor evaluates whether a control's stated capability is present and operating as intended. Which assessment method is being applied when the assessor examines configuration settings directly?

  1. Test
  2. Interview
  3. Observe
  4. Examine Correct answer.

Explanation

Examine is the assessment method used to review, inspect, or analyze artifacts such as configuration settings, documents, and logs. Interview and test involve different evidence-gathering approaches.

Question 36NIST Security and Privacy Management

A system owner determines that a control cannot be implemented as specified but an alternative measure provides comparable protection. What NIST tailoring concept does this describe?

  1. Compensating control Correct answer.
  2. Inherited control
  3. Control enhancement
  4. Supplemental control

Explanation

A compensating control is an alternative measure that provides equivalent protection when the specified control cannot be implemented. Supplemental controls add protection beyond the baseline.

Question 37NIST Security and Privacy Management

Which NIST activity produces a prioritized list of weaknesses with planned remediation dates for authorization decision-making?

  1. The contingency plan
  2. The security categorization
  3. The privacy impact assessment
  4. The plan of action and milestones Correct answer.

Explanation

The plan of action and milestones records identified weaknesses, planned remediation, and milestones, supporting risk management and authorization decisions. It does not replace the assessment itself.

Question 38NIST Security and Privacy Management

An organization operates a system with inherited controls from a shared service provider. What should the system's authorization package document about those controls?

  1. The provider's business continuity plan
  2. Only the controls implemented locally by the system owner
  3. A statement that inherited controls require no assessment
  4. The controls and their assessment evidence as provided by the common control provider Correct answer.

Explanation

Inherited controls and their assessment evidence must be documented so the authorizing official can rely on them. The package should reflect the provider's evidence and any residual responsibility of the system owner.

Question 39NIST Security and Privacy Management

Which NIST publication describes the risk management framework steps and the roles and responsibilities for authorizing systems?

  1. NIST SP 800-61
  2. NIST SP 800-53
  3. NIST SP 800-37 Correct answer.
  4. NIST SP 800-60

Explanation

NIST SP 800-37 provides the RMF process and describes roles such as the authorizing official and system owner. The other publications address controls, categorization, and incident handling.

Question 40NIST Security and Privacy Management

A privacy team maps data processing activities to identify where privacy risk arises from collection and sharing. Which Privacy Framework function best matches this activity?

  1. Respond-P
  2. Identify-P Correct answer.
  3. Protect-P
  4. Recover-P

Explanation

Identify-P develops understanding of privacy risks, data flows, and processing activities. Protect-P implements safeguards, while Recover-P and Respond-P address incident response.

Question 41NIST Security and Privacy Management

Which statement best describes how NIST SP 800-60 supports the categorization step?

  1. It lists assessment procedures for each control
  2. It establishes continuous monitoring frequencies
  3. It maps information types to potential impact levels for confidentiality, integrity, and availability Correct answer.
  4. It defines the authorization package contents

Explanation

SP 800-60 provides guidance and mappings from information types to provisional impact levels, informing FIPS 199 categorization. It does not define assessment procedures or authorization contents.

Question 42NIST Security and Privacy Management

An assessor reports that a control exists but is not consistently applied across the environment. How should this finding be characterized?

  1. A control that is not applicable
  2. A control deficiency requiring remediation tracking Correct answer.
  3. An inherited control
  4. A fully satisfied control

Explanation

Inconsistent operation indicates a deficiency in control effectiveness that should be tracked and remediated. It is not equivalent to full satisfaction or non-applicability.

Question 43NIST Security and Privacy Management

Which NIST publication establishes a continuous monitoring strategy that supports ongoing authorization decisions?

  1. NIST SP 800-18
  2. NIST SP 800-137 Correct answer.
  3. NIST SP 800-30
  4. NIST SP 800-60

Explanation

NIST SP 800-137 provides guidance on information security continuous monitoring, enabling ongoing awareness of risk and supporting authorization. The other publications address planning, risk assessment, and categorization.

Question 44NIST Security and Privacy Management

An organization chooses to apply a control enhancement beyond the baseline because of a specific threat. What NIST concept does this represent?

  1. Inherited control
  2. Supplemental control Correct answer.
  3. Compensating control
  4. Common control

Explanation

Supplemental controls add protection beyond the baseline in response to specific risks. Compensating controls substitute for controls that cannot be implemented as specified.

Question 45NIST Security and Privacy Management

Which RMF step involves determining whether controls are implemented correctly, operating as intended, and producing the desired outcome?

  1. Assessment Correct answer.
  2. Categorization
  3. Authorization
  4. Selection

Explanation

Assessment evaluates control effectiveness through examination, interviewing, testing, and observation. It provides evidence for the authorization decision.

Question 46NIST Security and Privacy Management

A system owner is deciding whether a control is applicable given the system's architecture. Which NIST activity is being performed?

  1. Tailoring the control baseline Correct answer.
  2. Monitoring the environment
  3. Authorizing the system
  4. Categorizing the information

Explanation

Tailoring adjusts the baseline by determining applicability and documenting justification for any scoping decisions. It precedes implementation and assessment.

Question 47NIST Security and Privacy Management

An organization uses a common control provider for physical security. Which statement best reflects the NIST treatment of this arrangement?

  1. Inherited controls are excluded from the authorization package
  2. The provider's assessment evidence can support the system's authorization package with documented responsibility Correct answer.
  3. The system owner must reassess all inherited controls independently
  4. Common controls eliminate the need for authorization

Explanation

Common controls may be inherited, and the provider's assessment evidence can be leveraged when responsibility is documented. The system owner remains accountable for ensuring the evidence is valid for the system.

Question 48NIST Security and Privacy Management

Which statement best distinguishes the RMF from the Cybersecurity Framework?

  1. The RMF applies only to private organizations, while the CSF applies only to federal agencies
  2. The CSF provides control baselines, while the RMF provides profiles
  3. The RMF replaces the CSF for all federal systems
  4. The RMF prescribes a lifecycle process for authorizing systems, while the CSF organizes outcomes for managing cybersecurity risk Correct answer.

Explanation

The RMF is a process for selecting, assessing, and authorizing systems, while the CSF organizes outcomes and profiles for managing cybersecurity risk. They are complementary rather than mutually exclusive.

Question 49NIST Security and Privacy Management

An organization identifies a privacy risk that arises from combining datasets in a way that exceeds the original purpose. Which Privacy Framework function and supporting activity best addresses this?

  1. Identify-P through incident logging
  2. Respond-P through notification procedures
  3. Recover-P through restoration of affected data
  4. Protect-P through data minimization and purpose limitation safeguards Correct answer.

Explanation

Protect-P includes safeguards such as data minimization and purpose limitation to manage privacy risk from processing. Recovery and response functions address incidents rather than preventive safeguards.

Question 50NIST Security and Privacy Management

Which statement best describes how authorization decisions and continuous monitoring interact under NIST guidance?

  1. Authorization ends all monitoring obligations
  2. Monitoring replaces the need for an initial authorization decision
  3. Monitoring is performed only when a system is decommissioned
  4. Monitoring provides ongoing evidence that can trigger reauthorization or adjustment of the authorization decision Correct answer.

Explanation

Continuous monitoring supplies ongoing evidence about control effectiveness and risk, which can lead to reauthorization or changes in the authorization decision. It does not replace the initial decision.