Practice Exam

Question 1

Which of the following persons is responsible for testing and verifying whether the security policy is properly implemented and the derived security solutions are adequate or not?
A. Data owner

B. Data custodian

C. User

D. Auditor

Answer 1

D. Auditor

Question 2

Which of the following professionals plays the role of a monitor and takes part in the organizations configuration management process?
A. Senior Agency Information Security Officer

B. Authorizing Official

C. Common Control Provider

D. Chief Information Officer

Answer 2

C. Common Control Provider

Question 3

FISMA charges which one of the following agencies with the responsibility of overseeing the security policies and practices of all agencies of the executive branch of the Federal government?
A. Office of Management and Budget (OMB)

B. National Institute of Standards and Technology (NIST)

C. National Security Agency (NSA)

D. Department of Justice

Answer 3

Office of Management and Budget (OMB)

Question 4

The British Standard BS7799 was the basis for which of the following standards?
A. ISO/IEC 154508

B. ISO/IEC 17799

C. ICO/ICE 17799

D. Executive Order (E.O.) 13231

Answer 4

B. ISO/IEC 17799

Question 5

Subsequent to a security breach, which of the following techniques are used with the intention to limit the extent of damage caused by the incident?
A. Corrective controls

B. Preventive controls

C. Change controls

D. Incident controls

Answer 5

A. Corrective controls

Question 6

Which role in the security authorization process is responsible for organizational information systems?
A. IS program manager

B. Designated authorizing official

C. Certification agent

D. User representative

Answer 6

B. Designated authorizing official

Question 7

Which of the following is not a standard phase in the System Authorization Process?
A. Pre certification

B. Post authorization

C. Post certification

D. Certification

Answer 7

C. Post certification

Question 8

This is a standard that sets essential requirements for assessing the effectiveness of computer security controls built into a computer system?
A. FITSAF

B. TCSEC

C. FIPS

D. SSAA

Answer 8

B. TCSEC

Question 9

An assessment procedure consists of a set of which things, each with an associated set of potential assessment methods and assessment objects?
A. Assessment objectives

B. Security controls

C. Operational requirements

D. Assessment objects
A. Assessment objectives

B. Security controls

C. Operational requirements

D. Assessment objects

Answer 9

A. Assessment objectives

Question 10

Which of the following statements best describes the difference between the role of a data owner and the role of a data custodian?
A. The data owner implements the information classification scheme after the initial assignment by the custodian.

B. The custodian implements the information classification scheme after the initial assignment by the operations manager.

C. The data custodian implements the information classification scheme after the initial assignment by the data owner.

D. The custodian makes the initial information classification assignments and the operations manager implements the scheme.

Answer 10

C. The data custodian implements the information classification scheme after the initial assignment by the data owner.

Question 11

NIST SP 800 53A defines three types of interview depending on the level of assessment conducted. Which of the following NIST SP 800 53A interviews consists of informal and ad hoc interviews?
A. Substantial

B. Abbreviated

C. Comprehensive

D. Significant

Answer 11

B. Abbreviated

Question 12

NIST SP 800 53A defines three types of interview depending on the level of assessment conducted. Which of the following NIST SP 800 53A interviews consists of informal and ad hoc interviews?
A. Substantial

B. Abbreviated

C. Comprehensive

D. Significant

Answer 12

B. Abbreviated

Question 13

What assessment procedure is designed to work with and complement the assessment procedures to contribute to the grounds for confidence in the effectiveness of the security controls employed in the information system?
A. Extended

B. Subordinate

C. Based

D. Cross control

Answer 13

A. Extended

Question 14

In which type of access control do user ID and password system come under?
A. Physical

B. Administrative

C. Power

D. Technical

Answer 14

D. Technical

Question 15

This stakeholders involvement is required to determine acceptable residual risk and also advises the development team if the risks associated with eventual operation of the system appear to be unacceptable.
A. Authorization Official

B. Acceptance Official

C. Accreditation Officer

D. Assessment Officer

Answer 15

B. Acceptance Official

Question 16

Which one of the following publications provides details of the monitoring security control?
A. NIST SP 800 53

B. NIST SP 800 42

C. NIST SP 800 37

D. NIST SP 800 41

Answer 16

C. NIST SP 800 37

Question 17

What process should be initiated when changes to the information system negatively impact the security of the system or when a period of time has elapsed as specified by agency or federal policy?
A. IS audit

B. Systems acquisition

C. Reauthorization

D. Reclassification of data

Answer 17

C. Reauthorization

Question 18

Applying the first three steps in the RMF to legacy systems can be viewed in what way to determine if the necessary and sufficient security controls have been appropriately selected and allocated?
A. Sequential

B. Level of effort

C. Gap analysis

D. Common control

Answer 18

C. Gap analysis

Question 19

Which of the following NIST documents provides a guideline for identifying an information system as a National Security System?
A. NIST SP 800 59

B. NIST SP 800 53

C. NIST SP 800 60

D. NIST SP 800 37

Answer 19

A. NIST SP 800 59

Question 20

Concerning residual risk which of the following statements is true?
A. It is a weakness or lack of control that can be exploited by a risk.

B. It is an indicator of threats coupled with vulnerability.

C. It is the possible risk after implementing all security measures.

D. It is the possible risk prior to implementing all security measures.

Answer 20

C. It is the possible risk after implementing all security measures.