SPED SFPC EXAM RISK MANAGEMENT FRAMEWORK (RMF) QUESTIONS
AND ANSWERS #1
Dod systems are subject to what types of threats? - correct answer Confidentiality,
integrity, or availability of information processed, stored, or transmitted by dod systems.
Define system categorization - correct answer System Categorization is the process by
which the Information Owner identifies the potential impact (low, moderate, or high) that
would result from the loss of confidentiality, integrity, and availability should a security
breach occur.
What is non-repudiation and the negative impacts of not having non--repudiation? -
correct answer Definition: Protection against an individual falsely denying having
performed a particular action. Provides the capability to determine whether a given
individual took a particular action such as creating information, sending a message,
approving information, and receiving a message.
Negative impacts :
1.) Sender could deny message was sent.
2.) Recipient of email could change message and contest that altered message was
sent by sender.
What is confidentiality and the negative impacts of not having confidentiality? - correct
answer Definition: Preserving authorized restrictions on information access and
disclosure, including means for protecting personal privacy and proprietary information.
Negative impacts of no confidentiality:
1.) Persons could be granted access to information beyond their need-to-know.
2.) Sensitive or classified information could be disclosed to an unauthorized system
What is CIA in relation to RMF? - correct answer Confidentiality: preserving authorized
restrictions on information access and disclosure
Integrity: guarding against unauthorized information modification or destruction
Availability: timely and reliable access to and use of information
What program does RMF replace? - correct answer DIACAP
What dod guidance provides direction for the implementation of RMF? - correct answer
dod 8510.01
What does the Risk Management Framework (RMF) provide? - correct answer A
structured, yet flexible approach for managing risk resulting from incorporation of
information systems into mission/business processes of organization
AND ANSWERS #1
Dod systems are subject to what types of threats? - correct answer Confidentiality,
integrity, or availability of information processed, stored, or transmitted by dod systems.
Define system categorization - correct answer System Categorization is the process by
which the Information Owner identifies the potential impact (low, moderate, or high) that
would result from the loss of confidentiality, integrity, and availability should a security
breach occur.
What is non-repudiation and the negative impacts of not having non--repudiation? -
correct answer Definition: Protection against an individual falsely denying having
performed a particular action. Provides the capability to determine whether a given
individual took a particular action such as creating information, sending a message,
approving information, and receiving a message.
Negative impacts :
1.) Sender could deny message was sent.
2.) Recipient of email could change message and contest that altered message was
sent by sender.
What is confidentiality and the negative impacts of not having confidentiality? - correct
answer Definition: Preserving authorized restrictions on information access and
disclosure, including means for protecting personal privacy and proprietary information.
Negative impacts of no confidentiality:
1.) Persons could be granted access to information beyond their need-to-know.
2.) Sensitive or classified information could be disclosed to an unauthorized system
What is CIA in relation to RMF? - correct answer Confidentiality: preserving authorized
restrictions on information access and disclosure
Integrity: guarding against unauthorized information modification or destruction
Availability: timely and reliable access to and use of information
What program does RMF replace? - correct answer DIACAP
What dod guidance provides direction for the implementation of RMF? - correct answer
dod 8510.01
What does the Risk Management Framework (RMF) provide? - correct answer A
structured, yet flexible approach for managing risk resulting from incorporation of
information systems into mission/business processes of organization
