Security control Families QUESTIONS WITH COMPLETE SOLUTIONS

Access Control (AC) correct answer: Organization must limit information system access to.... -authorized users -process acting on behalf of authorized users -devices -types of transactions and function that authorized users are permitted. To exercise. Awareness and Training (AT) correct answer: Organizations must ensure that managers and users of organizational information systems are.... -made aware of the security risk associated with their activities -aware of the applicable laws, executive laws, directives, policies, standards, instructions, regulations, procedures relates to security organizational information systems -ensure that organizational personnel are adequately trained to carry out their assigned information security related duties. Audit & Accountability (AU) correct answer: Organizations must... -Create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity -Ensure that the actions of an individual system user can be uniquely traced to those users so they can be held accountable for their actions. Security Assessment and Authorization (CA) correct answer: Organizations must...... -Assess the security controls in organizational information systems to determine if the controls are effectively in their application -Develop and implement a POA&M designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational information systems -Authorize the operation of organizational information systems and any associated information systems and any associated information system connections -Monitor the information system security controls on an ongoing basis to ensure the continued effectiveness of controls. Configuration Management (CM) correct answer: Organizations must...... -establish and maintain baseline configurations and inventories of organizational informational information system throughout the respective SDLC (hardware, software, firmware, and documentations) -establish and enforce security configuration settings for information tec