FITSP-A Module 7 QUESTIONS WITH COMPLETE SOLUTIONS

1. Name the reporting tool, which automates Agency FISMA reporting directly to the DHS. a) FISMA b) DHS Reporting Metrics c) Cyberscope d) Cyberstat correct answer: Correct answer: c) CyberScope. In OMB M-10-15, CyberScope was designated as the reporting tool for FISMA reporting. Incorrect answers: a) FISMA requires the reports; b) DHS Reporting Metrics indicate what must be reported; d) CyberStat refers to OMB's reviews 2. Which family of security controls is considered Tier 2? a) Access Control b) Management Family c) Operational Controls d) Program Management correct answer: Correct answer: d) Program Management NIST SP 800-137, Paragraph 2.1.2 states: "Controls in the Program Management (PM) family are an example of Tier 2 security controls." Incorrect answers: a) Access controls are Tier 3; b) Management a class, not a family; c) Operational controls are a class, not a family. 3. What is the document that provides guidelines for developing a Continuous Monitoring (CM) program? a) SP 800-137 b) NISTIR 7756 c) SP 800-37 d) FIPS 201 correct answer: Correct answer: a) SP 800-137 NIST SP 800-137 is titled "Information Security Continuous Monitoring for Federal Information Systems and Organizations" Incorrect answers: b) is the CAESARS Framework; c) is the RMF Guide; d) is PIV guidance. 4. What is an open information security community effort to standardize how to assess and report upon the machine state, such as vulnerabilities, of computer systems? a) OCIL