FITSP-A Module 4 QUESTIONS AND ANSWERS

1. List the 3 security objectives under FISMA. a) Confidentiality, Integrity, Authentication b) Confidentiality, Integrity, Availability c) Containment, Integrity, Availability d) Confidentiality, Impact, Availability correct answer: Correct answer: b) Confidentiality, Integrity, Availability FISMA 2002, Section 3542 states: "The term 'information security' means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide - integrity...; confidentiality...; and availability, Incorrect answers: The other choices include terms that are not security objectives. 2. FIPS 199 standards apply to which types of systems? a) Unclassified Systems b) Classified Systems c) Financial Systems d) All Systems correct answer: Correct answer: a) Unclassified System and c) Financial systems FIPS Pub 199 states: "These standards shall apply to: (i) all information within the federal government other than that information that has been determined ... to require protection against unauthorized disclosure and is marked to indicate its classified status; and (ii) all federal information systems other than those information systems designated as national security systems/' Incorrect answers: Per the quote above, FIPS Pub 199 does not apply to systems with classified information. It also does not apply to national security systems. 3. Where are security controls documented? a) System Security Plan b) Risk Assessment c) Business Impact Assessment d) Privacy Impact Assessment correct answer: Correct answer: a) System Security Plan NIST SP 800-37rl defines the System Security Plan as "Formal document that provides an overview of the security requirements for an information system and describes the security controls in place or planned for meeting those requirements." Incorrect answers: The other 3 choices are assessments conducted as part of the RMF process, but do not contain the security controls. The BIA is used in contingency planning, the PIA in systems that contain PI I, and the risk assessment for all systems. 4. What is the correct order of the Risk Management Framew