FITSP-A Module 5 Exam Questions and Answers

FITSP-A Module 5 Exam Questions and Answers 1. An assessment object for each security control, which identifies the specific control items being assessed and testing techniques, can be found in which document? a) NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems b) NIST Special Publication 800-53 Revision 4, Recommended Security Controls for Federal Information Systems and Organizations c) NIST Special Publication 800-53A Revision 4, Guide for Assessing the Security Controls in Federal Information Systems and Organizations d) All of the above - Answer ️️ -Correct answer: c) NIST Special Publication 800-53A Revision 4 NIST SP 800-53Ar4 states: "An assessment procedure consists of a set of assessment objectives, each with an associated set of potential assessment methods and assessment objects/' It then provides the assessment procedures with the objects for each control in SP 800-53r4. Incorrect answers: a) is the RMF Guide; c) provides the controls, but not assessment objects; d) is incorrect - only c) contains the assessment objects. 2. Examples of control activities that are specific protection-related pursuits or actions that involve people are all of the following except? a) Exercising a contingency plan b) Locking user accounts after failed logins c) Reviewing audit logs d) Moving backups to an offsite location - Answer ️️ -Correct answer: b) Locking user accounts after failed logins NIST SP 800-53Ar4, p. F-31 includes this activity in control AC-7. It is performed automatically by the system without human intervention. Incorrect answers: All other choices require people to perform at least part of the activity. Which of the following is not one of the phases of the SDLC? (System Development Life Cycle) a) Implementation b) Innovation c) Disposition (Disposal) d) Development/Acquisition - Answer ️️ -Correct answer: b) Innovation NIST SP 800-64r2, paragraph 2.1.1 states: "A typical SDLC includes five phases: initiation, development/acquisition, implementation/assessment, operations/maintenance, and disposal. Incorrect answers: a), c), and d) are all phases of SDLC per the citation above. 4. Which of the following is a valid assessment m