The findings from a security control assessment are documented in which of the following documents? Response:

• A.System Security and Privacy Plan
• B.Security Assessment Report (SAR)
• C.Plan of Action & Milestones (POA&M)
• D.Security Assessment Plan (SAP)

Comment: *

Name: *

Email: *

Verification: *

Information developed from Federal Information Processing Standard (FIPS) 199 may be used as an input to which authorization package document?
Response:

• A.Authorization decision document
• B.Security assessment report (SAR)
• C.System security plan (SSP)
• D.Plan of actions and milestones (POA&M)

Comment: *

Name: *

Email: *

Verification: *

The point in time to which data must be recovered after an outage.
Response:

• A.General Support System (GSS)
• B.Internal Security Testing (IST)
• C.Recovery Point Objective (RPO)
• D.Active Security Testing (AST)

Comment: *

Name: *

Email: *

Verification: *

Common control providers have the responsibility for development, implementation, assessment, and monitoring of common controls. In which document do common control providers document common controls?
Response:

• A.System security and privacy plan
• B.Security Assessment Report (SAR)
• C.Security Puthorization Plan (SAP)
• D.Plan of Action and Milestones (POA&M)

Comment: *

Name: *

Email: *

Verification: *

What is the four-step security categorization process?
Response:

• A.1. Identify Information Types
  2. Select Provisional Impact Levels For The Information Types
  3. Review Provisional Impact Levels And Adjust/Finalize Information Impact Levels
  4. Assign System Security Category And Overall Impact Level
• B.1. Select Provisional Impact Levels For The Information Types
  2. Identify Information Types
  3. Assign System Security Category And Overall Impact Level
  4. Review Provisional Impact Levels And Adjust/Finalize Information Impact Levels
• C.1. Identify Information Types
  2. Assign System Security Category And Overall Impact Level
  3. Review Provisional Impact Levels And Adjust/Finalize Information Impact Levels
  4. Select Provisional Impact Levels For The Information Types
• D.1. Review Provisional Impact Levels And Adjust/Finalize Information Impact Levels
  2. Identify Information Types
  3. Assign System Security Category And Overall Impact Level
  4. Select Provisional Impact Levels For The Information Types

Comment: *

Name: *

Email: *

Verification: *