Which of the following is not part of the contents of a PO&Ms? Response:

• A.Rules of engagement
• B.Recommended actions and milestones
• C.Resources required
• D.Scheduled completion date

Comment: *

Name: *

Email: *

Verification: *

An information system is currently in the initiation phase of the system development life cycle (SDLC) and has been categorized high impact. The information system owner wants to inherit common controls provided by another organizational information system that is categorized moderate impact. How does the information system owner ensure that the common controls will provide adequate protection for the information system?
Response:

• A.Consult with the information system security engineer and the information security architect.
• B.Perform rigorous testing of the common controls to determine if they provide adequate protection.
• C.Ask the common control provider for the system security plan for the common controls.
• D.Supplement the common controls with system-specific or hybrid controls to achieve the required protection for the system.

Comment: *

Name: *

Email: *

Verification: *

What roles and responsibilities can only be occupied by a government employee? Response:

• A.Risk Executive
  Risk Mitigation
  Risk Assessment
  Authorizing Official (AO)
• B.Chief Information Officer (CIO)
  Senior Information Security Officer (SISO)
  Authorizing Official (AO)
  Risk Executive
• C.Risk Executive
  Chief Information Officer (CIO)
  Senior Information Security Officer (SISO)
  Authorizing Official (AO)
• D.Risk Executive
  Chief Information Officer (CIO)
  Senior Information Security Officer (SO)
  Authorizing Official (AO)

Comment: *

Name: *

Email: *

Verification: *

What is included in a POA&M that is presented to the Approving Authority as part of the initial authorization package?
Response:

• A.Deficiencies that have not yet been remediated and verified throughout the RMF process
• B.Only volatile findings that require prioritization in remediation
• C.Only findings that have been evaluated as moderate or high
• D.All failed controls identified throughout the RMF process

Comment: *

Name: *

Email: *

Verification: *

An effective continuous monitoring program can be used to Response:

• A.support the Federal Information Security Management Act (FISMA) requirement for annual assessment of the security controls in information systems.
• B.replace information system security audit logs.
• C.meet an organization's requirement for periodic information assurance training of all computer users.
• D.meet the Federal Information Processing Standard (FIPS) Publication 200 requirement for monthly risk assessments.

Comment: *

Name: *

Email: *

Verification: *