FISMA Interview Practice Test

These questions are part of the practice quiz. Start practicing

• Which statement BEST describes the flexibility offered by a hybrid cloud strategy?
• The documents produced by the leading agency are called what?
• In eAuthentication, MFA enhances security by using multiple forms of what?
• C&A is a process in the implementation of which law?
• What does HSPD-12 stand for?
• Which of the following is NOT among the seven NIST publications listed as used in the past?
• Nonrepudiation in Information Assurance refers to which concept?
• An Access Control List registers which of the following?
• What is the purpose of the POAM?
• What does a GRC tool help manage?
• Which artifact did the person prepare as part of the C&A process?
• What is the stated purpose of the GRC tool with respect to federal laws and policies?
• Who is primarily responsible for system-specific controls?
• In the C&A process, to whom do you report?
• Which statement best defines a vulnerability?
• What is the primary purpose of a GRC tool?
• Which circular imposes new privacy and security requirements and a structure for authority to operate for federal IT systems?
• Which control focuses on identifying vulnerabilities in information systems through scans and assessments?
• What does FIPS 199 establish?
• What best defines a hybrid security control?
• What does POAM stand for?
• What is the role of POAM in C&A?
• Accreditation is the official management decision to authorize operation of an information system. Which option matches this definition?
• Which type of control is primarily implemented by hardware, software or firmware components?
• Confidentiality definition: conserving device restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. Which option best reflects this definition?
• What best defines a managed service provider (MSP) in the context of IT services?
• What are the 3 forms of examination?
• Which control specifically addresses interconnections between information systems?
• Integrity is defined as which of the following?
• Which of the following is an operational control focused on people?
• STIGS provide guidance to lock down systems to prevent what?
• Which option is NOT listed as a type of control in the material?
• A System of Records contains information retrieved by:
• In the list of operational controls, what does SI stand for?
• Which statement accurately differentiates a minor application from a major application?
• Which SP maps information types to security categories and is used with FIPS 199?
• Scenario: A system receives protection from controls developed by entities outside the system. This is an example of which concept?
• E-Authentication is required when:
• Certification and Accreditation (C&A) is:
• What is your weakness?
• Electronic Authentication (eAuthentication) refers to the process of establishing confidence in user identities in online environments.
• What is Security Control Assessment?
• Who drafts the PIA according to the material?
• Which federal act provides the legal authority for information security modernization?
• Which of the following lists the four phases of the C&A process?
• What is an information system?
• Which of the following is NOT an assessment method used in NIST SP 800-115?
• The STIGS contain technical guidance to 'lock down' information systems/software that might otherwise be vulnerable to a malicious computer attack.
• What defines a hybrid cloud?
• Which management control is labeled PL?
• Security Control Assessor refers to which of the following?
• What is a security assessment report (SAR)?
• What is the purpose of NIST SP 800-37?
• During tailoring, which controls are identified?
• Which option is not listed as something worked on in the artifacts described?
• What does SORN stand for, and what does the Privacy Act require?
• Were you part of external or internal audits, or both?
• What is NIST SP 800-60 used for?
• What are technical controls?
• What does POAM stand for?
• Which of the following is the final phase in the C&A process?
• Accreditation boundary according to NIST SP 800-37 regroups
• Which term describes security controls that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software, or firmware components of the system?
• What does OMB stand for?
• Which acronym corresponds to Access Control in security controls?
• Which statement best describes operational controls?
• Which of the following is a C&A phase?
• Which activity is explicitly part of the C&A process in the material?
• SAS 70 audits examine controls in service organizations, often including IT controls. Which act's requirements make SAS 70 reports more important?
• Were you part of the C&A team?
• Which acronym stands for Audit & Accountability?
• Which confidentiality property states that information must not be disclosed to system entities unless they are authorized to access it?
• Which acronym stands for Identification and Authentication?
• What is the purpose of FIPS 200?
• What is a common control?
• The A&A process in federal information security is a comprehensive assessment and/or evaluation of which aspects?
• Availability refers to
• NIST SP 800-53A is described as?
• STIGS are intended to lock down information systems to mitigate what type of risk?
• NIST SP 800-30 is best described as?
• What is required before developing a System Security Plan (SSP)?
• What is a System Security Plan?
• A system should be decommissioned when which condition occurs?
• SAS 70 reports became more important due to the requirements of which act?
• What are management controls?
• STIGS are standards for which domain?
• Which control area is responsible for Contingency Planning?
• Confidentiality is
• Which control relates to general security awareness training for personnel?
• SP 800-60 is described as assisting federal agencies to do what?
• Security Control Baseline is defined as which of the following?
• What is an Access Control List?
• Which action is a confidentiality breach example?
• When you notice a security violation by someone you know, what is the appropriate action?
• What is a POAM?
• Threat assessment is defined as:
• FIPS 199 defines security categories for federal information and systems at what levels?
• To whom do agency C&A report cards are submitted?
• What is a Public Key Infrastructure (PKI)?
• Which control governs when and how configuration changes are made to information systems?
• What is NIST SP 800-34 used for?
• MA is the abbreviation for which operational control?
• In the context of contingency planning, CP-2 can be used as a predefined template for a generalized contingency plan for all organizational information systems with tailoring by system owners. Which option best reflects this use?
• Which statement about a System Security Plan is true?
• Certification and Accreditation (C&A) is a process for implementing information security. Which statement correctly describes Certification?
• What completes the acronym C&A in the context described?
• Which statement best describes the purpose of NIST SP 800-18?
• Which categories of controls were implemented in the described process?
• Which NIST SP is the contingency planning guide for information technology systems?
• What does an MOU/ISA pair entail?
• PTA is an acronym used in the material. What does it stand for?
• If a POAM is 90 days overdue, whom should you report this to?
• Which acronym denotes System & Communication Protection?
• What is a GRC tool?
• What is vulnerability scanning?
• Which statement best captures a benefit of a hybrid cloud strategy?
• The C&A process is part of implementing which federal law?
• Integrity is defined as
• Security control baseline defines minimum standards for which information?
• What does the NIST SP 800-53 provide?
• Scenario: An access control list includes groups, machines, and processes in addition to individual users. This illustrates which concept?
• What best describes a General Support System?
• Threat analysis is defined as:
• STIGS are configuration standards for DoD IA and IA-enabled devices/systems.
• Integrity applies to data in which states?
• What is the focus of an Interconnection Security Agreement?
• Scenario: The process of testing and/or evaluating security controls to determine if they are implemented correctly and operating as intended. Which concept is this?
• What is security control inheritance?
• Operational controls are security controls primarily implemented and executed by which group?
• Which of the following is NOT one of the three assessment methods described in NIST SP 800-115?
• What is a common control?
• Tailoring of Security Baseline occurs when
• What does FISMA stand for?
• RA stands for which management control?
• Vulnerability scanning is used to proactively identify security vulnerabilities of computing systems in a network. Which option best reflects this definition?
• MFA adds increased security by using multiple forms of eAuth mechanisms during a transaction.
• What is an Authorization Boundary?
• Disposition of information resources refers to which activity?
• Application developers are faced with a choice of mechanisms based on technologies to perform local or remote authentication.
• What do the initials C&A stand for in the context of FISMA?
• Which statement defines a Minor application?
• What does OMB Circular A-123 define?
• Which NIST publication is listed among the past seven and has the number 800-37?
• Who is responsible for accrediting all components within the accreditation boundary?
• How do you handle adversity or difficulties?
• ST&E results are described as involving which of the following actions?
• Which term describes the process of establishing confidence in online user identities?
• Which control focuses on maintaining records of personnel security training?
• An accreditation boundary is described as which of the following?
• HSPD-12 targets identification for which group?
• Who should be involved in SSP development besides categorization and control selection?
• What does "communication between each distinct service" imply in a hybrid cloud?
• Access Control is best described as the process of granting or denying specific requests to:
• Threat analysis versus threat assessment: which statement is correct?
• Which option is an example of an operational control?
• Which of the following is true about a Security Assessment Report (SAR)?
• Which operational control covers protecting facilities and environmental conditions?
• Information Assurance involves protecting information systems by ensuring which five aspects?
• Availability is defined as which of the following?
• Which statement about honeypots is true?
• Who is described as the leading C&A agency?
• What is the current security clearance status of the individual described?
• Which grades are used on the C&A report card?
• What is the United States Government Configuration Baseline (USGCB)?
• Which OMB circulars are mentioned as familiar?
• What is a major application?
• Which SP is described as a guide for developing security plans for federal information systems?
• What is a C&A report card?
• Which statement correctly describes the Authorization Boundary?
• Can inefficient POAM management affect an agency's C&A report card?
• What is the primary purpose of scans as described in the material?
• How many people were in your team?
• FIPS 199 is used to do what?
• Which infrastructure combination is characteristic of a hybrid cloud model?
• Which operational control is primarily about awareness and training?
• Confidentiality: the act of holding information in confidence, not to be released to unauthorized individuals. Which option reflects this definition?