Federal IT Security Professional (FITSP) Operator Practice Test

These questions are part of the practice quiz. Start practicing

• Which of the following is NOT listed as a phase in the SDLC as described?
• Which of the following is NOT a resource of the National Vulnerability Database (NVD)?
• RA Step 1 Task 3 focuses on which area?
• What does DI privacy control stand for?
• FIPS 181 corresponds to which concept?
• Which NIST Special Publication defines the System Development Life Cycle (SDLC)?
• What is the first step in the Contingency Planning Process?
• Major IT investments reporting for agencies is done via which exhibit?
• The Federal Information Security Management Act (FISMA) is Title III of which act?
• Which memorandum includes elements such as PIA and SORNs, Privacy Training, and agency use of web management and customization technologies (cookies)?
• What does NIST 800-55 Security Metric Guide provide?
• SP-800 70 Rev2 is associated with which program?
• Which of the SP 800-65 CPIC steps involves establishing baseline prioritization?
• What are the four components of the Risk Management Framework (RMF)?
• Which of the following is a technical control family?
• How many novel smart card types are discussed in IR 7206?
• Which GAO life cycle model is described as Select-Control-Evaluate in governance and IT investment planning?
• Where is the catalog of controls used to implement baselines located?
• Which statement best describes AR-6 Privacy Reporting?
• Which description best matches AR-2 Privacy Impact and Risk Assessment?
• NIST 800-92 covers which area?
• What does M-06-19 PII Reporting require?
• Which SP 800 document covers Information Security Continuous Monitoring for Federal Information System and Org?
• What does the Clinger-Cohen Act of 1996 require?
• What is the final step in the ISCM process?
• Which of the following is NOT listed as an assessment task?
• Which statement describes the depth and coverage attributes of assessment?
• Which PIV specification addresses technical interoperability requirements for smartcards?
• ___________ is an aggregate of directives, rules, and practices that prescribe how an organization manages, protects, and distributes information.
• What does Federal Continuity Directive 2 provide?
• Which SP 800 document is the Guide to Intrusion Detection and Prevention Systems (IDPS)?
• Which feature is NOT typically listed as a Network Layer Security (IPSEC) capability in the source material?
• FIPS 180-3 specifies which cryptographic function?
• RA Step 2 Task 2 focuses on identifying what?
• Which NIST IR is described as the annual Interagency Report?
• Circular A-130 contains policy on the management of what?
• Which document is known as the Secure Hash Standard?
• What are the approved digital signature standards?
• Which of the following is NOT listed as a type of guidance provided by an OMB Memorandum?
• In FIPS 140-2, which level adds tamper-evident coatings?
• Which references support PL-5 Privacy Impact Assessment?
• Which entity provides retention schedules for federal records and coordinates with records officers and NARA?
• Which sequence correctly lists the four steps of the interconnect process in order?
• Which action is part of the assessment process?
• Which requirement does the Computer Security Act of 1987 mandate for federal computer systems that contain sensitive information?
• Which of the following are uses for IDS and IDPS?
• RA Step 4 Task 2 Update Risk Assessment specifies which areas and timing?
• Which SP 800 document is the Guide to Computer Security log Management?
• In IR 7316, which aspects of access control mechanisms are discussed?
• Which of the following is a storage encryption technology?
• What does CPIC stand for?
• Which are examples of hash functions?
• Which documents support CP-2?
• Which outcome meets the CSRDA requirement?
• NIST Interagency Reports (NISTIRs) describe research of a technical nature intended for a specialized audience. True or False.
• IR 7206 Smart Cards and Mobile Devices Authentication overview describes two novel types of smart cards that?
• The Information Analysis and Infrastructure Protection (IAIP) is part of which department, and what is its primary focus?
• Which implementations are allowed for the AES algorithm according to FIPS 197?
• What does IR 7316 Assessment of Access Control System provide?
• Which security control reiterates the important parts of the security categorization?
• Which privacy control stands for Data Minimization and Retention?
• What requires a Radius server?
• FIPS 198-1 defines which keyed-hash mechanism?
• Which of the following is an area for adjusting system categorization?
• Data Quality and Integrity is the expansion for which privacy control?
• In identifying threat sources, which aspects are examined?
• Which Bluetooth security mode is non-secure?
• NIST IR 7564 provides information about security metrics. How are these metrics categorized?
• In management controls, RA stands for which?
• Which act requires each federal agency to implement an information security program and to report annually to the OMB on the adequacy of the security program, the adequacy of plans and reports relating to annual budgets, and any significant deficiency?
• Which is the final step in the interconnect process?
• Which statement about tampering in FIPS 140-2 is accurate?
• NIST 800-40 is primarily associated with?
• NIST SP 800-114 is associated with which topic according to the source material?
• Security Reauthorizations are conducted during what phase of the SDLC?
• FIPS 197 specifies the algorithm known as which encryption standard?
• In risk assessment planning, which element is considered primary?
• What is the main consideration in determining the scope of protection for an information system?
• In management controls, SA stands for which?
• Which SP 800 document focuses on the confidentiality of PII and breach response requirements?
• Compared to TKIP, CCMP is described as what?
• Which NIST Special Publication covers Security Configuration Checklists?
• What are the six steps of the RMF in the correct order?
• Which artifact provides an overview of the agency's entire IT portfolio by listing every IT investment, lifecycle, and budget-year cost information?
• What is the third step in the staffing process?
• Which phase is the first in the Security Services life cycle?
• In Federal Agency Incident Reporting Categories, which category corresponds to Malicious Code?
• What does OMB use to assess investments and make funding decisions?
• Which of the following is a phase of the Software Development Life Cycle (SDLC)?
• Which NIST IR includes the Crypto Module Validation Program and the Crypto Algorithm Validation Program?
• Which area does User Administration cover?
• Which document tracks remediation actions for control implementations?
• Which item is included in an Authorization Package?
• SP 800 94 is the Guide to Intrusion Detection and Prevention Systems (IDPS). Which model is described for IDPS?
• What is used for digital signatures?
• In the IA Policy and Standard set, which item is designated as the policy reference?
• What is the typical order of implementing security controls?
• Which pair correctly identifies the data encryption format and digital certificate standard used by S/MIME?
• Which of the following is NOT a phase of the SP 800-47 Security Guide for Interconnecting IT Systems?
• NIST SP 800-77 is associated with which security technology according to the source material?
• What does appendix A of 800-34 provide?
• Under FISMA, which items are reported to the OMB annually?
• The ________ requires agencies to identify sensitive systems, conduct computer security training, and develop computer security plans.
• The scope of IR 7206 includes which of the following?
• Which statement best describes the focus of IR 7316?
• Which of the following is an operation control family?
• Which publication addresses security and privacy in Public Cloud Computing?
• RA Step 1 is composed of three tasks. Which statement correctly describes their grouping?
• Security Functionality is typically defined in terms of what?
• Which action is part of building an effective assurance case?
• Which document defines the Digital Signature Standard?
• Which Act addresses restrictions on wiretaps and access to electronic communications?
• Which is a focus area of the Critical Infrastructure Plan?
• Which item is included in M-07-16 Privacy and Privacy Reporting?
• What is CCMP?
• Which media sanitization step involves discarding media with no other sanitization consideration?
• Which VPN model is described as the most often used to provide secure remote access?
• CCE provides nomenclature and dictionary of what?
• What does OMB M-04-04 E-authentication guidance provide guidance for?
• FIPS 180-2 defines which standard?
• Appendix J is based on which principle set?
• CSRDA stands for which act mentioned in relation to the National Checklist Program?
• What topic does NIST 800-46 address?
• Which documents support PL-4 Rules of Behavior?
• What is NIST 800-111 about?
• Which FIPS 140-2 encryption level enables environmental protections?
• FIPS 140-2 pertains to which area?
• Which of the following is a step in the staffing process?
• In what year was the Federal Information Security Modernization Act (FISMA) enacted?
• Which item is explicitly listed as part of Tier 1 risk coverage?
• Which item is explicitly listed as a physical access control in the materials?
• Which of the following is a CIO responsibility for government personnel?
• Which SP 800 document is the Guideline for Media Santitization?
• Why was the Computer Security Act of 1987 passed?
• What is the focus of FIPS 200?
• What does RMF stand for?
• Which option is NOT listed as a factor for changes to the Security Control Catalog?
• Which item is contained in the Program Management Overview?
• Which item is described as a true-floor-to-true-ceiling barrier in physical access controls?
• Which RMF step involves implementing security controls?
• In identifying threat sources, range of effects is considered for which type of threats?
• What defines a high likelihood level?
• The Economic Espionage Act defines economic espionage as theft or misappropriation of a trade secret with the intent to benefit which entities?
• What is the primary focus of NIST SP 800-92?
• Which SP defines malware categories and types, describes malware prevention techniques, and discusses malware response mechanisms?
• NIST SP 800-114 discusses which topic according to the source material?
• RA-3 Risk Assessment is supported by which NIST publication?
• OMB 02-01 provides guidance for what?
• Which of the following is an actual Federal Enterprise Architecture model?
• Which data encryption format is used by S/MIME to protect message content?
• Which of the following is a factor that affects the trustworthiness of an information system?
• Which of the following is not a technical control family?
• In the security services life cycle, which phase is responsible for specifying the right solution?
• What is the primary purpose of symmetric key encryption?
• What does 5 CFR 731.106 address?
• RA Step 4 Task 1 Monitor Risk Factors covers which areas?
• Which encryption/evaluation level is described as requiring identity-based authentication in the source material?
• Which e-authentication level requires multi-factor authentication using a hard token?
• What is a Cold site?
• Which approach involves continually balancing protection of agency information and assets with the cost of security controls and mitigation strategies?
• Which component is primarily used for auditing and monitoring in security controls, as suggested by the material?
• In what year did COPPA take effect?
• RA Step 3 Task 2 shares risk-related results to support risk responses. What is the primary purpose?
• Which of the following is not an operation control family?
• Which system is indicated for reporting instructions changes for OMB M11-33/M11-02/M12-02?
• In RA Step 2 Task 4, which elements are considered to determine likelihood?
• Which of the following is a hash algorithm?
• Which of the following is listed as a malware category?
• In RMF-5, which item communicates the decision to accept residual risk?
• What is a configuration item in a system?
• What defines a low likelihood in risk assessment?
• Which pairing correctly matches the SP number with its title as described?
• Which publication is the primary source for risk management guidance in the material?
• Which SP standard covers Protecting PII?
• Why do organizations look for automated solutions for ISCM?
• Which of the following is a stream cipher used for confidentiality among the listed symmetric algorithms?
• Which of the following is a management control family?
• Which element is contained in the Information Security Program Plan?
• Tier 1 risk coverage includes which core area?
• Which of the following is NOT listed as a security domain?
• Which publication provides an overview of information security program concepts to assist senior leadership in overseeing and supporting development and implementation?
• What does TKIP do?
• Which of the following is NOT an information input activity for risk assessment?
• The Interconnection Security Agreement (ISA) primarily details what?
• Which practice aligns with PII handling guidance?
• What does MTD stand for in the context of RTO?
• GISRA 2000 required U.S. government agencies to implement an information security program that includes planning, assessment and protection, and was replaced by which act in 2002?
• Which of the following is NOT an Assessment Testing activity?
• What is the legal precedence for federal information security policy?
• What is Federal Enterprise Architecture?
• Which document presents a program review titled PRISMA for information security management assistance?
• Which privacy control stands for Transparency?
• What SP specifies how to run name server software with restricted privileges?
• Which statement accurately describes CPIC's overall objective?
• Which statement about FIPS approval of SSL cipher suites is supported by the material?
• In FIPS 140-2, Level 1 is described as what?
• What are the Investment Life Cycle phases?
• Which reference provides fundamentals for selecting controls?
• What is the US-CERT incident category name and reporting timeframe for a CAT-3 incident?
• Which document provides a standardized approach for review and measurement of an information security program?
• What does HMAC stand for?
• Which option correctly lists the three tiers in Organizational Wide Risk Management?
• Which act superseded the Computer Security Act of 1987?
• Which of the following is NOT a step in the four-step interconnect process?
• What program employs a network of private sector, accredited testing laboratories to independently evaluate commercial security products in key technology areas?
• Which publication outlines the units accomplishments during FY 2011?
• Which legislation requires Federal agencies to develop and implement an agency-wide information security program?
• Continuous monitoring updates which document?
• Which standard is listed as an integrity standard in the material?
• Which program is used to verify cryptographic modules?
• In Federal Agency Incident Reporting Categories, which category corresponds to Unauthorized Access?
• Which SP 800 document is the Guide to Computer Security log Management?
• Which Act focuses on privacy rights of individuals to access and seek amendment of records held by federal agencies?
• Which IR provides an overview of smart cards and mobile device authentication?
• What best describes PL-6 Security Related Activity Planning?
• What does TIC stand for in the context of M-09-32?
• What does M-03-22 Guidance for Implementing the Privacy Provisions of the E-Gov Act of 2002 cover?
• What was the purpose for NIST developing the National Checklist Program (NCP) for IT products?
• CPE provides nomenclature and dictionary for what?
• Which standard defines the Digital Signature Standard?
• Which security testing and evaluation program is used to assess security features and assurances for commercial off-the-shelf products?
• NIST SP 800-88 covers which topic?
• Which area is listed as an area covered when updating the risk assessment?
• Which document is the implementation standard referenced for federal identity and authentication?
• Which of the following statements is NOT a core principle of the Federal Enterprise Architecture?
• Which statement best describes the overall concept of risk in this context?
• True or False: Any incident that involves compromised PII must be reported to US-CERT within one hour regardless of the incident category reporting time frame.
• Which NIST Special Publication defines CPIC?
• What investment life cycle model is used by GAO?
• Under the Computer Security Act of 1987, which organization was assigned to develop minimum acceptable practices, with assistance from the NSA?
• Which security control is addressed by NIST SP 800-50?
• What does PM-10 Security Auth Process require?
• Which option lists the IPSEC network layer protocol components as described in the source material?
• Which NIST Special Publication defines Security Services?
• FIPS 186-3 defines which digital signature standard?
• Which circular covers Management's Responsibility for Enterprise Risk Management and Internal Control (Revised 07/15/2016)?
• Which control requires ensuring that the collection of PII is for purposes authorized by law or regulation?
• Which NIST Special Publications cover Security Architecture?
• What does RPO represent?
• Which document would you reference for a glossary of information security terms?
• What are VPN architectures as listed in the material?
• Which of the following is NOT one of the Federal Enterprise Architecture models?
• Which SP 800-65 step focuses on prioritization requirements?
• Which department issues the Federal Information Security Memorandum (FISM)?
• What does CVSS measure?
• What control ensures that an organization recognizes the importance of trustworthiness?
• Under M-06-16, what security measure is required for mobile data when the data resides on mobile devices?
• Authority and Purpose is the expansion for which privacy control?
• What triggers updates to the risk assessment?
• What is the stated purpose of OMB Circular A-11?
• FIPS 186-2 defines which standard?
• Which SP provides guidance specifically for the DNS deployment?
• What term is used to evaluate operational information systems against the RMF to determine the security controls in place and the requirements to mitigate risk at an acceptable level?
• What are the Risk Assessment Steps? (Risk framing)
• What is the purpose of a POAM schedule?
• Which statement describes system registration?
• Which statement best describes the development life cycle relation to risk assessment?
• In AH, which mode creates a new IP header for each packet?
• Which VPN architecture option is described as the most common model for secure remote access in the material?
• Which memorandum includes Breach Notification Policy as part of its privacy provisions?
• Which act first officially declared what constitutes a National Security System?
• ___________ can verify the authenticity of the sender and enforce nonrepudiation to prove that the sender is who she/he claims to be and cannot deny sending it.
• Which of the following is an Information Sharing and Analysis Center (ISAC)?
• What disposal method is recommended by 800-88 sanitization guidelines for paper-based medical records containing PII?
• Which standard governs digital certificates used by S/MIME?
• What is the process of comparing definitions of what activity is considered normal against observed events to identify significant deviations called?
• Which item is listed as a malware category?
• Which NIST IR describes System and Network Security Acronyms and Abbreviations?
• Which SP 800 document is the Technical Guide to Information Security Testing and Assessment and works with SP 800-53a for testing and assessment guidance?
• In Bluetooth security, which security mode enforces the link-level security?
• Which PKI component is used to revoke certificates before expiration?
• Which action is part of long-term log data storage?
• What directive establishes a national policy for Federal Departments and agencies to identify and prioritize US critical infrastructure and key resources to protect us from terrorist attacks?
• Which media sanitization step protects confidentiality of data against a laboratory attack?
• Which statement best describes Common Controls?
• NIST 800-94 addresses which technology?
• RA Step 2 Task 5 determines Impact. Which elements are included?
• How are privacy and security described in Appendix J?
• Which function facilitates sharing of risk information and coordinates with senior leadership?
• Under the Clinger-Cohen Act, which of the following describes a National Security System?
• The Health Information Technology for Economic and Clinical Health Act (HITECH) is part of which act enacted in 2009?
• What is the primary subject of IR 7206?
• Which is the final step in the Contingency Planning Process?
• In what security mode are Bluetooth devices considered promiscuous?
• Security reauthorizations are associated with which SDLC lifecycle phase?
• NIST IR 7359 Information Security Guide for Gov Executives provides what kind of guidance?
• What does SP 800-66 Rev 1 Implementing the HIPAA Security Rules provide?
• The National Institute of Standards and Technology (NIST) was formerly known as what name?
• Which function takes streams of data and reduces them to a fixed size using a one-way operation?
• Which of the following is listed as a security domain example?
• What does a security assessment report provide?
• Which scenario best describes host-to-host VPN usage?
• Following the loss of 26 million records containing PII, M-06-16 requires which of the following?
• FIPS 198-1 defines which of the following?
• What is the first step of the ISCM process?
• PRISM Topic Areas of Coverage provide focus on which aspect of information security program management?
• SP 800-144 provides guidelines on security and privacy in what context?
• In the security services life cycle, which phase ensures operational success?
• In management controls, CA stands for which?
• Which requirement is specified by DM-1 Data Minimization privacy control?
• RA Step 1 Task 2 involves identifying Scope, determining what will be considered in the assessment, including organizational applicability, time frame supported, and architectural/technology considerations.
• Which term defines the boundary around an organization's information systems for protection purposes?
• RA Step 2 Task 4 (assessing inputs) is described as selecting the analytic approach and models for the assessment. Which option correctly identifies this task?
• The combination of CPE, CVE, OVAL is associated with which of the following?
• Which items are typically included in a System Registration Declaration?
• SP 800-137 ISCM guidelines define maintaining ongoing awareness of what?
• In PKI, which component verifies a user's identity before issuing a certificate?
• Which of the following is NOT listed as a common control candidate?
• Which document provides guidelines on TT&E design, testing, training, and exercises?
• Which publication discusses two novel smart card types using standard handheld interfaces?
• What does M-06-15 Safeguarding PII require?
• Which control addresses privacy risk management across the life cycles of all processes that collect or handle PII?
• Which SCAP specification provides a standard naming and dictionary of system configuration issues?
• Which statement best describes ISCM?
• What elements are components of an information system?
• Which statement best describes Tier 3 risk in relation to Tier 1 and Tier 2 decisions?
• Tier 3 addresses risk from which perspective?
• Which document supports PM-8 Critical Infrastructure Plan?
• What does M-02-01 cover?
• Which NIST Special Publication provides the Guide to Applying the Risk Management Framework to Federal Information Systems?
• Which SP 800 document is the Information Security Handbook - A guide for managers?
• Which memorandum is associated with e-authentication and federal online service access criteria?
• What does AP privacy control stand for?
• Which standard validates the Secure Hash Algorithm family?
• Which of the following is NOT a step in the Contingency Planning Process?
• Which security control is addressed by NIST SP 800-16?
• What does M-03-19 cover?
• Accountability, Audit, and Risk Assessment is the expansion for which privacy control?
• Which RMF step provides ongoing oversight after authorization?
• Which references support PL-5 Privacy Impact Assessment?
• Which CPIC-related exhibit is explicitly mentioned as part of the process?
• Which memorandum is designed to force implementation of HSPD-12 Personal Identity Verification criteria along with M05-24, M06-06, M-06-18, M08-01 and M11-11?
• When a hard drive from a classified information system is recycled and reused within the organization, which media sanitization method is recommended?
• In Federal Agency Incident Reporting Categories, which category corresponds to Investigation?
• What NIST Pub superseded the original SP 800-30 as the primary source for guidance on risk management?
• As part of monitoring the security posture of agency desktops, OMB requires federal agencies to use vulnerability scanning tools that leverage the ________ protocol.
• What is a National Security Letter?
• What is the first phase of Security-Focused Configuration Management (SecCM)?
• Which NIST document number is associated with IPSEC according to the source material?
• Which input activity involves gathering information directly from on-site stakeholders?
• RMF Step 3 - Implement Controls includes which of the following activities?
• NIST 800-45 pertains to which domain?
• Who approves FIPS?
• Why was M-09-32 Trusted Internet Connections initiated?
• Which SP 800 document is the Information Security Handbook - A guide for managers?
• Which privacy control corresponds to Transparency?
• What is EPHI?
• Which of the following statements about IR 7298 is true?
• The AES standard specifies which algorithm?
• Which category includes Exercise/Network Defense Testing in Federal Agency Incident Reporting Categories?
• What are the four IDPS technologies listed?
• Which item is NOT listed as part of Tier 1 risk coverage?
• Which term describes the management of user accounts and access within an organization?
• RA Step 2 Task 3 focuses on identifying what domains?
• Which of the following is NOT a SCAP component?
• In which AH mode does not create a new IP header?
• FIPS 190 focuses on guidelines for what?
• What are the approved integrity standards?
• How many control families exist within SP 800-53 r4 across control types?
• During what phase of the SDLC should the organization consider the security requirements?
• Which of the following are examples of information sources?
• Which references support CA-5 Plan of Action and Milestones?
• Which of the following is a key establishment algorithm listed as supported by Fortezza cards?
• Which NIST Special Publication defines Security Products?
• FIPS 199 is Standard for Security Categorization of which?
• Assessment findings are documented in which report?
• What is NIST 800-23?
• Where can vulnerability information be found?
• What is the purpose of Capital Planning and Investment Control (CPIC)?
• SP-800-39 superseded which previous NIST Special Publication?
• IR 7298 Glossary of Key Information Security Terms includes terms from which sources?
• Malware Incident Response includes which phases in the listed sequence?
• Which of the following is a Responsibility of the Risk Executive function?
• RA Step 1 Task 3 involves identifying Assumptions and considerations, including assumptions, constraints, risk tolerances, and priorities/trade-offs.
• RA Step 1 Task 1 involves identifying the purpose of the assessment, including information the assessment will produce and the decision it will support.
• Which organization is NOT listed among the Incident Response (IR) organizations?
• Which SP 800 document provides guidelines for media sanitization, including techniques and disposal?
• What is a Warm site?
• Which directive addresses national policy for protecting critical infrastructure from terrorist attacks?
• Which of the following is a Common Control Provider responsibility?
• An MOU/A document primarily documents what?
• Which publication provides a cross-country perspective on validated cryptographic modules and confidence in security assurance?
• Which standard defines Security requirements for cryptographic modules?
• What does PM-1 Information Security Program Plan document?
• Which type of detection is the process of comparing signatures against observed events to identify possible incidents?
• What are resources of National Vulnerability Database (NVD)?
• What is the first step in handling an incident?
• What are the two AH modes?
• FIPS 191 provides guidelines for the analysis of what?
• What does DM-2 Data Retentions and Disposal support require?
• Under the Clinger-Cohen Act, which of the following is a criterion for a system to be considered National Security System?
• RA Step 1 Task 4 requires that each information source be described with which four elements?
• What SP describes Secure Portal VPNs and Secure Tunnel VPN?
• Which of the following is NOT typically considered part of the CPIC decision process?
• In Federal Agency Incident Reporting Categories, which category corresponds to Inappropriate Usage?
• What does RTO define?
• SP 800-83 is the guide to Malware Incident Prevention and Handling. Which of the following does it define?
• How does SSL VPN operate with a browser-based client?
• RA Step 3 Task 1 focuses on communicating risk assessment results to whom?
• ISCP stands for what?
• Which provision did the Computer Security Act of 1987 mandate regarding federal employees who use those systems?
• Which basic cryptographic service provides confidentiality?
• Which memorandum focuses on E-Authentication Guidance for Federal Agencies?
• What is the purpore of Open Security Architecture?
• The National Checklist Program for IT products was developed as part of CSRDA to facilitate what?
• SP 800-53 r4 control families count statement?
• 800-39 has replaced 800-30 as the authoritative source of comprehensive risk management guidance.
• In the security services life cycle, which phase involves engaging the right source?
• Which IR would you consult for key information security terms used in NIST publications?
• Under the Clinger-Cohen Act, what does the 'at risk' category indicate?
• What is a risk assessment summary?
• FIPS 201 defines which identification standard?
• What is the full title of the USA PATRIOT Act?
• In PKI, which component serves as the database of active digital certificates for a CA?
• Which organization developed the National Checklist Program (NCP) for IT products?
• Which requirement is specified by DI-1 Data Quality privacy control?
• How many layers of Encryption standards are defined by FIPS?
• Which Special Publication describes attacker tools such as backdoors?
• Which approach is an effective method to analyze log data?
• Which document focuses on embedded access control mechanisms and their capabilities and limitations?
• Which statement is true about Tier 3 risk?
• What topic does NIST SP 800-12 address?
• Which detection method involves comparing a predetermined profile of benign protocol activity for each protocol state against observed events to identify deviations?
• What does OMB Circular A-127 Revised prescribe?
• Tier 2 addresses risk from which perspective?
• What is the stated purpose of the Computer Fraud and Abuse Act (CFAA) of 1986?
• Which SP 800 document would you consult for media sanitization guidelines and tools?
• Which item is included in the Program Management Overview?
• Tier 2 of the 3-tiered risk management approach addresses risk-related concern at which level?
• Which publication is focused on outlining the eight topic areas used for strategic information security program management under PRISM?
• RA-3 security control must be partially implemented prior to the implementation of other controls in order to complete the first two steps in the Risk Management Framework: True or False?
• What does FIPS 199 specify?
• Which action is a poor practice for long-term log storage?
• NIST 800-83 is focused on which security domain?
• What does the E-Government Act of 2002 accomplish?
• Which document is used to document the System Security Plan?
• What does Authentication Header (AH) provide in IPsec?
• Which is the initial step in the interconnect process?
• Which of the following is one of the five Federal Enterprise Architecture models?
• CERT/CC is best described as which type of organization?
• Tier 2 risk decisions are guided by decisions in which tier?
• Baselines are based upon the IMPACT level as defined in FIPS 199, selected via CNSSI-1253 or FIPS 200, and now implemented through catalog of controls found in SP 800-53. Baselines are based upon the IMPACT level defined in which standard?
• Which memorandum is associated with privacy provisions that include PIA and SORNs and privacy training?
• Which phase describes capturing lessons learned to improve future responses in Malware Incident Response?
• Which of the following describes a key provision of the Clinger-Cohen Act?
• Which document is titled Automated Password Generator?
• Which of the following is an Information System Manager responsibility?
• Which of the following is a security testing and evaluation program?
• Which NIST Special Publication covers CPIC?
• Which IPSEC component is responsible for negotiating security associations and keys?
• Which IPSEC protocol provides data integrity and authentication of packets?
• In Federal Agency Incident Reporting Categories, which category corresponds to Denial of Service?
• Which of the following is NOT a control type in SP 800-53 r4?
• What is another name for the Information Technology Management Reform Act of 1996?
• In management controls, PL stands for which?
• What is the purpose of the US Government Configuration Baseline (USGCB)?
• What is the second step in the staffing process?
• Is reauthentication required every three years?
• What is SP-800-115?
• Which privacy control stands for Individual Participation and Redress?
• In AES, which parameters are variable according to the standard?
• Capital Planning and Investment Control entails which of the following?
• How is risk assessment typically conducted over time?
• NIST SP 800-63 defines which area of identity and access management?
• Which SP 800 document defines PII and impact levels and provides for confidentiality considerations of USG systems and breach response requirements?
• What does IAIP stand for in the IR context?
• NIST SP 800-113 is associated with which security protocol according to the source material?
• What does NIST 800-56 and 800-57 address?
• Which NIST IR covers biometrics validation and implementation under FIPS-201 and HSPD-12?
• If you need an assessment of an access control system, which IR would you consult?
• Who leads the privacy incident response plan according to SE-2 Privacy Incident Response?
• Which of the following is an internal information source?
• What measures are provided by 800-55 Performance Measurement Guide for Info Systems?
• Which control is described as addressing only incidents that relate to PII?
• Which media sanitization step is described as the ultimate form of sanitization?
• What is WPA-Personal or WPA-PSK designed for?
• Which control is associated with Contingency Plan Testing and Exercises in TT&E under NIST 800-84?
• Which of the following is NOT a method of assessment?
• What does CVE stand for?
• In Federal Agency Incident Reporting Categories, which category corresponds to Scans/Probes/Attempted Access?
• What does AR privacy control stand for?
• Which standard discusses mapping types to categories in security categorization?
• FIPS 201 defines personal identity verification of federal employees and contractors. The standard is based on which initiative?
• Which standard covers the Keyed-Hash Message Authentication Code (HMAC)?
• Which of the following is NOT included in an Authorization Package?
• What does ICD 704 address?
• Which sequence correctly lists the steps for handling an incident?
• What does OMB Memorandum 10-28 cover?
• What is the focus of SE-1 Inventory of Personally Identifiable Information?
• Which SP 800 document is the Guide for Security Focused Configuration Management of Information Systems?
• What establish the scope of protection for organizational information systems?
• Under CFAA, which definition describes a 'protected computer'?
• Which NIST SP document is associated with PIV?
• Which statement best describes the role of vulnerability scanning tools in government IT security?
• The Health Information Technology for Economic and Clinical Health Act (HITECH) mandates audits of health care providers to investigate HIPAA compliance and is part of which larger recovery act enacted in 2009?
• In Malware Incident Response, which phase immediately follows Preparation?
• RA Step 2 Task 6 determines risk by combining which two elements?
• Which SP includes recommendations for controls to mitigate malware attacks and improve an organization's malware program?
• RA Step 2 Task 1 focuses on identifying threat sources of concern, including which attributes?
• In the RMF, which step involves categorizing the information system?
• What does CCSS stand for in software security configuration contexts?
• RA Step 1 Task 5 requires identifying what?
• M-00-13 covers privacy policies and data collection on Federal Web Sites. It requires agencies to do which of the following?
• Digital signatures provide which assurance?
• Which VPN model is the least used and typically employed for remote management of servers by system administrators?
• In the RMF, which step directly follows 'Assess'?
• Which protocols secure traffic between a browser and the SSL VPN device?
• What does IR 6/7 require?
• COPPA, the Children's Online Privacy Protection Act, is managed by which federal agency?
• What defines a medium likelihood level?
• Which allows a user to use a single SSL connection to a Web site to securely access multiple network services?
• What are the five phases of the SDLC?
• Which mandate uses NIST SP-800-53?
• The Clinger-Cohen Act requires alignment of IT investments with what planning process?
• Which references support CA-5 Plan of Action and Milestones?
• Which statement about SP 800-53 Appendix J is correct?
• What is 800-61 focused on?