Security Controls and Authorization Flashcards
6 cards from real CAP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Security Controls and Authorization flashcards as text
Which NIST SP 800-53 control family covers configuration management?
Answer: CM
The CM (Configuration Management) family includes controls for baseline configurations, change control, and software usage restrictions.
What is the purpose of an Interconnection Security Agreement (ISA)?
Answer: To document the security requirements for a connection between two systems
An ISA establishes the security interface requirements and responsibilities when two systems are interconnected.
Which document formally describes the security controls applied to a system and how they are implemented?
Answer: System Security Plan
The System Security Plan (SSP) comprehensively describes all security controls and their implementation details for the information system.
Which control overlay in NIST SP 800-53 provides additional guidance for classified national security systems?
Answer: CNSS Instruction 1253 overlay
CNSSI 1253 provides the security categorization and control selection guidance for national security systems.
What distinguishes a system-specific control from a hybrid control in NIST SP 800-53?
Answer: System-specific controls are implemented only for the local system; hybrid controls are shared and locally customized
Hybrid controls have portions implemented by a common control provider and portions implemented locally by the system owner.
Under FedRAMP, what authorization path allows agencies to reuse an existing cloud ATO?
Answer: Joint Authorization Board (JAB) Provisional ATO
A JAB Provisional ATO (P-ATO) issued by FedRAMP's Joint Authorization Board can be leveraged by multiple agencies through reciprocity.