Security Controls and Authorization Flashcards
6 cards from real CAP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Security Controls and Authorization flashcards as text
What are the three security control baselines defined in NIST SP 800-53B?
Answer: Low, Moderate, High
NIST SP 800-53B defines Low, Moderate, and High baselines corresponding to the FIPS 199 impact categories.
Which security control family in NIST SP 800-53 addresses access control?
Answer: AC
The AC (Access Control) family contains controls governing who can access systems, data, and functions.
Control tailoring in NIST SP 800-53 allows organizations to do which of the following?
Answer: Adjust baseline controls to meet specific operational needs
Tailoring lets organizations add, remove, or modify baseline controls to fit their unique environment and risk tolerance.
Which NIST SP 800-53 control family specifically addresses audit and accountability?
Answer: AU
The AU (Audit and Accountability) family includes controls for logging, audit record retention, and review of audit logs.
What is a compensating security control?
Answer: An alternative control providing equivalent protection when the primary control cannot be implemented
A compensating control provides an equivalent level of protection when the baseline control is not feasible to implement as specified.
In the context of authorization, what does 'security control inheritance' mean?
Answer: A system leverages controls already implemented by a common control provider
Inheritance means the system benefits from controls already in place at a higher organizational level without implementing them independently.