Question 1

One Tech's AO has been informed of a significant change in the threat landscape, which increases the likelihood of a previously low-impact vulnerability being exploited. What should the AO do in response to this new information?

Options :

A : Immediately revoke the system-s ATO

B : Request an updated security control assessment focusing on the affected vulnerability

C : Consult with the system owner and security team to evaluate the increased risk and determine appropriate mitigation measures

D : Wait for the next scheduled security control assessment to review the risk

Answer: C

Question 2

Which of the following is a key consideration when implementing security controls for an information system?

Options :

A : The system-s hardware and software components

B : The budget and resource constraints of the organization

C : The potential risks to the information system

D : The organizational structure of the system-s users

Answer: C

Question 3

During what phase of the SDLC does authorization reporting for new systems take place?

Options :

A : Operations/Maintenance

B : Development/Acquisition

C : Implementation/Assessment

D : Initiation (concept/requirements definition)

Answer: C

Question 4

Your organization is preparing to authorize a new information system. As part of the Prepare phase of the NIST SP 800-37 Risk Management Framework, your team is working to identify the system's stakeholders and their roles. Which of the following stakeholders would be responsible for ensuring that the system's security controls are properly implemented and maintained?

Options :

A : The system owner

B : The authorizing official

C : The system administrator

D : The security manager

Answer: C

Question 5

Which of the following is true about common controls?

Options :

A : Common controls promote more cost-effective and consistent information security across the organization

B : Common controls are easier to implement

C : Common controls are the same as hybrid controls

D : Common controls cannot be implemented in the cloud

Answer: A