FITSP-A Module 7 Exam Questions and Answers

FITSP-A Module 7 Exam Questions and Answers 1. Name the reporting tool, which automates Agency FISMA reporting directly to the DHS. a) FISMA b) DHS Reporting Metrics c) Cyberscope d) Cyberstat - Answer ️️ -Correct answer: c) CyberScope. In OMB M-10-15, CyberScope was designated as the reporting tool for FISMA reporting. Incorrect answers: a) FISMA requires the reports; b) DHS Reporting Metrics indicate what must be reported; d) CyberStat refers to OMB's reviews 2. Which family of security controls is considered Tier 2? a) Access Control b) Management Family c) Operational Controls d) Program Management - Answer ️️ -Correct answer: d) Program Management NIST SP 800-137, Paragraph 2.1.2 states: "Controls in the Program Management (PM) family are an example of Tier 2 security controls." Incorrect answers: a) Access controls are Tier 3; b) Management a class, not a family; c) Operational controls are a class, not a family. 3. What is the document that provides guidelines for developing a Continuous Monitoring (CM) program? a) SP 800-137 b) NISTIR 7756 c) SP 800-37 d) FIPS 201 - Answer ️️ -Correct answer: a) SP 800-137 NIST SP 800-137 is titled "Information Security Continuous Monitoring for Federal Information Systems and Organizations" Incorrect answers: b) is the CAESARS Framework; c) is the RMF Guide; d) is PIV guidance. 4. What is an open information security community effort to standardize how to assess and report upon the machine state, such as vulnerabilities, of computer systems? a) OCIL b) 5CAP c) CCE d) OVAL - Answer ️️ -Correct answer: d) OVAL The OVAL web site (R/) states "[Open Vulnerability and Assessment Language] OVAL is an information security community effort to standardize how to assess and report upon the machine state