CCNP Security 300-745 SDSI Practice Test 24

Correct Answer: It provides a structured, repeatable process (categorize, select, implement, assess, authorize, and monitor) for managing security and privacy risk for an information system throughout its lifecycle
Explanation: NIST SP 800-37's RMF provides a structured, repeatable lifecycle process for managing information system risk, unlike a cloud billing framework, a building construction standard, a marketing framework, a programming language specification, or a personnel scheduling framework.

Correct Answer: Select, which involves choosing a baseline set of security controls appropriate to the system's categorized impact level
Explanation: The Select step involves choosing a baseline control set appropriate to the system's categorized impact level, unlike Categorize (determining impact level itself), Monitor (ongoing assessment), Authorize (operational risk decision), Implement (deploying already-selected controls), or Assess (evaluating control effectiveness).

Correct Answer: Authorize
Explanation: The Authorize step involves an authorizing official making a risk-based decision on whether the system may operate, unlike Categorize (impact level determination), Select (control selection), Implement (control deployment), Assess (control evaluation), or Prepare (organizational readiness).

Correct Answer: Security controls could become outdated, misconfigured, or ineffective over time without being detected, since ongoing monitoring is what identifies control drift and emerging risk after initial authorization
Explanation: Skipping ongoing monitoring risks undetected control drift or emerging risk after initial authorization, unlike assuming a one-time approach causes immediate decommissioning, that DNS infrastructure fails, that it improves posture with no further effort, that it reduces compliance costs to zero, or that it has no impact on ongoing posture.

Correct Answer: The residual risk remaining after implemented controls are assessed, weighed against the organization's risk tolerance and the mission or business need for the system to operate
Explanation: Residual risk weighed against organizational risk tolerance and mission need most influences the authorization decision, which is unrelated to the documentation template's color scheme, the authorizing official's coffee brand, headquarters parking space count, an internal newsletter's font, or outdoor temperature.

Correct Answer: Accurately categorizing each system's impact level, selecting and implementing controls appropriate to that level, independently assessing control effectiveness, making risk-informed authorization decisions, and continuously monitoring systems after authorization
Explanation: Accurate categorization, appropriate control selection/implementation, independent assessment, risk-informed authorization, and continuous monitoring together provide effective RMF application, unlike selecting controls without categorization, one-time authorization with no monitoring, relying solely on self-certification, applying an identical baseline regardless of impact level, or authorizing by default with no risk-informed decision.

Correct Answer: Review the system's current configuration against the RMF Monitor step's continuous monitoring findings to determine when and why the drift occurred, and reassess whether the system's authorization remains valid given the current control gap
Explanation: Reviewing continuous monitoring findings to determine when/why drift occurred and reassessing authorization validity is the appropriate response, unlike blaming desktop wallpaper, immediately revoking authorization with no investigation, wrongly assuming drift is deprecated, blaming unrelated air conditioning, or blaming the phase of the moon.

Correct Answer: An information system's threat landscape, configuration, and mission context can all change after authorization, so continuous monitoring is what allows the organization to detect emerging risk and maintain an accurate, current risk picture rather than relying on a point-in-time assessment
Explanation: Because threat landscape, configuration, and mission context can change after authorization, continuous monitoring maintains an accurate current risk picture beyond a point-in-time assessment, unlike claiming Monitor and Authorize are identical, that risk profiles never change post-authorization, that this is guest-only, that skipping monitoring equals performing it, or that Monitor eliminates the need for earlier steps.

Correct Answer: Periodically reassessing system categorizations as their mission context or data sensitivity changes, updating control baselines as organizational and regulatory requirements evolve, and ensuring continuous monitoring coverage scales alongside the growing system portfolio
Explanation: Periodic categorization reassessment, updated control baselines as requirements evolve, and monitoring that scales with the portfolio together keep RMF effective over time, unlike a one-time categorization, assuming baselines stay appropriate indefinitely, monitoring only original systems, decade-only review, or disabling reassessment once deemed mature.

Correct Answer: Using standardized control baselines and, where appropriate, an established authorization approach such as reuse of a common control baseline or an ongoing authorization model for systems with sufficiently similar risk profiles and shared infrastructure
Explanation: Standardized baselines and reuse/ongoing authorization approaches for sufficiently similar, shared-infrastructure systems provide efficiency without skipping rigor, unlike skipping RMF for lower-risk systems entirely, assuming automatic qualification with no similarity assessment, repeating the full resource-intensive process for every similar system, fully delegating to a vendor with no oversight, or assuming lower-risk systems need no authorization at all.