Question 1
A system owner has implemented required controls. An assessor now examines evidence to determine whether those controls operate effectively. Which RMF activity is being performed?
Show answer & explanation
Correct answer: B - Assess
10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
These 10 free CFCP questions are organized by exam domain, so you can see how each part of the Certified FISMA Compliance Practitioner blueprint is tested. Reveal the answer and explanation under each question.
A system owner has implemented required controls. An assessor now examines evidence to determine whether those controls operate effectively. Which RMF activity is being performed?
Correct answer: B - Assess
An assessor finds installed software that is not recorded. What is the primary concern?
Correct answer: A - Asset accountability is incomplete
A records system is altered without authorization, creating a risk of incorrect agency decisions. Which FIPS 199 security objective is primarily affected?
Correct answer: C - Integrity
An incident responder has confirmed an event and is determining scope and affected assets. Which phase is occurring?
Correct answer: B - Detection and analysis
A control exists in policy but evidence shows inconsistent operation. What is the best assessment conclusion?
Correct answer: B - The control implementation should be evaluated using operating evidence
An agency evaluates how threats could affect mission objectives and organizational operations. Which assessment applies?
Correct answer: A - Business risk assessment
A manager identifies critical processes and ranks restoration priorities after disruption. Which activity is being performed?
Correct answer: A - Business impact assessment
A team evaluates the likelihood and impact of exploiting a vulnerability on one application server. Which assessment is this?
Correct answer: B - System risk assessment
An administrator makes an undocumented production change. Which principle was violated?
Correct answer: A - Approved baselines and change control
Which document describes a system, security requirements, implemented controls, and control implementation details?
Correct answer: A - System Security Plan
The CFCP exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,020 more CFCP questions with explanations.
Continue in the free practice test →
View plans