Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

FITSP- > FITSP-M > Flashcards

FITSP-M Flashcards

1
Q

SP 800-30, rev 1

A

Conducting Risk Assessments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

SP 800-34

A

Contingency Planning Guide for Federal IT Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

SP 800-37, rev 2

A

Applying RMF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

SP 800-39

A

Managing Information Security Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

SP 800-40 rev 3

A

Patch and Vulnerability Management Program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

SP 800-41 rev 1

A

Firewalls and Firewall Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

SP 800-45 rev 2

A

Guidelines on e-mail security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

SP 800-47

A

Interconnecting IT systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

SP 800-50

A

IT Security Awareness and Training Program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

SP 800-53, rev 4

A

Security Controls for Federal IT Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

SP 800-53A, rev 4

A

Assessing Security Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

SP 800-55, rev 1

A

Performance Measurement Guide for Information Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

SP 800-60

A

Mapping Information types to Security Categories

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SP 800-61, rev 2

A

Computer Security Incident Handling Guide

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

SP 800-66, rev 1

A

HIPAA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

SP 800-70, rev 2

A

National Checklist Program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

SP 800-83

A

Malware Incident Prevention and Handling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

SP 800-92

A

Computer Security Log Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

SP 800-94

A

IDS/IPS (IDPS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

SP 800-100

A

Information Security Handbook: Managers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

SP 800-115

A

Technical Guide Information Security Testing and Assessments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

SP 800-122

A

Guide to Protecting Confidentiality of PII

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

SP 800-128

A

Configuration Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

SP 800-137

A

Continuous Monitoring (ISCM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

SP 800-144

A

Security and Privacy in Public Cloud Computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

FIPS 140-2

A

Cryptography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

FIPS 180-4

A

Secure Hash Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

FIPS 181

A

Automated Password Generator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

FIPS 186-4

A

Digital Signature Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

FIPS 190

A

Advanced Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

FIPS 191

A

LAN Security (Confidentiality, Integrity and Availability of the data)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

FIPS 197

A

AES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

FIPS 198-1

A

HMAC (Keyed-Hash Message Authentication Code)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

FIPS 199

A

Security Categorization based on impact levels (low, moderate, or high)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

FIPS 200

A

Minimum Security Requirements (Baselines)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

FIPS 201-2

A

Personal Identity Verification PIV (smart cards)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

HSPD-1

A

Creates Homeland Security Council and functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

HSPD-3

A

Homeland Security Advisory Team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

HSPD-5

A

Management of Domestic Incidents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

HSPD-7

A

(Replaced with PDD-21) Critical Infrastructure Identification/Priority/Protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

HSPD-8

A

National Preparedness

42
Q

HSPD-12

A

Common Identification Standard for Federal Employees

43
Q

HSPD-20

A

NSPD-51 National Continuity Policy / Continuity of government/operation.

44
Q

HSPD 24

A

Biometrics for Identification for National Security

45
Q

BOD 20-01

A

Develop and Publish a Vulnerability Disclosure Policy

46
Q

BOD 19-02

A

Vulnerability Remediation Requirements for Internet-Accessible Systems

47
Q

BOD 18-02

A

Securing High Value Assets

48
Q

BOD 18-01

A

Enhance Email and Web Security

49
Q

BOD 17-01

A

Removal of Kaspersky-branded Products

50
Q

BOD 16-03

A

2016 Agency Cybersecurity Reporting Requirements

51
Q

BOD 16-02

A

Threat to Network Infrastructure Devices

52
Q

When a message is input to a hash algorithm, the output result is called a ____

A

Massage digest

53
Q

FIPS 199 = Standards for security categorization of federal systems puts systems into what 3 categories?

A

Low- Limited damage
Moderate- Serious damage
High- Severe / Catastrophic damage

54
Q

SP800-60 established security impact levels for loss of what 3 information types?

A

Confidentiality (encryption, Access control)
Integrity (unauthorized modification = Hashing)
Availability (add redundancy, power, weather)

55
Q

SP800-____ is a dictionary of all controls to choose from for your system.

A

SP800-60 Mapping information types to security categories.

56
Q

___ and ____ provide a disciplined and standard process that integrates information security and risk management activities into the system development life cycle.

A

Risk Management Framework (RMF)

NIST SP800-37

57
Q

Who is responsible for the information system?

A

Information System Owner

58
Q

Who is responsible for the data on the system?

A

Information Owner

59
Q

Who is responsible for the overall procurement of the system?

A

Program Manager

60
Q

What does FedRAMP stand for?

A

Federal Risk Authorization Management Program

61
Q

What are the 2 control documents?

A

SP800-53, SP800-53A

62
Q

PII - the confidentiality impact level generally falls into the _____ range.

A

Moderate

63
Q

What does SDLC stand for?

A

System Development Life Cycle

64
Q

Risk Management is a process that requires organizations to do what 4 things?

A

FARM

Frame Risk, Assess Risk, Respond to Risk, Monitor Risk

65
Q

NIST Control Families
There are how many control families?
What are the 3 categories the control families are put in?

A

18

4 Technical, 9 Operational, 5 Managerial

66
Q

NIST SP

FIPS 200 mandates the use of SP800-_____

A

SP800-53
Organizations must employ all security controls in the respective security control baselines unless specific exceptions are allowed based on the tailoring guidance provided in NIST Special Publication
800-53.

67
Q

A Security Control Assessment can only be _____ or ______.

A

satisfactory or other

68
Q

_______ is a suite of specifications for organizing and expressing security-related in standard ways as well as related reference data, such as identifiers for software laws and security configuration issues.

A

SCAP Security Control Automation Protocol

69
Q

FedRAMP is the automation tool for bringing ______ and ____ into the accreditation process.

A

Cloud and Virtualization

70
Q

RMF Step 1 Categorize Information System

The security categorization process is carried out by the _____ and ____.

A

Information System Owner and Information Owner/steward

71
Q

What are the 3 levels of impact on organizations, operations, assets, or individuals?

A

Low- Limited
Moderate- Serious
High- Severe/Catastrophic

72
Q

Continuous Monitoring Vocabulary

What does CAESARS stand for?

A

Continous asset Evaluation, Situational awareness, and Risk Scoring = CAESARS

73
Q

What is a dictionary of weaknesses that can lead to exploitable vulnerabilities?

A

Common Weakness Enumeration (CWE)

74
Q

What complies with the National Vulnerability Database (NVD) and is the basis for automating all FISMA reporting?

A

SCAP - Security Control Automation Protocol

75
Q

What are the 3 ways monitoring activities are recorded and reported?

A

Event driven
Time driven
Both

76
Q

What are the five basic areas of the NIST Cybersecurity Framework?

A 
Identify
Protect
Detect
Respond
Recover
77
Q

The Security Assessment Report (SAR) contains a list of _____.

A

Vulnerability findings

78
Q

Name the 3 types of authorizations.

A

Authority to Operate (ATO)
Denial of Authority of Operate (DATO)
Interim Authorization to Test (IATT)

79
Q

RMF Assess Security Controls

What are the 3 methods of assessment?

A

Testing
Interviewing
Examination

80
Q

Name 3 roles that are assigned to government personal only.

A

CIO
Risk Executive
Senior Informational Security Officer

81
Q

What are the 3 risk documents?

A

SP800-30
SP800-37
SP800-39

82
Q

What are the 3 documents in a Security Authorization Package?

A

System Security Plan (SSP)
Security Assessment Report (SAR)
Plan of Action Milestones (POAM)

83
Q

Security Categorization

{(Confidentiality), (Integrity), (Availability)}

A

Security Categorization

{(Confidentiality), (Integrity), (Availability)}

84
Q

What are the 7 RMF steps?

A 
1 Prepare
2 Categorize
3 Select
4 Implement
5 Assess
6 Authorize
7 Monitor
85
Q

Cyberscope = FISMA Compliance reporting

Agencies must send security data about their system how often?

A

Monthy

86
Q

DHS operates ____ for computer-related incidents.

DHS oversees the implementation of the ____ initiative.

A

US-CERT - US Computer Emergency Readiness Team

Trusted Internet Connection (TIC)

87
Q

OMB is the ____ agency and

DHS is the ____ agency for Cybersecurity Data and events.

A 
OMB= reporting agency
DHS= Gathering agency
88
Q

3 steps to address security at a higher level.

A

Prevention
Reaction
Correction

89
Q

The Information Technology Management Reform Act of ____ is also called __________.

What are the 4 requirements?

A

1996, Clinger-Cohen Act

CIO
OMB oversite
Enterprise Archetecture
CPIC (Capital Planning and Investment Control)

90
Q

What is FEA

A

Federal Enterprise Architecture

91
Q

What is FISMA? When/how enacted?

A

Federal Information Security Management Act

enacted 2002 as Title 3 of E-Government Act of 2002

92
Q

What are FIPS?

A

Federal Information Processing Standard

FISMA requires federal agencies to comply with the standards

93
Q

What are SPs?

A

Special Publications

recommendations and guidance documents

94
Q

What is NIST? and what does NIST issue?

A

National Institute of Standards and Technology

FIPS and SPs

95
Q

OMB issues what 2 types of documents?

A

Circulars - good for 2 years

Memorandums - provide further explanations and guidance.

96
Q

How long does OMB give you to report a PII breach? and who do you report it to?

A

1 hour

CERT (Computer Emergency Readiness Team)

97
Q

What type of encryption is EAS?

A

Symetric

98
Q

SP800-64

A

Security in SDLC

99
Q

SP800-18

A

Developing System Security Plan

100
Q

SP800-65

A

Integration of IT Security into the Capital Planning and Investment Control Process / Asset Management

FITSP- (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions