Practice Information

Question 1

SI.14.2 - Malicious Code Protection

Answer 1

5 Points

800-83 for Malware Incident guidance

Question 2

SI.14.3 - Security Alerts & Advisories

Answer 2

5 Points

NIST SP 800-161 SCRM

Question 3

SI.14.6 - Monitor Communications for Attack

Answer 3

5 Points

NIST SP 800-94 for IDS/IPS

Supports AU.L2-3.1.1 - System Auditing

Question 4

SI 14.7 - Identify Unauthorized Use

Answer 4

5 Points

Related to: 3.1.1, 3.3.1, 3.5.1, 3.5.2

Question 5

AC. 1.1 - Authorized Access Control

Answer 5

5 Points

Leverages 3.5.1 (identification)

Question 6

AC. 1.3 - Control CUI Flow

Answer 6

1 Point

NIST SP 800-41 Guidance on firewalls and firewall policy
NIS SP 800-125B Guidance on security for virtualization technologis

Question 7

AC. 1.7 - Privileged Functions

Answer 7

1 Point

Leverages AU-3.3.2, which ensures logging and traceability of user actions
Extends AC-3.1.2 which defined requirements to limit types of transactions

Question 8

AC. 1.12 - Control Remote Access

Answer 8

5 points
*Do not subtract points if remote access is not permitted.

NIST SP 800-46, 77, 113 Guidance on secure remote access and VPNs

Compliments 5 other Remote Access practices: AC.3.1.14 (remote access routing), 3.1.13 (crypto for remote), 3.1.15 (auth’d priv cmds for remote), IA.3.5.3 (MFA), MA.3.7.5 (MFA remote maintenance)

Question 9

AC 1.13 - Remote Access Confidentiality

Answer 9

5 points

Compliments 5 other practices: AC.3.1.14 (remote access routing), 3.1.12 (Control Remote Access) , 3.1.15 (auth’d priv cmds for remote), IA.3.5.3 (MFA), MA.3.7.5 (MFA remote maintenance)

Question 10

AC 1.14 - Remote Access Routing

Answer 10

1 Point

Compliments 5 other practices:
3.1.12 (Control Remote Access), 3.1.13 (crypto for remote), 3.1.15 (auth’d priv cmds for remote), IA.3.5.3 (MFA), MA.3.7.5 (MFA remote maintenance)

Question 11

AC 1.15 - Privileged Remote Access

Answer 11

1 point

Compliments 5 other Remote Access practices: AC.3.1.14 (remote access routing), 3.1.13 (crypto for remote), 3.1.12 (Control Remote Access), IA.3.5.3 (MFA), MA.3.7.5 (MFA remote maintenance)

Question 12

AC. 1.16 - Wireless Access Authorization
AC 1.17 - Wireless Access Protection
AC 1.18 - Mobile Device Connection

Answer 12

5 points

Complimentary Practices: AC.3.1.16 (Wx Access Auth), AC.3.1.17 (Wx Access Protection), and AC.3.1.18 (Mobile Device Connection)

Question 13

AC 1.19 - Encrypt CUI on Mobile

Answer 13

3 points

Extends three other CUI protection practices: MP.3.8.1 (CUI media protection), MP.3.8.2 (limit access to CUI), SC.3.13.16 (CUI data at rest)

Leverages SC.3.13.11 (FIPS), and SC.3.13.10 (crypto key management)

Question 14

AU.3.2 - User Accountability

Answer 14

3 points

Supports AC.3.1.7 (control non-priv users) and other on auditing, CM, IR, and situation awareness

Question 15

AU.3.3 - Event Review

Answer 15

1 point

Focused on configuration of auditing system, NOT the review of audit records.

Question 16

CM 4.7 - Nonessential Functionality

Answer 16

5 points

Extends CM.3.4.6 - Least Functionality

Question 17

CM.4.8 - Application Execution Policy

Answer 17

5 Points

Leverages CM 3.4.1 (software inventories) and extends CM.3.4.9 (requires control/monitoring of user installed software)

Question 18

IA.5.1 - Identification

Answer 18

5 points

Creates a vetted ad trusted ID supporting 3.1.1 (Auth Access)

Question 19

MA.7.4 - Media Inspection

Answer 19

3 points

Extends both SI 3.14.2 and 3.14.4 (require implementation/updating of mechanisms to protect systems from mal code).

MA.3.7.4 extends this requirement to diagnostic and testing tools.

Question 20

MP.8.4 - Media Marking

Answer 20

1 point

MP.3.8.8 requires media have an identifiable owner – could be desirable to include owner in the marking.

Question 21

RA.11.1 - Risk Assessment

Answer 21

3 points

Enables other RA practices such as 11.3 (Vuln Remediation) and CA.3.12.2 (Plan of Action)

Question 22

CA.12.2 - Pan of Action

Answer 22

3 points

Driven by RA.3.11.1 (risk assessments)
Promotes CA.12.3 (security control monitoring)

Question 23

CA.12.3 - Security Control Monitoring

Answer 23

5 points