FITSI Manager Practice Exam

These questions are part of the practice quiz. Start practicing

• In the risk management model, what does 'FARM' stand for?
• What does SLA stand for in the context of IT service management?
• What likelihood category indicates that an adversary is almost certain to initiate a threat event?
• Which of the following is a key component of data governance?
• What does stakeholder analysis involve?
• What kind of control does “Media Protection” fall under in the families of security and privacy controls?
• What is one of the main functions of IT governance?
• Which of the following is part of the assessment scale for risk determination?
• How is "malware" defined in the context of information security?
• Which term refers to a standardized description of vulnerabilities?
• What occurs during the 'Authorize' step in the risk management process?
• Which step of the risk assessment involves communicating the results?
• What could be a negative outcome of scope creep?
• How is the term “Risk Assessment Reports” categorized in SP 800-30?
• What does a value proposition state in a business context?
• How does Problem Management differ from Incident Management?
• What does SP 800-30 provide guidance on?
• What role does benchmarking play in management?
• What is one of the main benefits of using a combination of technology, processes, and people in security?
• What does the principle of non-repudiation ensure?
• What does risk appetite define?
• What does CNSS stand for in the context of national security?
• What are national security systems primarily concerned with?
• What is involved in the process of developing the project team?
• What does FIPS 200 set standards for?
• What is a key characteristic of encryption keys?
• Which of the following best describes project performance assessment?
• What is a primary component of HSPD-12?
• What is meant by resource allocation in project management?
• Which of the following is NOT considered an RMF Tier 1 risk?
• What are lessons learned in project management?
• During which phase of the Risk Management Framework are security controls implemented?
• Why is user account management important in FITSI?
• Which of the following is NOT a family of security and privacy controls under RMF?
• What is assessed in the 'Assess' step of the Risk Management Framework?
• What does a Feasibility Study assess?
• What does the term "security posture" refer to?
• Which term describes the likelihood of an environmental threat such as a hurricane occurring?
• What is a business case used for in project planning?
• How does FITSI mandate data encryption?
• Which of the following is an outcome of the CNSS's work?
• Which organization collaborates closely with the CNSS for national security purposes?
• What does the acronym CPIC stand for?
• What is a benefit of conducting regular penetration tests?
• What does the process of requirements gathering primarily involve?
• What is the main purpose of NIST SP 800-37 Rev 2?
• In a comprehensive security strategy, which of the following is not typically included?
• What is the purpose of the Clinger Cohen Act?
• What is a common goal for implementing security policies in organizations?
• What does a SWOT analysis primarily evaluate?
• In a security context, what is meant by "compliance"?
• What does Configuration Management aim to maintain?
• What role does encryption play in data protection?
• What does NVD stand for in security terms?
• Which benefit does a well-rounded security strategy provide besides asset protection?
• Which of the following are considered the three pillars of a FITSI security program?
• What area does a Business Impact Analysis primarily focus on?
• Which is a primary purpose of security controls?
• Which term describes measurable values demonstrating organizational effectiveness?
• In the context of IT services, what does effective governance help to manage?
• Which statement reflects the CNSS's approach to national security systems?
• What is a vulnerability assessment?
• What is an expected benefit of conducting a change readiness assessment?
• Which is NOT part of the Risk Management Framework process?
• What is the goal of the 'Monitor' phase of the Risk Management Framework?
• What are the phases included in the IT project lifecycle?
• What constitutes a "critical security function" under FITSI guidelines?
• What role does Change Management play in IT service management?
• What is the primary role of a FITSI Manager?
• What is the main purpose of a security audit?
• Which impact can be caused by noncompliance with laws or regulations?
• What does the acronym CIO stand for in the context of the Clinger Cohen Act?
• In terms of organizational security, what role do people play?
• What is Capital Planning Investment Controls related to in the context of the Clinger Cohen Act?
• The CNSS guides and oversees actions in what area?
• What is scope creep?
• What is the purpose of a project dashboard?
• What is the focus of the Common Vulnerability Scoring System (CVSS)?
• What aspect does SP 800-30 address in its appendices?
• Which type of assessment includes testing, examination, and interview?
• According to the RMF Tier 2 risks, what aspect is emphasized from the mission/business perspective?
• What does data governance refer to in an organization?
• Which adverse impact involves an inability to restore missions in a timely manner?
• Which document includes risk assessment processes as part of the RMF?
• What is the primary function of communications management in a project?
• What is the main goal of effective stakeholder communication?
• How does continuous service improvement benefit organizations?
• What is one of the roles of the Committee on National Security Systems?
• Which of the following describes the three key roles in IT service management?
• What role does continuous monitoring play in FITSI management?
• What is the focus of the Trusted Internet Connection (TIC) initiative?
• Why is stakeholder engagement important in project management?
• Which role in IT service management is primarily responsible for delivering services?
• Which of the following best describes the outcome of a successful quality management process?
• What constitutes a security breach?
• Why is it important to identify risks in IT services?
• What is the purpose of the actions approved by the CNSS?
• What is benchmarking in management?
• What is the primary focus of OCIL?
• What does CCE represent in cybersecurity terminology?
• Which of the following is a common example of malware?
• What does a security framework provide?
• What does a change readiness assessment evaluate?
• What is the purpose of Incident Management?
• What is a significant outcome of effective encryption?
• According to FITSI recommendations, how often should penetration testing be conducted?
• What role does documentation play in FITSI management?
• What is the primary focus of FITSI management training?
• How often should security training be conducted for employees, according to FITSI guidelines?
• What is the primary focus of vendor management?
• In risk determination, what must be identified about the risk assessment?
• What type of report does NISTIR refer to?
• What is the purpose of an IT governance framework?
• What is the primary focus of a comprehensive security strategy?
• What phase of the risk assessment process involves maintaining assessments post-completion?
• How does threat modeling contribute to cybersecurity?
• What characterizes Agile Project Management?
• How do encryption keys function in data security?
• What is the meaning of CVE?
• Which organization is known for assessing, approving, and overseeing mitigating actions of national security systems?
• What is the primary responsibility of a Chief Information Security Officer (CISO)?
• In the context of project management, what does developing the project team primarily aim to improve?
• Why is patch management an essential practice in cybersecurity?
• What does the RACI matrix help clarify in a project?
• What does PPD-21 address?
• What key aspect does resource management aim to achieve?
• What is CVSS used for in the field of cybersecurity?
• Which type of harm includes damage to trust relationships and reputation?
• What is constituted as a phishing attack?
• What is risk management in the context of FITSI?
• Name two key components of incident response planning.
• Which element is crucial for ensuring authorized user access in information security?
• What are security controls aimed at protecting?
• In the context of network security, which of the following best describes a firewall?
• If an error is highly likely to occur multiple times a year, how is this categorized in terms of threat likelihood?
• In which area does the CNSS provide oversight?
• How does an insider threat differ from an outsider threat?
• What is emphasized in the development of security plans for information systems?
• Why is document control significant in project management?
• What does CPE signify in information security frameworks?
• Which type of risk is associated with Strategic, Governance, and Risk Tolerance under RMF Tier 1?
• In the context of IT services, what is risk management?
• What is typically a focus of continuous monitoring in IT security?
• Define the term "compliance" within FITSI management.
• What does "threat intelligence" refer to?
• What is the purpose of a business impact analysis (BIA)?
• What aspect of national security does the CNSS NOT directly oversee?
• What is the importance of access control in FITSI management?
• What is the first step in SP 800-30 risk assessment tasks?
• Which cybersecurity frameworks are commonly integrated within FITSI management processes?
• Which of the following would NOT be included in the concept of least privilege?
• What defines the likelihood of an event categorized as "Very Low" in risk assessment?
• What aspect of a comprehensive security strategy is essential for ongoing risk management?
• What is the focus of Value Management?
• Why is it essential for only authorized users to have access to decrypted data?
• How is customer satisfaction typically measured in IT services?
• What component does encryption help protect in an organization?
• What does resource management involve in IT services?
• What is one goal of continuous service improvement?
• What role does a security operations center (SOC) play in an organization?
• What does the concept of security by design entail?
• Which group is responsible for assessing national security systems?
• What is a primary objective of cost-benefit analysis?
• What is typically included in a successful business continuity plan?
• What does business continuity planning ensure for an organization?
• What is the purpose of change control in project management?
• Which statement is true regarding the CNSS?
• What does POAM stand for in risk management?
• What type of threat does a structural source refer to?
• What is the main function of a firewall in the context of IT security?
• What is the main responsibility of a project manager?
• What is a key responsibility of the CNSS?
• What does the term "data integrity" refer to?
• What do encryption keys allow organizations to protect?
• What does ROI stand for in management terminology?
• The term "Defining Core Missions" applies to which RMF Tier?
• What does CISO stand for in the context of information security?
• How many E-Authentication Levels are there according to the provided classifications?
• Which impact category is associated with a low level of effect in FIPS 199?
• What does OMB Circular A-130 communicate?
• What does effective resource allocation involve in project management?
• What is the primary focus of quality management in IT services?
• What purpose does a security policy serve in an organization?
• What is the purpose of a disaster recovery plan (DRP)?
• What is the purpose of ITIL in IT service management?
• How do security information and event management (SIEM) systems function?
• What is the primary function of a project charter?
• Which of the following best describes the role of technology in a comprehensive security strategy?
• What is a key component of establishing information system boundaries?
• What is a key characteristic of a security breach?
• What is the ultimate goal of implementing a comprehensive security strategy?
• Which of the following represents an adversarial threat source?
• What does the "zero trust" model in IT security reject?
• Common vulnerabilities identified in systems are summarized under which enumeration?
• What framework does XCCDF pertain to in cybersecurity documentation?
• What is the significance of endpoint security?
• What does the assessment of vulnerabilities involve in the risk assessment process?
• Which of the following is NOT part of the incident response process?
• Which aspect of security does the term "integrity" refer to?
• What is the focus of service strategy in IT service management?
• What is the purpose of performance management?
• What does OVAL stand for?
• Which directive sets national continuity policy for the U.S. Government?
• What does Earned Value Management (EVM) integrate in its assessment?
• What aspect of cybersecurity does two-factor authentication primarily enhance?
• What do resource constraints refer to in project management?
• What overarching theme guides the CNSS's guidelines?
• What does the concept of least privilege entail?
• What is one of the primary functions of the CNSS?
• What does FISMA stand for?
• What benefit do organizations gain from having a security awareness program?
• What is the purpose of a Work Breakdown Structure (WBS)?
• What is a critical outcome of a well-structured Work Breakdown Structure?
• What is the role of threat modeling in FITSI management?
• Which of the following are key elements of data loss prevention (DLP)?
• Why is it important to review lessons learned in future projects?
• In the context of the RMF, what do Tier 3 risks primarily address?
• Which of the following is an example of physical security?
• What is the benefit of threat modeling for risk assessment?
• Which tier in the SP 800-37 RMF organization structure focuses on the entire organization?
• What is the purpose of two-factor authentication (2FA)?
• Which of the following documents is part of the primary NIST RMF documentation?
• FIPS 199 is primarily concerned with which of the following?
• What level of likelihood corresponds with an adversary being somewhat likely to initiate a threat event?
• What aspect of a business case is crucial for decision-making?
• Which of the following is a key benefit of having a Service Level Agreement?
• Which document serves as a guide for conducting risk assessments?
• What defines a security incident in the context of information security?
• What is a Gantt chart primarily used for?
• Which of the following is an example of a process in a comprehensive security strategy?
• What is the main function of a security operations center (SOC)?
• What aspect of project management does the RACI matrix specifically address?
• What form of harm includes injury or loss of life?
• Which of the following best describes the CNSS's role?
• What does FITSI stand for?
• Why is social engineering considered a significant threat to organizations?
• Which of the following best describes internal stakeholders?