SAPPC Exam 2022/2023 Questions and Answers

Common Control - ANSWER A security control that is inherited by one or more organizational information systems. See Security Control Inheritance. Common, System-Specific, Hybrid - ANSWER Security controls can be categ ...

Common Control - ANSWER A security control that is inherited by one or more organizational information systems. See Security Control Inheritance. Common, System-Specific, Hybrid - ANSWER Security controls can be categorized as _____________, _____________, _____________. Compensating Security Controls - ANSWER The management, operational, and technical controls (i.e., safeguards or countermeasures) employed by an organization in lieu of the recommended controls in the baselines described in NIST Special Publication 800‐53 and CNSS Instruction 1253, that provide equivalent or comparable protection for an information system. Defense-in-Depth - ANSWER Information security strategy integrating people, technology, and operations capabilities to establish variable barriers across multiple layers and missions of the organization. Hybrid Security Control - ANSWER A security control that is implemented in an information system in part as a common control and in part as a system-specific control. See Common Control and System-Specific Security Control. System-Specific Security Control - ANSWER A security control for an information system that has not been designated as a common security control or the portion of a hybrid control that is to be implemented within an information system. Need-to-Know - ANSWER a determination made by an authorized holder of classified information that a prospective recipient requires access to specific classified information in order to perform or assist in a lawful and authorized governmental function Formula for granting access to classified information - ANSWER Verify clearance eligibility, determine need-to-know, SF-312 has been completed E.O. 13526 - ANSWER The executive order that governs the DoD Information Security Program Information Security Oversight Office (ISOO) - ANSWER Oversee and manage the information security program National Security Council (NSC) - ANSWER An agency in the Executive Office of the President that advises the president on national security and provides the overall policy direction for the Information Security Program DoDM 5200.01 - ANSWER DoD Information Security Program Top Secret - ANSWER Unauthorized disclosure could reasonably be expected to cause exceptionally GRAVE DAMAGE to the national security Secret - ANSWER Unauthorized disclosure could reasonably be expected to cause SERIOUS DAMAGE to national security Confidential - ANSWER Unauthorized disclosure could reasonably be expected to cause DAMAGE to national security Original Classification Authority - ANSWER Position delegated to a position not an individual who is specifically authorized in writing to make initial classification decisions. Original Classification Process - ANSWER The six step process an OCA applies in making classification determinations How does an OCA communicate a classification decision? - ANSWER With the security classification guide and source documents Original Classification Process Steps - ANSWER Step 1: Determine if information is official government information. Step 2: Determine if information is eligible to be classified. Step 3: Determine if there is a potential for damage to national security. Step 4: Assign a level of classification. Step 5: Determine the duration of classification. Step 6: Communicate the decision What do you use the information from an SCG for? - ANSWER To determine if something is classified, its classification level, downgrading instructions, declassification instructions, special control notices, or other information pertinent to the proper classification and dissemination of the items in question and contact information for the OCA Compilation - ANSWER Combining two or more pieces of unclassified information that when combined warrant protection as classified information. Who designates what types of information are classified through compilation? - ANSWER Original Classification Authority (OCA) Derivative Classification - ANSWER Incorporating, paraphrasing, restating, or generating in new form any information that is already classified, and marking the newly developed material consistent with the classification markings that apply to the source information.