Obtain Security Approval to Operate (e.g., Risk Acceptance, Sign-Off at Appropriate Level) CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A large financial institution is deploying a new customer-facing web application. The security assessment identified a moderate residual risk related to session management. The organization's policy requires that any risk rated 'moderate' or higher be accepted by an executive-level official. Who should provide the sign-off for the ATO?

   • AThe Chief Information Security Officer (CISO)
   • BThe quality assurance team lead
   • CThe lead software developer
   • DThe project manager
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   According to typical organizational policy, who is usually the appropriate authority to grant a security approval to operate (ATO) for a system with high-impact residual risks?

   • AThe help desk manager
   • BThe software developer
   • CA senior executive or designated authorizing official
   • DThe system administrator
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security assessor is compiling an ATO package for a new system. Which of the following items is essential to include in the package?

   • AThe list of all software licenses used
   • BThe user training schedule
   • CThe results of the security risk assessment
   • DThe marketing plan for the system
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A healthcare software product has completed its security testing. A few residual risks remain, including a low-severity vulnerability in a third-party library that cannot be patched until the next vendor release. The project manager wants to proceed with deployment. According to the organization's risk acceptance policy, what is the required action before the system can be authorized to operate?

   • AAsk the development team to implement a temporary workaround to eliminate the vulnerability before deployment.
   • BProceed with deployment because the vulnerability is low severity and does not require formal acceptance.
   • CObtain verbal approval from the project sponsor and proceed with deployment.
   • DDocument the residual risks in the ATO package and obtain formal sign-off from the designated authorizing official.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the relationship between an ATO and continuous monitoring?

   • AContinuous monitoring is not required if an ATO is granted
   • BContinuous monitoring replaces the need for periodic re-authorization
   • CContinuous monitoring provides ongoing evidence that the system remains within the conditions of the ATO
   • DContinuous monitoring is performed only after the ATO expires
   Reveal Solution Discussion Select an answer first