Obtain Security Approval to Operate (e.g., Risk Acceptance, Sign-Off at Appropriate Level) CSSLP Practice Questions (Page 4)

Questions 16–18

1. 16foundation · easy

   Which of the following is an example of a condition or limitation that might be included in an ATO?

   • AThe system must be shut down every night
   • BThe system must use the latest version of all software
   • CThe system must be accessible to all users without restriction
   • DThe system must not process credit card data until additional controls are implemented
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An ATO is granted for a system with a condition that the system must be re-assessed if the network architecture changes. Six months later, the network team migrates the system to a different subnet. What should happen?

   • AThe network team can proceed without informing the security team
   • BThe security team should conduct a re-assessment to ensure the system still meets the ATO conditions
   • CThe system continues to operate without any action because the ATO is still valid
   • DThe ATO is automatically revoked because of the change
   Reveal Solution Discussion Select an answer first
3. 18application · medium

   A system has been operating under an ATO for two years. The organization's policy requires re-authorization every three years. During a routine security review, a critical vulnerability is discovered in a core component. What is the most appropriate action?

   • AReport the vulnerability through the continuous monitoring process and initiate remediation
   • BWait until the three-year re-authorization date to address the vulnerability
   • CImmediately revoke the ATO without further analysis
   • DAssume the ATO remains valid and take no action
   Reveal Solution Discussion Select an answer first