Question 1

What is the purpose of the Technical Implementation of A&A in the NISP course?

Accepted Answer

The purpose of this course is to provide you with the knowledge needed to assess information systems for authorization under the National Industrial Security Program, or NISP. [Source: CDSE — Technical Implementation of A&A in the NISP (CS300.16) Student Guide — "The purpose of this course is to provide you with the knowledge needed to assess information systems for authorization under the National Industrial Security Program, or NISP." https://www.cdse.edu/Portals/124/Documents/student-guides/CS300-guide.pdf]

Question 2

What tools does Monique need to obtain for the self-assessment process?

Accepted Answer

Monique must obtain a SCAP Compliance Checker and a STIG Viewer. [Source: CDSE — Technical Implementation of A&A in the NISP (CS300.16) Student Guide — "Monique must obtain two tools: a SCAP Compliance Checker and a STIG viewer." https://www.cdse.edu/Portals/124/Documents/student-guides/CS300-guide.pdf]

Question 3

What is the SCAP Compliance Checker used for?

Accepted Answer

The SCAP Compliance Checker is an automated vulnerability scanning tool that analyzes and reports on the security configuration of an information system. [Source: CDSE — Technical Implementation of A&A in the NISP (CS300.16) Student Guide — "The SCAP Compliance Checker is an automated vulnerability scanning tool. It leverages the Defense Information Systems Agency, or DISA, Security Technical Implementation Guides, or STIGs, and Operating System-specific baselines to analyze an" https://www.cdse.edu/Portals/124/Documents/student-guides/CS300-guide.pdf]

Question 4

What administrative requirement is necessary for installing the SCAP Compliance Checker?

Accepted Answer

Administrative privileges on the machine to be scanned are required to install the SCAP Compliance Checker application and to run scans. [Source: CDSE — Technical Implementation of A&A in the NISP (CS300.16) Student Guide — "It is important to note that administrative privileges on the machine to be scanned are required to install the SCAP Compliance Checker application and to run scans." https://www.cdse.edu/Portals/124/Documents/student-guides/CS300-guide.pdf]

Question 5

What is the purpose of the STIG Viewer?

Accepted Answer

The STIG Viewer is used in conjunction with the SCAP Compliance Checker scan results in order to view the compliance status of the system's security settings. [Source: CDSE — Technical Implementation of A&A in the NISP (CS300.16) Student Guide — "The STIG Viewer is used in conjunction with the SCAP Compliance Checker scan results in order to view the compliance status of the system's security settings." https://www.cdse.edu/Portals/124/Documents/student-guides/CS300-guide.pdf]

Question 6

What type of report does the SCAP scan generate?

Accepted Answer

The SCAP scan generates two types of reports: the All Settings Report and the Non-Compliance Report. [Source: CDSE — Technical Implementation of A&A in the NISP (CS300.16) Student Guide — "One report is the largest html file, the All Settings Report. The other is the smaller html file, which is the Non-Compliance Report." https://www.cdse.edu/Portals/124/Documents/student-guides/CS300-guide.pdf]

Question 7

What does the Non-Compliance Report list?

Accepted Answer

The Non-Compliance Report lists open vulnerabilities. [Source: CDSE — Technical Implementation of A&A in the NISP (CS300.16) Student Guide — "This is a report that shows only open vulnerabilities." https://www.cdse.edu/Portals/124/Documents/student-guides/CS300-guide.pdf]

Question 8

What is the role of the ISSM in relation to the POA&M?

Accepted Answer

The ISSM is responsible for creating the POA&M as part of the Security Authorization Package. [Source: CDSE — Technical Implementation of A&A in the NISP (CS300.16) Student Guide — "As an ISSM, my role is to create the POA&M as part of the SSP." https://www.cdse.edu/Portals/124/Documents/student-guides/CS300-guide.pdf]

Question 9

What does the POA&M document?

Accepted Answer

The POA&M documents unmitigated vulnerabilities and monitors progress in correcting security vulnerabilities. [Source: CDSE — Technical Implementation of A&A in the NISP (CS300.16) Student Guide — "One of the most important purposes of a POA&M is to monitor the progress of correcting security vulnerabilities." https://www.cdse.edu/Portals/124/Documents/student-guides/CS300-guide.pdf]

Question 10

What is the significance of the CAT tabs in the STIG Viewer?

Accepted Answer

The CAT tabs indicate different levels of severity for vulnerabilities, with Level 1 being the most severe. [Source: CDSE — Technical Implementation of A&A in the NISP (CS300.16) Student Guide — "These are different levels of severity. Level 1 is the most severe and Level 3 is the least severe." https://www.cdse.edu/Portals/124/Documents/student-guides/CS300-guide.pdf]

Question 11

What is the expected outcome of using the SCAP Compliance Checker and STIG Viewer?

Accepted Answer

The expected outcome is to identify vulnerabilities and document unmitigated vulnerabilities on a POA&M. [Source: CDSE — Technical Implementation of A&A in the NISP (CS300.16) Student Guide — "This course provided you with instruction needed to use the SCAP Compliance Checker and STIG Viewer to identify vulnerabilities and document unmitigated vulnerabilities on a POA&M." https://www.cdse.edu/Portals/124/Documents/student-guides/CS300-guide.pdf]

technical implementation of a a in the nisp

Know questions we're missing?

Want to study these as flashcards?