Free C)RMFA Practice Questions

Question 1

A claims reviewer signs in with multifactor authentication. The application correctly identifies the reviewer, but permits approval of payments reserved for supervisors. Audit records accurately identify who approved each payment. Which control deficiency best explains this result?

Accepted Answer

AC-3 Access Enforcement: permitted actions do not match the approved role.

Answer

AU-3 Content of Audit Records: the approving employee is not recorded.

Answer

IA-2 Identification and Authentication: the user's identity is unverified.

Answer

AC-2 Account Management: a former employee's account remains enabled for application use.

Question 2

A federal system's complete information inventory gives these potential-impact values in confidentiality/integrity/availability order:
Equipment command data: Low/High/Moderate
Maintenance records: Moderate/Moderate/Low
Routine operating notices: Low/Low/Moderate
No aggregation or system-level factor raises these values. Which system category and initial security baseline follow?

Accepted Answer

Moderate/High/Moderate; High-impact security baseline.

Answer

Low/High/Moderate; High-impact security baseline.

Answer

Moderate/Moderate/Moderate; Moderate-impact security baseline.

Answer

High/High/High; High-impact security baseline.

Question 3

Assessment objective: demonstrate that a financial ledger can be restored with complete, internally consistent transactions. Available evidence: successful backup-job logs and a current recovery runbook, but no restoration results. Which procedure would directly resolve that evidence gap?

Accepted Answer

Restore a backup in an approved isolated environment and reconcile the recovered transactions.

Answer

Interview the administrator about recovery and reconciliation procedures.

Answer

Compare the recovery runbook with the documented restoration requirements.

Answer

Examine job logs for successful completion of all scheduled backups.

Question 4

An assessment identifies two remaining control deficiencies. Verified interim safeguards reduce the exposure, and the plan of action and milestones assigns funded corrective work, owners, and completion dates. After reviewing the evidence, the authorizing official determines that operating risk is acceptable under stated conditions. No applicable requirement prohibits operation with these deficiencies. Which disposition is consistent with that determination?

Accepted Answer

Authorize operation with documented conditions while tracking the remaining corrective work.

Answer

Use the approved POA&M as the operating decision without a separate authorization.

Answer

Defer authorization until all findings have been remediated and independently reassessed.

Answer

Obtain revised 'satisfied' findings from the assessor before authorizing the accepted residual risk.

Question 5

During contract negotiations for a hosted records service, the provider offers a general assurance certificate but will not commit to supplying evidence for the controls the agency expects to inherit. The contract has not been signed. Where should this gap be resolved?

Accepted Answer

In acquisition requirements specifying control responsibilities and access to relevant assessment evidence.

Answer

In the system plan, assigning provider-operated controls to the agency without changing the service agreement.

Answer

In post-deployment monitoring, requesting control evidence after the hosted service becomes operational.

Answer

In the authorization package, accepting the provider's certificate as sufficient inherited-control evidence.

Question 6

At month-end, 50 controls were due for assessment. Assessors completed 46 of those assessments plus four due next month. Five of the 46 completed assessments produced 'other than satisfied' findings. Agency policy requires at least 95% completion of the month's due assessments; a shortfall requires a plan to complete the unfinished work. Which month-end report correctly applies the policy?

Accepted Answer

92% complete; record the shortfall and a completion plan for the four outstanding assessments.

Answer

100% complete; count the four early assessments toward this month's target.

Answer

82% complete; exclude assessments with adverse findings from the completed count.

Answer

92% complete; suspend operation pending completion of all overdue assessments.

Question 7

A risk memorandum states: 'The external eligibility service has its own authorization and lies outside our approved boundary, so this dependency does not need to be assessed.' The benefits application cannot approve claims without that service. Which revision corrects the memorandum?

Accepted Answer

Document the dependency and assess its risks within the application's operating context.

Answer

Include the provider's entire environment in the application's authorization boundary before assessing the dependency.

Answer

List the service in the inventory as evidence of protection.

Answer

Exclude the dependency because the provider's authorization covers the risks of operating its service.

Question 8

The approved FIPS 199 category for a federal visitor-registration system is Low for confidentiality, integrity, and availability. The system processes visitors' names and contact details. Using the baseline-based approach in NIST SP 800-53B, the appropriate starting point is:

Accepted Answer

The Low-impact security baseline and the privacy baseline, followed by applicable tailoring.

Answer

The privacy baseline alone, replacing the Low-impact security baseline.

Answer

The Low-impact security baseline alone, since no significant privacy risk can exist in a Low-impact system.

Answer

The Moderate-impact security baseline and the privacy baseline, because the system processes identifiable visitor data.

Question 9

Control allocation assigns event receipt and review to a common provider, and event generation and forwarding to the application team. Deployment evidence shows that sign-ins arrive, required record-export events do not, and the provider processes everything received correctly. To complete this hybrid control, the application team should:

Accepted Answer

Configure the records application to generate and forward its required export events.

Answer

Retain sign-in events longer as substitute evidence of record exports.

Answer

Increase central review frequency to compensate for incomplete export-event coverage.

Answer

Declare collection fully inherited and rely on the common provider's assessment for the missing events.

Question 10

Quarterly access reviews: the manager says they occurred, but no records or other sufficient evidence establish that the required reviews were performed. No unauthorized access has been detected. Under NIST SP 800-53A, the defensible assessment determination is:

Accepted Answer

Other than satisfied: performance of the required reviews cannot be established.

Answer

Other than satisfied: missing records confirm that reviews were omitted and access enforcement failed.

Answer

Satisfied: no unauthorized access was detected during the review period.

Answer

Satisfied: the manager confirmed adherence to the approved review schedule.

Free C)RMFA Practice Questions

Domain 2: The RMF Integration into the SDLC

Question 1

Domain 3: The Prepare Phase of the RMF Model

Question 2

Domain 4: Categorize the System

Question 3

Domain 5: Select Security Controls

Question 4

Question 5

Domain 6: Implement Security Controls

Question 6

Domain 7: Assess Security Controls

Question 7

Question 8

Domain 8: Authorize Information System

Question 9

Domain 9: Monitor Security Controls

Question 10

The rest of the C)RMFA blueprint

That's 10 of 1,030