nerdexam
CompTIA

CAS-002 · Question #342

An administrator is trying to categorize the security impact of a database server in the case of a security event. There are three databases on the server. Current Financial Data = High level of…

The correct answer is B. Database server = {(Confidentiality HIGH),(Integrity Moderate),(Availability Moderate)}. FIPS 199 requires using the high-water mark across all information types for each security objective independently to derive the aggregate system categorization.

Research and Analysis

Question

An administrator is trying to categorize the security impact of a database server in the case of a security event. There are three databases on the server. Current Financial Data = High level of damage if data is disclosed. Moderate damage if the system goes offline Archived Financial Data = No need for the database to be online. Low damage for integrity loss Public Website Data = Low damage if the site goes down. Moderate damage if the data is corrupted Given these security categorizations of each database, which of the following is the aggregate security categorization of the database server?

Options

  • ADatabase server = {(Confidentiality HIGH),(Integrity High),(Availability High)}
  • BDatabase server = {(Confidentiality HIGH),(Integrity Moderate),(Availability Moderate)}
  • CDatabase server = {(Confidentiality HIGH),(Integrity Moderate),(Availability Low)}
  • DDatabase server = {(Confidentiality Moderate),(Integrity Moderate),(Availability Moderate)}

How the community answered

(28 responses)
  • A
    14% (4)
  • B
    75% (21)
  • C
    7% (2)
  • D
    4% (1)

Why each option

FIPS 199 requires using the high-water mark across all information types for each security objective independently to derive the aggregate system categorization.

ADatabase server = {(Confidentiality HIGH),(Integrity High),(Availability High)}

No individual database has a High availability impact - the highest availability rating is Moderate for Current Financial Data, so the aggregate cannot reach High.

BDatabase server = {(Confidentiality HIGH),(Integrity Moderate),(Availability Moderate)}Correct

Per FIPS 199, each security objective is categorized separately by taking the highest impact level across all data types hosted on the system. Confidentiality peaks at HIGH from Current Financial Data, Integrity peaks at Moderate from Public Website Data, and Availability peaks at Moderate from Current Financial Data, producing the aggregate (HIGH, Moderate, Moderate).

CDatabase server = {(Confidentiality HIGH),(Integrity Moderate),(Availability Low)}

Availability cannot be Low because Current Financial Data carries a Moderate availability impact, which sets the high-water mark above Low.

DDatabase server = {(Confidentiality Moderate),(Integrity Moderate),(Availability Moderate)}

Confidentiality must be HIGH, not Moderate, because Current Financial Data is explicitly assigned a High confidentiality impact that propagates to the aggregate.

Concept tested: FIPS 199 aggregate security categorization high-water mark

Source: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf

Topics

#FIPS 199#security categorization#aggregate impact#data classification

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice