An administrator is assessing the potential risk impact on an accounting system and categorizes it as follows: Administrative Files = {(Confidentiality, Moderate), (Integrity, Moderate)…

Choice A uses Moderate for Confidentiality, which ignores the High impact rating assigned to Payroll Data and violates the high-water mark rule.

Choice B incorrectly assigns Low to Integrity, when both Administrative Files and Payroll Data independently carry an Integrity rating of Moderate.

NIST FIPS 199 mandates that the overall system security category be set at the highest impact level found among all information types for each objective. Confidentiality takes High from Payroll Data, Integrity takes Moderate (the highest value across Administrative Files and Payroll Data), and Availability remains Low across all three types, yielding the correct aggregate of (High, Moderate, Low).

Choice D also uses Moderate for Confidentiality rather than High, failing to apply the high-water mark to the Payroll Data Confidentiality value.