nerdexam
(ISC)2

CGRC · Question #444

A security control for an information system that has not been designated as a common control or the portion of a hybrid control that is to be implemented within an informational system is referred to

The correct answer is B. System Specific control. A security control that is not designated as a common control, or the portion of a hybrid control implemented within a specific information system, is known as a system-specific control.

Selection and Approval of Framework, Security, and Privacy Controls

Question

A security control for an information system that has not been designated as a common control or the portion of a hybrid control that is to be implemented within an informational system is referred to as a... Response:

Options

  • ALogical control
  • BSystem Specific control
  • CCommon control
  • DHybrid control

How the community answered

(42 responses)
  • A
    2% (1)
  • B
    95% (40)
  • D
    2% (1)

Why each option

A security control that is not designated as a common control, or the portion of a hybrid control implemented within a specific information system, is known as a system-specific control.

ALogical control

A logical control is a type of security control (e.g., software, policies) but not a classification based on its scope of application (common, system-specific, hybrid).

BSystem Specific controlCorrect

A system-specific control is precisely defined as a security control that is not a common control and is implemented within and inherited by a single information system, or the part of a hybrid control specifically implemented by the information system. These controls address risks unique to that particular system.

CCommon control

A common control is designed to be inherited by multiple information systems, which directly contradicts the question's premise that it 'has not been designated as a common control'.

DHybrid control

A hybrid control is a combination of common and system-specific controls, but the question specifically describes the system-specific portion or a control not common.

Concept tested: NIST control categorization (common, system-specific, hybrid)

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

Topics

#System Specific Control#Control Categorization#NIST RMF#Security Controls

Community Discussion

No community discussion yet for this question.

Full CGRC Practice