FIPS 199 defines the three levels of potential impact on organizations. Which of the following potential impact levels shows limited adverse effects on organizational operations, organizational…

Question

Options

• AModerate
• BMedium
• CHigh
• DLow

• B
  5% (1)
• C
  5% (1)
• D
  91% (20)

Explanation

Low (D) is correct because FIPS 199 explicitly defines the "low" impact level as one where a security breach would cause limited adverse effects - meaning degraded operations, minor asset damage, or minor harm to individuals, but the organization can still function.

Why the distractors are wrong:

• A (Moderate): Moderate impact means serious adverse effects - significant operational degradation, significant asset damage, or significant individual harm. That's a step above "limited."
• B (Medium): "Medium" is not a defined impact level in FIPS 199 at all - the three official levels are Low, Moderate, and High. This is a trap for test-takers guessing from everyday language.
• C (High): High impact means severe or catastrophic adverse effects - potentially including loss of life, major financial damage, or inability to perform critical missions.

Memory tip: Think of it as a traffic light - Low = Green (limited impact, keep going), Moderate = Yellow (serious, slow down), High = Red (catastrophic, stop everything). The word "limited" in the question is the direct keyword from FIPS 199's Low definition, so whenever you see "limited adverse effects," that maps to Low.

No community discussion yet for this question.