Free FITSP-Designer Practice Questions

Question 1

A federal non-national-security system publishes public evacuation instructions and stores an internal contact roster. The impact analysis finds that altered instructions could cause deaths; loss of the instruction service would have a serious but non-life-threatening effect. The roster has Moderate confidentiality impact and Low integrity and availability impacts. The public instructions need no confidentiality protection, and no further aggregation adjustment is warranted. What system category and security-baseline starting point follow?

Accepted Answer

Confidentiality Moderate, Integrity High, Availability Moderate; use the High security baseline as the starting point.

Answer

Confidentiality Low, Integrity High, Availability Moderate; use the High security baseline as the starting point.

Answer

Confidentiality Moderate, Integrity Moderate, Availability Moderate; use the Moderate security baseline as the starting point.

Answer

Confidentiality High, Integrity High, Availability High; use the High security baseline as the starting point.

Question 2

Reading individual benefits cases is authorized; releasing those records externally is not. Analysts may export only approved summary statistics. A new reporting service authenticates analysts, checks their case-reading permissions, and encrypts the connection, but it transmits complete case records. What change preserves authorized reporting while enforcing the release restriction?

Accepted Answer

Enforce a release policy that allows approved summaries and blocks prohibited case-record transfers.

Answer

Require multifactor authentication for exports while retaining existing case-reading permissions.

Answer

Disable every external reporting path, including releases that contain only approved summary data.

Answer

Give the reporting service read-only access and encrypt exported records using the authorized recipient's key.

Question 3

An IAL2 enrollment review finds that a remote, unattended service validates one STRONG identity document showing the applicant's current postal address, one FAIR telephone-account record, and all required core attributes. Returning a code sent to the validated telephone number establishes ownership of the FAIR evidence. No other ownership check occurs before an AAL2 authenticator is bound. Under NIST SP 800-63A-4, which addition addresses the remaining gap without requiring an on-site visit?

Accepted Answer

Require return of a code mailed to that postal address after validating it with an authoritative source.

Answer

Send another telephone code after the applicant authenticates with the newly bound AAL2 authenticator.

Answer

Replace the AAL2 authenticator with a phishing-resistant AAL3 authenticator before allowing the applicant to use the new account.

Answer

Accept the document's validated attributes and successful authenticity checks as sufficient evidence of the applicant's ownership.

Question 4

Eight U.S. citizens volunteer for an agency pilot. The agency will procure a new portal that maintains their income and contact information, with staff retrieving records by an assigned personal identifier. No existing system of records notice covers the portal, and no applicable exception removes the privacy requirements. Which privacy obligations does this design trigger?

Accepted Answer

Complete a PIA and establish SORN coverage; the two requirements have independent triggers.

Answer

Complete a PIA; a SORN is needed only for records disclosed outside the agency.

Answer

Establish SORN coverage; defer the PIA until identical information is collected from at least ten people.

Answer

Document safeguards and retention; the small, voluntary pilot requires neither a PIA nor a SORN.

Question 5

The system plan states, "Vulnerability monitoring: fully inherited." The hosting provider's current assessment covers physical hosts and managed operating systems, but its agreement excludes agency-developed applications. The agency maintains the application code and dependencies; the provider's assessed protections remain applicable. Which allocation should replace the plan's entry?

Accepted Answer

Hybrid, with inherited host protections and an agency-owned application-monitoring portion that is implemented and assessed.

Answer

Fully inherited, with a local software inventory documenting the agency-developed application and its dependencies.

Answer

Entirely system-specific, with the agency repeating the provider's host assessments and assessing its application controls separately.

Answer

Fully inherited, with a tenant penetration test used as assurance for applications outside the provider's assessment scope.

Question 6

A disputed change-authorization record exposes a limitation in an agency-contractor exchange: both organizations possess the HMAC key used to authenticate records. The channel already protects confidentiality. An independent reviewer must be able to verify the originating organization without receiving a secret that would allow the reviewer to generate equivalent evidence. What cryptographic redesign meets that requirement?

Accepted Answer

Sign records with each originator's protected private key and verify them against reliably bound public keys.

Answer

Use a different shared HMAC key for each transmission direction and disclose those keys to the reviewer.

Answer

Encrypt records with the recipient's public key and have the reviewer confirm that decryption succeeds.

Answer

Attach a SHA-256 digest before encryption and have the reviewer compare it with a recomputed digest.

Question 7

Two administrators authenticate individually to an automation portal, which logs their job submissions. A worker executes their jobs concurrently through an approved service account. Protected, synchronized target-system logs show the commands and service account; portal logs show jobs and submitters. Investigators cannot associate particular target commands with specific submitted jobs. What additional audit design is needed?

Accepted Answer

Carry a trustworthy correlation ID linking each command to its job and initiating administrator.

Answer

Copy the service account's authentication result into both logs at the same timestamp precision.

Answer

Extend portal-log retention so investigators can compare a longer history of surrounding activity.

Answer

Retain command output separately, with a protected record of every target-side result and its execution time.

Question 8

During acceptance testing, two detection rules process identical traffic containing 40 malicious events. Each rule generates at most one alert per event. The existing rule produces 120 alerts, 36 of them true positives; the replacement produces 40 alerts, 28 of them true positives. Deployment requires detecting at least 85% of malicious events while reducing analyst workload. What belongs in the test report?

Accepted Answer

Alert precision improves, but the replacement fails the required attack-detection rate.

Answer

The replacement improves both detection coverage and the proportion of actionable alerts.

Answer

Both rules meet the detection target; the replacement also generates fewer false alarms.

Answer

Neither rule meets the target because fewer than 85% of its alerts identify malicious events.

Question 9

Contractor-owned servers host a civilian agency's benefits-document intake and case-routing platform. Processing agency records is the contracted service itself, and the platform contains CUI Basic. The proposed security plan applies only the requirements for CUI in nonfederal systems. At the system-scoping review, the team should:

Accepted Answer

Treat the platform as operated on the agency's behalf and apply the applicable federal system requirements.

Answer

Classify the platform as nonfederal because the contractor owns and administers its servers.

Answer

Apply SP 800-171 alone because the platform processes unclassified rather than classified mission information.

Answer

Adopt the contractor's assessment as the agency authorization because the provider operates the platform's controls.

Question 10

An authorizing official accepts a documented residual control weakness in a signed decision, sets monitoring conditions, and plans no remediation. No overriding requirement compels correction or a POA&M entry. Applying NIST SP 800-37 Rev. 2, how should the weakness be treated after acceptance?

Accepted Answer

Retain the finding and acceptance decision, monitor the conditions, and omit a remediation POA&M entry when no corrective action is planned.

Answer

Mark the control fully implemented and remove the finding, retaining the signed acceptance decision as the record of closure.

Answer

Create a corrective-action milestone and completion date because every accepted weakness still requires a planned technical remedy.

Answer

Suspend the service until the weakness is corrected because an authorization cannot remain valid with a known control deficiency.

Free FITSP-Designer Practice Questions

Domain 1: NIST Special Publications (SPs) 20% of exam

Question 1

Question 2

Domain 2: NIST Federal Information Processing Standards (FIPS) 13% of exam

Question 3

Question 4

Domain 3: NIST Control Families (CFs) 22% of exam

Question 5

Question 6

Domain 4: Governmental Laws and Regulations 19% of exam

Question 7

Question 8

Domain 5: NIST Risk Management Framework (RMF) 20% of exam

Question 9

Question 10

The rest of the FITSP-Designer blueprint

That's 10 of 1,030