Study. uk . com
  1. Home
  2. All questions
  3. Question 175

CISSP study material · question 175 of 500

A system holds two information types. One is moderate for confidentiality and low for integrity; the other is low for confidentiality and high for integrity. What is the system's FIPS 199 category?

  1. High confidentiality and high integrity, since one high value raises every objective.
  2. Moderate confidentiality and moderate integrity, taking the average of the values.
  3. Moderate confidentiality and high integrity, taking the highest value found for each objective.
  4. Low confidentiality and low integrity, taking the lowest value to avoid over-controlling.
Show the answer

Answer: C. Moderate confidentiality and high integrity, taking the highest value found for each objective.

A system's category takes, for each objective, the highest impact value among the information types it holds - the high water mark - rather than averaging or generalising.

Source: NIST FIPS 199 (NIST) — FIPS 199 > Security Categorization Applied to Information Systems

Challenge yourself on this topic → Study as cards