FITSP LATEST EXAM PREP QUESTIONS AND
ANSWERS PDF 2026
▶ FIPS-197. Answer: AES (Advanced encryption standard)
-The AES algorithm is a symmetric block cipher that can encrypt (encipher)
and decrypt (decipher).
Rijndael algorithm
▶ What cryptographic keys does the AES algorithm use and what size data
blocks can it encrypt/decrypt?. Answer: Keys: 128, 192, and 256
Can encrypt/decrypt data blocks of 128 bits
▶ FIPS-198. Answer: Keyed Hash Message Authentication Code (HMAC)
HMACs have two functionally distinct parameters, a message input and a
secret key known only to the message originator and intended receiver(s).
▶ FIPS-199. Answer: Develops standards for categorizing information and
information systems and covers all "official" federal systems.
▶ SP 800-60. Answer: Security Categorization: Guides implementation of
FIPS-199
▶ How does Clinger-Cohen tie into security?. Answer: 1. NIST issues
FIPS with which all agencies must comply
2. Info types are categorized using SP 800-60 (driven by FIPS 199 and
200), which derive their ratings from their use under the line of business in
the Business Reference Model.
3. This produces the criticality of the system and its info.
4. The above lead to the projection requirements (CIA triad)
▶ FIPS-200. Answer: Establishes minimum security requirements for
information systems (mandates the use of SP800-53 as amended)
▶ FIPS-201. Answer: PIV (common identification and e-auth)
, ▶ SP800-53. Answer: Recommended Security Controls for Federal
Information Systems and Organizations
FROM FIPS 199, 200
▶ SP800-53a. Answer: Guide for assessing the security controls in an
information system
▶ What are the three risk documents and two controls documents are the
primary documents from NIST for use in implementing RMF?. Answer:
Risk:
SP800-30
SP800-37
SP800-39
Controls:
SP800-53
SP800-53a
▶ The "3's" of special publications addressing risk?. Answer: SP800-30:
Risk Assessment
SP800-37: Risk Management Framework
SP800-137: Continuous Monitoring
SP800-39: Managing Risk, replaced the original SP800-30
▶ What are the three control families as defined by SP800-53r3?. Answer:
1. Management
2. Technical
3. Operational
▶ Implementation of continuous monitoring results in ongoing updates to
what documents?. Answer: Security Plan
Security Assessment Report
Plan of Action and Milestones
▶ Risk Management Strategy. Answer: An unambiguous expression of the
organization's risk tolerance, acceptable risk assessment methodologies,
risk mitigation strategies, a process for evaluation risk across the
organization, and approaches for monitoring risk.
ANSWERS PDF 2026
▶ FIPS-197. Answer: AES (Advanced encryption standard)
-The AES algorithm is a symmetric block cipher that can encrypt (encipher)
and decrypt (decipher).
Rijndael algorithm
▶ What cryptographic keys does the AES algorithm use and what size data
blocks can it encrypt/decrypt?. Answer: Keys: 128, 192, and 256
Can encrypt/decrypt data blocks of 128 bits
▶ FIPS-198. Answer: Keyed Hash Message Authentication Code (HMAC)
HMACs have two functionally distinct parameters, a message input and a
secret key known only to the message originator and intended receiver(s).
▶ FIPS-199. Answer: Develops standards for categorizing information and
information systems and covers all "official" federal systems.
▶ SP 800-60. Answer: Security Categorization: Guides implementation of
FIPS-199
▶ How does Clinger-Cohen tie into security?. Answer: 1. NIST issues
FIPS with which all agencies must comply
2. Info types are categorized using SP 800-60 (driven by FIPS 199 and
200), which derive their ratings from their use under the line of business in
the Business Reference Model.
3. This produces the criticality of the system and its info.
4. The above lead to the projection requirements (CIA triad)
▶ FIPS-200. Answer: Establishes minimum security requirements for
information systems (mandates the use of SP800-53 as amended)
▶ FIPS-201. Answer: PIV (common identification and e-auth)
, ▶ SP800-53. Answer: Recommended Security Controls for Federal
Information Systems and Organizations
FROM FIPS 199, 200
▶ SP800-53a. Answer: Guide for assessing the security controls in an
information system
▶ What are the three risk documents and two controls documents are the
primary documents from NIST for use in implementing RMF?. Answer:
Risk:
SP800-30
SP800-37
SP800-39
Controls:
SP800-53
SP800-53a
▶ The "3's" of special publications addressing risk?. Answer: SP800-30:
Risk Assessment
SP800-37: Risk Management Framework
SP800-137: Continuous Monitoring
SP800-39: Managing Risk, replaced the original SP800-30
▶ What are the three control families as defined by SP800-53r3?. Answer:
1. Management
2. Technical
3. Operational
▶ Implementation of continuous monitoring results in ongoing updates to
what documents?. Answer: Security Plan
Security Assessment Report
Plan of Action and Milestones
▶ Risk Management Strategy. Answer: An unambiguous expression of the
organization's risk tolerance, acceptable risk assessment methodologies,
risk mitigation strategies, a process for evaluation risk across the
organization, and approaches for monitoring risk.
