10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The FITSP-Operator exam has 150 questions and runs 3 hours.
These 10 free FITSP-Operator questions are organized by exam domain, so you can see how each part of the FITSP-Operator blueprint is tested. Reveal the answer and explanation under each question.
A phishing site forwards an employee's password and freshly generated one-time code to the agency's real sign-in service before the code expires. The attacker obtains a session even though the service accepts each code only once. What change addresses the authentication weakness demonstrated by this attack?
Correct answer: C - Replace the one-time code with a PIN-activated WebAuthn security key.
A payment database fails at 09:20. Its recovery point objective (RPO) allows a 30-minute data-loss window; its recovery time objective (RTO) is 90 minutes from the outage. The recovery log shows: 09:10 snapshot: failed integrity validation. 08:55 snapshot: newest usable recovery point. 10:25: service restored from the 08:55 copy and validated. Which entry accurately reports the recovery objectives?
Correct answer: B - Both objectives were met: 25 minutes of potential data loss and 65 minutes of recovery.
One federal information system will hold both personnel case files and public emergency alerts. The approved information-type ratings are: Case files: confidentiality Moderate; integrity Moderate; availability Low. Emergency alerts: confidentiality Not Applicable; integrity High; availability Moderate. No system-specific adjustment is warranted. Select the initial FIPS 199 security category for the combined system.
Correct answer: A - Confidentiality Moderate; integrity High; availability Moderate.
A contractor submits electronic change approvals to an agency. Both parties can generate and verify the HMAC tags because they share the same key. An independent reviewer must be able to verify the contractor's approvals without receiving a secret that would let the reviewer forge them. Which replacement provides that property?
Correct answer: D - Have the contractor sign with its private key; give the reviewer only the trusted public key.
An investigation compares two protected audit trails: Privileged-access gateway: individual administrator, connection ID, session start and end. Target server: shared administrator account, command, timestamp, result. Two gateway sessions overlap, and the server records contain no connection ID. Analysts can establish what happened but cannot reliably identify who issued each command. What additional linkage would resolve that gap?
Correct answer: D - Record the gateway connection ID with each command and retain its mapping to the authenticated individual.
A network scanner flags a web service because its banner shows an affected version. The vendor's advisory states that the agency's installed package contains a backported fix and deliberately retains that banner. The running process is verified to use that package, and the vendor's validation check confirms the specific flaw is corrected. The scanner's detection logic examines only the banner. How should this finding be dispositioned?
Correct answer: A - As a documented false positive, supported by the package and validation evidence.
An agency is launching an online benefits service for U.S. citizens. It will collect applicants' names and income, record eligibility decisions, and retrieve files by name or applicant number. The privacy impact assessment (PIA) is complete, but no existing public notice covers the collection. What additional requirement is triggered by the retrieval method?
Correct answer: B - Publish a system of records notice for the new collection.
A Federal Civilian Executive Branch agency has capacity to patch one server tonight: North: CVSS v3.1 score 9.8; not in CISA’s Known Exploited Vulnerabilities (KEV) Catalog; agency patch deadline in seven days. South: CVSS v3.1 score 7.5; KEV remediation deadline tomorrow. The servers have equal exposure and mission importance. Both patches passed staging, neither server shows compromise, and both services must remain available except during approved patch outages. The next patch window is three days away. Which schedule satisfies both the deadlines and the service requirement?
Correct answer: C - Patch South tonight and keep North on its remaining compliant schedule.
To assess termination controls, an assessor samples 25 completed tickets and confirms every listed account was disabled on time. An independent HR roster identifies three other departed employees who held accounts in the system. No tickets can be found for them, and their access status has not been checked. Which follow-up would most directly address the assessment gap?
Correct answer: C - Reconcile HR departures to system accounts and verify timely revocation for the unmatched employees.
A vendor assigns a CVSS v3.1 Base score of 9.8 to a flaw in a remote-management service. An agency confines the service to a protected administration subnet, and testing confirms the restriction. A dashboard administrator proposes lowering the imported Base score to credit that control. Which revision preserves the meaning of the CVSS metrics?
Correct answer: A - Keep the Base score and assess the restriction through Environmental metrics.
The full bank has 1,020 more FITSP-Operator questions with explanations.
Continue in the free practice test →
View plans