Which of the following is NOT listed as an assessment task?

• A. Ensure the proper polices are in place
• B. Ensure all previous RMF steps were completed
• C. Collect and evaluate system artifacts
• D. Configure system backups

Answer: (D)

In a security assessment, the focus is on evidence and validation of controls and governance rather than performing system setup. You verify that policies exist and are appropriate, confirm that the prior RMF steps (categorize, select, implement, and conduct the initial assessment) have been completed, and collect artifacts that demonstrate how controls are implemented and tested—things like policy documents, test results, configuration baselines, and evidence of control effectiveness.

Configuring system backups, on the other hand, is about implementing or operating a contingency and data protection measure. While you would review backup policies and confirm that backups are in place and tested, the act of configuring or setting up backups is not something you typically do during the assessment itself. That’s why this task isn’t listed as an assessment task.