CAP Practice Questions
404 real CAP exam questions with expert-verified answers and explanations. Page 1 of 9.
- Question #1Security and Privacy Governance, Risk Management, and Compliance Program
DIACAP applies to the acquisition, operation, and sustainment of any DoD system that collects, stores, transmits, or processes unclassified or classified information since December...
DIACAPCertification and AccreditationDoD SystemsCompliance Lifecycle - Question #2Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following is a subset discipline of Corporate Governance focused on information security systems and their performance and risk management?
Information Security GovernanceCorporate GovernanceRisk Management - Question #3Security and Privacy Governance, Risk Management, and Compliance Program
Ben is the project manager of the YHT Project for his company. Alice, one of his team members, is confused about when project risks will happen in the project. Which one of the fol...
Project Risk ManagementRisk DefinitionRisk Characteristics - Question #4Security and Privacy Governance, Risk Management, and Compliance Program
You are the project manager of the NKJ Project for your company. The project's success or failure will have a significant impact on your organization's profitability for the coming...
Risk ManagementStakeholder ToleranceRisk Utility FunctionRisk Appetite - Question #5Security and Privacy Governance, Risk Management, and Compliance Program
Where can a project manager find risk-rating rules?
Risk ManagementOrganizational Process AssetsProject ManagementRisk Assessment - Question #6Security and Privacy Governance, Risk Management, and Compliance Program
There are five inputs to the quantitative risk analysis process. Which one of the following is NOT an input to the perform quantitative risk analysis process?
Risk Management ProcessQuantitative Risk AnalysisProcess InputsEnterprise Environmental Factors - Question #7Security and Privacy Governance, Risk Management, and Compliance Program
Your project has several risks that may cause serious financial impact should they happen. You have studied the risk events and made some potential risk responses for the risk even...
Risk ManagementQuantitative Risk AnalysisContingency PlanningFinancial Planning - Question #8Scope of the System
Which of the following professionals is responsible for starting the Certification & Accreditation (C&A) process?
C&A processRMF rolesInformation System OwnerProcess initiation - Question #9Security and Privacy Governance, Risk Management, and Compliance Program
You are working as a project manager in your organization. You are nearing the final stages of project execution and looking towards the final risk monitoring and controlling activ...
Risk ManagementRisk Monitoring and ControlProject Management OutputsRequested Changes - Question #10Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following DoD directives is referred to as the Defense Automation Resources Management Manual?
DoD DirectivesInformation Resources ManagementFederal GuidelinesAutomation Management - Question #11Security and Privacy Governance, Risk Management, and Compliance Program
The phase 3 of the Risk Management Framework (RMF) process is known as mitigation planning. Which of the following processes take place in phase 3? Each correct answer represents a...
Risk Management Framework (RMF)Mitigation PlanningRisk MitigationRMF Process Activities - Question #12Security and Privacy Governance, Risk Management, and Compliance Program
Gary is the project manager of his organization. He is managing a project that is similar to a project his organization completed recently. Gary has decided that he will use the in...
Risk IdentificationChecklist AnalysisLimitations of Risk Tools - Question #13Selection and Approval of Framework, Security, and Privacy Controls
What are the subordinate tasks of the Initiate and Plan IA C&A phase of the DIACAP process? Each correct answer represents a complete solution. Choose all that apply.
DIACAP ProcessSystem AccreditationInformation Assurance (IA)Initiation and Planning - Question #14Security and Privacy Governance, Risk Management, and Compliance Program
Information risk management (IRM) is the process of identifying and assessing risk, reducing it to an acceptable level, and implementing the right mechanisms to maintain that level...
Risk ManagementRisk CategoriesThreat SourcesIRM - Question #15Security and Privacy Governance, Risk Management, and Compliance Program
Neil works as a project manager for SoftTech Inc. He is working with Tom, the COO of his company, on several risks within the project. Tom understands that through qualitative anal...
Risk ManagementRisk PrioritizationQualitative Risk AnalysisProject Objectives - Question #16Selection and Approval of Framework, Security, and Privacy Controls
In which type of access control do user ID and password system come under?
Access ControlTechnical ControlsAuthenticationIdentification - Question #17Security and Privacy Governance, Risk Management, and Compliance Program
You and your project team are identifying the risks that may exist within your project. Some of the risks are small risks that won't affect your project much if they happen. What s...
Risk ManagementRisk IdentificationRisk MonitoringRisk Response - Question #18Security and Privacy Governance, Risk Management, and Compliance Program
Your project uses a piece of equipment that if the temperature of the machine goes above 450 degree Fahrenheit the machine will overheat and have to be shut down for 48 hours. Shou...
Risk managementRisk triggerRisk response planning - Question #19Security and Privacy Governance, Risk Management, and Compliance Program
Adrian is the project manager of the NHP Project. In her project there are several work packages that deal with electrical wiring. Rather than to manage the risk internally she has...
Risk managementRisk responseRisk transferenceVendor management - Question #20Implementation of Security and Privacy Controls
James work as an IT systems personnel in SoftTech Inc. He performs the following tasks: - Runs regular backups and routine tests of the validity of the backup data. - Performs data...
Information security rolesData custodianBackup and recoveryData management - Question #21Implementation of Security and Privacy Controls
Which of the following is an entry in an object's discretionary access control list (DACL) that grants permissions to a user or group?
Access Control Lists (ACLs)Access Control Entry (ACE)Discretionary Access Control (DAC)Permissions - Question #22Security and Privacy Governance, Risk Management, and Compliance Program
You are the project manager for your organization. You have identified a risk event you're your organization could manage internally or externally. If you manage the event internal...
Risk managementCost-benefit analysisRisk response optionsFinancial comparison - Question #23Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following refers to the ability to ensure that the data is not modified or tampered with?
CIA triadData integrityInformation security principlesSecurity concepts - Question #24Security and Privacy Governance, Risk Management, and Compliance Program
Management wants you to create a visual diagram of what resources will be utilized in the project deliverables. What type of a chart is management asking you to create?
Resource breakdown structure (RBS)Project managementResource planningProject deliverables - Question #25Security and Privacy Governance, Risk Management, and Compliance Program
You are preparing to start the qualitative risk analysis process for your project. You will be relying on some organizational process assets to influence the process. Which one of...
Qualitative Risk AnalysisOrganizational Process Assets (OPAs)Risk Management Inputs - Question #26Security and Privacy Governance, Risk Management, and Compliance Program
System Authorization is the risk management process. System Authorization Plan (SAP) is a comprehensive and uniform approach to the System Authorization Process. What are the diffe...
System Authorization Plan (SAP)Authorization Process PhasesCertification StagesRisk Management Framework (RMF) - Question #27Security and Privacy Governance, Risk Management, and Compliance Program
A part of a project deals with the hardware work. As a project manager, you have decided to hire a company to deal with all hardware work on the project. Which type of risk respons...
Risk ManagementRisk Response StrategiesTransferenceThird-Party Risk - Question #28Security and Privacy Governance, Risk Management, and Compliance Program
Risks with low ratings of probability and impact are included on a ____ for future monitoring.
Risk managementRisk monitoringWatchlistResidual risk - Question #29Security and Privacy Governance, Risk Management, and Compliance Program
You are the project manager for your organization. You are preparing for the quantitative risk analysis. Mark, a project team member, wants to know why you need to do quantitative...
Risk ManagementQuantitative Risk AnalysisRisk Assessment - Question #30Security and Privacy Governance, Risk Management, and Compliance Program
Frank is the project manager of the NHH Project. He is working with the project team to create a plan to document the procedures to manage risks throughout the project. This docume...
Risk Management PlanProject Risk ManagementRisk IdentificationContingency Planning - Question #31Assessment/Audit of Security and Privacy Controls
In which of the following testing methodologies do assessors use all available documentation and work under no constraints, and attempt to circumvent the security features of an in...
Penetration TestingSecurity TestingAssessment MethodologiesVulnerability Assessment - Question #32Assessment/Audit of Security and Privacy Controls
Which of the following DITSCAP phases validates that the preceding work has produced an IS that operates in a specified computing environment?
DITSCAPCertification and AccreditationSecurity ValidationSystem Assessment - Question #33Selection and Approval of Framework, Security, and Privacy Controls
Which of the following techniques are used after a security breach and are intended to limit the extent of any damage caused by the incident?
Security ControlsCorrective ControlsIncident ResponseDamage Limitation - Question #34System Compliance
Which of the following roles is also known as the accreditor?
RMF RolesDesignated Approving AuthorityAccreditationAuthorization Official - Question #35Assessment/Audit of Security and Privacy Controls
In which of the following phases of the DITSCAP process does Security Test and Evaluation (ST&E) occur?
DITSCAPSecurity Test and EvaluationST&ESystem assessment - Question #36Scope of the System
What component of the change management system is responsible for evaluating, testing, and documenting changes created to the project scope?
Configuration ManagementChange ManagementSystem ScopeDocumentation - Question #37Security and Privacy Governance, Risk Management, and Compliance Program
A project team member has just identified a new project risk. The risk event is determined to have significant impact but a low probability in the project. Should the risk event ha...
Risk identificationRisk management processRisk registerProject risk - Question #38Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following concepts represent the three fundamental principles of information security? Each correct answer represents a complete solution. Choose three.
Information Security PrinciplesCIA TriadConfidentialityIntegrity - Question #39Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following governance bodies provides management, operational and technical controls to satisfy security requirements?
GovernanceRoles and ResponsibilitiesOrganizational StructureSecurity Controls - Question #40Security and Privacy Governance, Risk Management, and Compliance Program
Your organization has a project that is expected to last 20 months but the customer would really like the project completed in 18 months. You have worked on similar projects in the...
Project Fast-trackingProject RiskSchedule Compression - Question #41System Compliance
The IAM/CA makes certification accreditation recommendations to the DAA. The DAA issues accreditation determinations. Which of the following are the accreditation determinations is...
Authorization to Operate (ATO)RMF (Risk Management Framework)Accreditation determinationsDAA (Designated Approving Authority) - Question #42Security and Privacy Governance, Risk Management, and Compliance Program
Tom is the project manager for his organization. In his project he has recently finished the risk response planning. He tells his manager that he will now need to update the cost a...
Risk Response PlanningProject BaselinesCost & Schedule ManagementScope Changes - Question #43Security and Privacy Governance, Risk Management, and Compliance Program
During qualitative risk analysis you want to define the risk urgency assessment. All of the following are indicators of risk priority except for which one?
Qualitative Risk AnalysisRisk PriorityRisk UrgencyRisk Assessment - Question #44Security and Privacy Governance, Risk Management, and Compliance Program
You are the project manager of the NKQ project for your organization. You have completed the quantitative risk analysis process for this portion of the project. What is the only ou...
Risk ManagementQuantitative Risk AnalysisProject ManagementRisk Register - Question #45Security and Privacy Governance, Risk Management, and Compliance Program
You work as the project manager for Bluewell Inc. You are working on NGQQ Projectyou're your company. You have completed the risk analysis processes for the risk events. You and th...
Risk managementRisk response strategiesRisk transferenceThreat management - Question #46Security and Privacy Governance, Risk Management, and Compliance Program
You work as a project manager for BlueWell Inc. You are currently working with the project stakeholders to identify risks in your project. You understand that the qualitative risk...
Risk ManagementQualitative Risk AssessmentBias MitigationProject Management - Question #47Assessment/Audit of Security and Privacy Controls
Which of the following evidences are the collection of facts that, when considered together, can be used to infer a conclusion about the malicious activity/person?
Evidence typesCircumstantial evidenceSecurity investigations - Question #48Security and Privacy Governance, Risk Management, and Compliance Program
Courtney is the project manager for her organization. She is working with the project team to complete the qualitative risk analysis for her project. During the analysis Courtney e...
Risk ManagementQualitative Risk AnalysisRisk ResponseRoot Cause Analysis - Question #49Security and Privacy Governance, Risk Management, and Compliance Program
You work as a project manager for BlueWell Inc. You are working with Nancy, the COO of your company, on several risks within the project. Nancy understands that through qualitative...
Risk ManagementRisk MonitoringWatchlistLow Probability/Impact Risks - Question #50Security and Privacy Governance, Risk Management, and Compliance Program
You work as a project manager for BlueWell Inc. Management has asked you to work with the key project stakeholder to analyze the risk events you have identified in the project. The...
Risk ManagementQualitative Risk AnalysisStakeholder EngagementProject Performance