CAP Exam Questions
384 real CAP exam questions with expert-verified answers and explanations. Page 3 of 8.
- Question #105Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following processes is described in the statement below? "It is the process of implementing risk response plans, tracking identified risks, monitoring residual risk, i...
Risk ManagementRisk MonitoringRisk ControlRisk Response - Question #106Security and Privacy Governance, Risk Management, and Compliance Program
There are seven risk responses for any project. Which one of the following is a valid risk response for a negative risk event?
Risk managementRisk response strategiesNegative riskThreats - Question #107Security and Privacy Governance, Risk Management, and Compliance Program
The National Information Assurance Certification and Accreditation Process (NIACAP) is the minimum standard process for the certification and accreditation of computer and telecomm...
NIACAPAccreditationCertification & AccreditationInformation Assurance - Question #108Security and Privacy Governance, Risk Management, and Compliance Program
You are the project manager of the GHY Project for your company. You have completed the risk response planning with your project team. You now need to update the WBS. Why would the...
Risk ManagementProject ManagementWork Breakdown Structure (WBS)Project Scope - Question #109Security and Privacy Governance, Risk Management, and Compliance Program
The risk transference is referred to the transfer of risks to a third party, usually for a fee, it creates a contractual-relationship for the third party to manage the risk on beha...
Risk ManagementRisk TransferenceRisk Response StrategiesLife Cycle Costing - Question #110Security and Privacy Governance, Risk Management, and Compliance Program
Adrian is a project manager for a new project using a technology that has recently been released and there's relatively little information about the technology. Initial testing of...
Risk ManagementProject DocumentationRisk Register - Question #111Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following is a risk response planning technique associated with threats that seeks to reduce the probability of occurrence or impact of a risk to below an acceptable t...
Risk ManagementRisk ResponseThreat MitigationRisk Planning - Question #112Security and Privacy Governance, Risk Management, and Compliance Program
BS 7799 is an internationally recognized ISM standard that provides high level, conceptual recommendations on enterprise security. BS 7799 is basically divided into three parts. Wh...
Information Security StandardsBS 7799ISO 27000 seriesRisk Management - Question #113Security and Privacy Governance, Risk Management, and Compliance Program
Gary is the project manager for his organization. He is working with the project stakeholders on the project requirements and how risks may affect their project. One of the stakeho...
project riskrisk definitionproject objectivesrisk management - Question #114Security and Privacy Governance, Risk Management, and Compliance Program
You work as a project manager for TechSoft Inc. You are working with the project stakeholders onthe qualitative risk analysis process in your project. You have used all the tools t...
Qualitative Risk AnalysisRisk Management ProcessRisk Assessment ToolsProject Risk Management - Question #115Security and Privacy Governance, Risk Management, and Compliance Program
You are the project manager for your organization. You have determined that an activity is too dangerous to complete internally so you hire licensed contractor to complete the work...
Risk ManagementSecondary RiskRisk TransferenceProject Management - Question #116Security and Privacy Governance, Risk Management, and Compliance Program
Tracy is the project manager of the NLT Project for her company. The NLT Project is scheduled to last 14 months and has a budget at completion of $4,555,000. Tracy's organization w...
Risk ManagementRisk ResponsePositive RiskOpportunity Management - Question #117Security and Privacy Governance, Risk Management, and Compliance Program
Diana is the project manager of the QPS project for her company. In this project Diana and the project team have identified a pure risk. Diana and the project team decided, along w...
Pure riskRisk definitionRisk managementRisk types - Question #118Security and Privacy Governance, Risk Management, and Compliance Program
You work as a project manager for BlueWell Inc. You are about to complete the quantitative risk analysis process for your project. You can use three available tools and techniques...
Quantitative Risk AnalysisRisk Management ProcessProject Management ToolsOrganizational Process Assets - Question #119Security and Privacy Governance, Risk Management, and Compliance Program
You work as a project manager for TechSoft Inc. You, the project team, and the key project stakeholders have completed a round of quantitative risk analysis. You now need to update...
Quantitative Risk AnalysisRisk RegisterProject Risk ManagementRisk Communication - Question #120Security and Privacy Governance, Risk Management, and Compliance Program
Lisa is the project manager of the SQL project for her company. She has completed the risk response planning with her project team and is now ready to update the risk register to r...
Risk ManagementRisk ResponseRisk RegisterPrioritization - Question #121Security and Privacy Governance, Risk Management, and Compliance Program
David is the project manager of HGF project for his company. David, the project team, and several key stakeholders have completed risk identification and are ready to move into qua...
Risk ManagementQualitative Risk AnalysisRisk PrioritizationProject Management - Question #122Security and Privacy Governance, Risk Management, and Compliance Program
The Identify Risk process determines the risks that affect the project and document their characteristics. Why should the project team members be involved in the Identify Risk proc...
Risk IdentificationProject Team InvolvementRisk Management PrinciplesAccountability - Question #123Assessment/Audit of Security and Privacy Controls
Which of the following NIST Special Publication documents provides a guideline on questionnaires and checklists through which systems can be evaluated for compliance against specif...
NIST SP 800-26Security AssessmentCompliance ChecklistsSelf-Assessment - Question #124Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following recovery plans includes specific strategies and actions to deal with specific variances to assumptions resulting in a particular security problem, emergency,...
Contingency planningRecovery plansIncident responseRisk management - Question #125Security and Privacy Governance, Risk Management, and Compliance Program
An organization monitors the hard disks of its employees' computers from time to time. Which policy does this pertain to?
Privacy policyEmployee monitoringData privacyOrganizational policy - Question #126Security and Privacy Governance, Risk Management, and Compliance Program
You work as a project manager for BlueWell Inc. You are working with your team members on the risk responses in the project. Which risk response will likely cause a project to use...
Risk ManagementRisk Response StrategiesRisk SharingProcurement - Question #127Selection and Approval of Framework, Security, and Privacy Controls
ISO 17799 has two parts. The first part is an implementation guide with guidelines on how to build a comprehensive information security infrastructure and the second part is an aud...
ISO 17799Information Security StandardsSecurity ControlsCompliance - Question #128Implementation of Security and Privacy Controls
FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems. Which of the following FITSAF...
FITSAFControl ImplementationSecurity Control LevelsSecurity Assessment Frameworks - Question #129Security and Privacy Governance, Risk Management, and Compliance Program
Sammy is the project manager for her organization. She would like to rate each risk based on its probability and affect on time, cost, and scope. Harry, a project team member, has...
Risk ManagementRisk AssessmentRisk ScoringProject Objectives - Question #130Selection and Approval of Framework, Security, and Privacy Controls
An authentication method uses smart cards as well as usernames and passwords for authentication. Which of the following authentication methods is being referred to?
Multi-factor authenticationAuthentication factorsSmart cardsPasswords - Question #131Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following risk responses delineates that the project plan will not be changed to deal with the risk?
Risk AcceptanceRisk ResponseRisk Management - Question #132Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following statements reflect the 'Code of Ethics Canons' in the '(ISC)2 Code of Ethics'? Each correct answer represents a complete solution. Choose all that apply.
(ISC)2 Code of EthicsEthical CanonsProfessional Ethics - Question #133Assessment/Audit of Security and Privacy Controls
The Phase 3 of DITSCAP C&A is known as Validation. The goal of Phase 3 is to validate that the preceding work has produced an IS that operates in a specified computing environment....
DITSCAPC&A PhasesValidation PhaseCertification Evaluation - Question #134Security and Privacy Governance, Risk Management, and Compliance Program
John is the project manager of the NHQ Project for his company. His project has 75 stakeholders, some of which are external to the organization. John needs to make certain that he...
Risk CommunicationStakeholder ManagementCommunications Management - Question #135Security and Privacy Governance, Risk Management, and Compliance Program
Your organization has named you the project manager of the JKN Project. This project has a BAC of $1,500,000 and it is expected to last 18 months. Management has agreed that if the...
Project ManagementProject CrashingCost ManagementSchedule Management - Question #136Security and Privacy Governance, Risk Management, and Compliance Program
You work as a project manager for BlueWell Inc. There has been a delay in your project work that is adversely affecting the project schedule. You decided, with your stakeholders' a...
Project ManagementFast TrackingRisk ManagementSchedule Management - Question #137Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following DoD directives defines DITSCAP as the standard C&A process for the Department of Defense?
DITSCAPC&A processDoD DirectivesInformation Security Policy - Question #138Security and Privacy Governance, Risk Management, and Compliance Program
Virginia is the project manager for her organization. She has hired a subject matter expert to interview the project stakeholders on certain identified risks within the project. Th...
Risk assessmentRisk analysisProbability and impact - Question #139Security and Privacy Governance, Risk Management, and Compliance Program
A security policy is an overall general statement produced by senior management that dictates what role security plays within the organization. What are the different types of poli...
Security PoliciesPolicy TypesInformation Security Governance - Question #140Scope of the System
In 2003, NIST developed a new Certification & Accreditation (C&A) guideline known as FIPS 199. What levels of potential impact are defined by FIPS 199? Each correct answer represen...
NIST FIPS 199Impact LevelsSecurity CategorizationRisk Management Framework - Question #141Security and Privacy Governance, Risk Management, and Compliance Program
Harry is a project manager of a software development project. In the early stages of planning, he and the stakeholders operated with the belief that the software they were developi...
Project ManagementAssumptionsRisk ManagementProject Planning - Question #142Selection and Approval of Framework, Security, and Privacy Controls
Which of the following statements about Discretionary Access Control List (DACL) is true?
Discretionary Access Control List (DACL)Access ControlAuthorizationPermissions - Question #143Security and Privacy Governance, Risk Management, and Compliance Program
Which types of project tends to have more well-understood risks?
Project ManagementRisk ManagementProject TypesRisk Assessment - Question #144System Compliance
The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statem...
ISSO rolesISSE rolesSystem security managementCompliance lifecycle - Question #145Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following processes is described in the statement below? "This is the process of numerically analyzing the effect of identified risks on overall project objectives."
Risk Management ProcessQuantitative Risk AnalysisRisk Assessment - Question #146Security and Privacy Governance, Risk Management, and Compliance Program
The Chief Information Officer (CIO), or Information Technology (IT) director, is a job title commonly given to the most senior executive in an enterprise. What are the responsibili...
CIO responsibilitiesIT GovernanceInformation Security ManagementContinuous Monitoring - Question #147Security and Privacy Governance, Risk Management, and Compliance Program
Eric is the project manager of the NQQ Project and has hired the ZAS Corporation to complete part of the project work for Eric's organization. Due to a change request the ZAS Corpo...
Contract ManagementTermination ClausesVendor ManagementLegal Liability - Question #148Security and Privacy Governance, Risk Management, and Compliance Program
Mark works as a project manager for TechSoft Inc. Mark, the project team, and the key project stakeholders have completed a round of qualitative risk analysis. He needs to update t...
Risk ManagementQualitative Risk AnalysisRisk Register UpdatesRisk Communication - Question #149Selection and Approval of Framework, Security, and Privacy Controls
Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security cont...
NIST SP 800-53Control FamiliesFederal Information Security StandardsInformation Security Controls - Question #150Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following tasks are identified by the Plan of Action and Milestones document? Each correct answer represents a complete solution. Choose all that apply.
Plan of Action and Milestones (POAM)Risk ManagementCompliance RemediationSecurity Controls - Question #151Security and Privacy Governance, Risk Management, and Compliance Program
Jenny is the project manager for the NBT projects. She is working with the project team and several subject matter experts to perform the quantitative risk analysis process. During...
Risk IdentificationRisk RegisterRisk Management ProcessQuantitative Risk Analysis - Question #152Security and Privacy Governance, Risk Management, and Compliance Program
Shoulder surfing is a type of in-person attack in which the attacker gathers information about the premises of an organization. This attack is often performed by looking surreptiti...
Shoulder surfingConfidentialityIn-person attacksSecurity principles - Question #153Security and Privacy Governance, Risk Management, and Compliance Program
Harry is the project manager of the MMQ Construction Project. In this project Harry has identified a supplier who can create stained glass windows for 1,000 window units in the con...
Risk ManagementRisk ResponseMitigationProject Risk - Question #154Security and Privacy Governance, Risk Management, and Compliance Program
You are the project manager of the BlueStar project in your company. Your company is structured as a functional organization and you report to the functional manager that you are r...
Risk ManagementProject Management ProcessesQualitative Risk AnalysisProject Inputs