CAP Exam Questions
384 real CAP exam questions with expert-verified answers and explanations. Page 4 of 8.
- Question #155Compliance Maintenance
Henry is the project manager of the QBG Project for his company. This project has a budget of $4,576,900 and is expected to last 18 months to complete. The CIO, a stakeholder in th...
Configuration managementChange controlSystem integrityProject management - Question #156Assessment/Audit of Security and Privacy Controls
Security Test and Evaluation (ST&E) is a component of risk assessment. It is useful in discovering system vulnerabilities. For what purposes is ST&E used? Each correct answer repre...
Security TestingSystem EvaluationVulnerability DiscoverySecurity Controls Assessment - Question #157Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following are the goals of risk management? Each correct answer represents a complete solution. Choose three.
Risk Management GoalsRisk IdentificationRisk AssessmentCost-Benefit Analysis - Question #158Security and Privacy Governance, Risk Management, and Compliance Program
Elizabeth is a project manager for her organization and she finds risk management to be very difficult for her to manage. She asks you, a lead project manager, at what stage in the...
Risk managementContinuous improvementExperienceProject management - Question #161Security and Privacy Governance, Risk Management, and Compliance Program
You are the project manager of the NHQ project for your company. Management has told you that you must implement an agreed upon contingency response if the Cost Performance Index i...
Cost Performance IndexEarned Value ManagementProject Management MetricsContingency Planning - Question #162Security and Privacy Governance, Risk Management, and Compliance Program
Bill is the project manager of the JKH Project. He and the project team have identified a risk event in the project with a high probability of occurrence and the risk event has a h...
Risk ManagementRisk Response StrategiesRisk AvoidanceProject Risk - Question #163Security and Privacy Governance, Risk Management, and Compliance Program
In what portion of a project are risk and opportunities greatest and require intense planning and anticipation of risk events?
Project InitiationRisk ManagementOpportunity IdentificationProject Lifecycle - Question #164Security and Privacy Governance, Risk Management, and Compliance Program
You work as a project manager for BlueWell Inc. You with your team are using a method or a (technical) process that conceives the risks even if all theoretically possible safety me...
Residual RiskRisk ManagementRisk Response - Question #166Security and Privacy Governance, Risk Management, and Compliance Program
Fred is the project manager of the CPS project. He is working with his project team to prioritize the identified risks within the CPS project. He and the team are prioritizing risk...
Risk managementQualitative risk analysisRisk prioritizationRMF process - Question #167Security and Privacy Governance, Risk Management, and Compliance Program
Diane is the project manager of the HGF Project. A risk that has been identified and analyzed in the project planning processes is now coming into fruition. What individual should...
Risk ManagementRisk ResponseRisk OwnerRoles and Responsibilities - Question #168Security and Privacy Governance, Risk Management, and Compliance Program
Ned is the project manager of the HNN project for your company. Ned has asked you to help him complete some probability distributions for his project. What portion of the project w...
Risk AnalysisProbability DistributionsUncertainty ModelingProject Management - Question #169Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following acts promote a risk-based policy for cost effective security? Each correct answer represents a part of the solution. Choose all that apply.
US Federal LegislationInformation Resource ManagementRisk-Based SecurityCost-Effectiveness - Question #170Selection and Approval of Framework, Security, and Privacy Controls
To help review or design security controls, they can be classified by several criteria. One of these criteria is based on time. According to this criteria, which of the following c...
Security ControlsControl ClassificationPreventive ControlsSecurity Incident Prevention - Question #171Security and Privacy Governance, Risk Management, and Compliance Program
You are the project manager for a construction project. The project involves casting of a column in a very narrow space. Because of lack of space, casting it is highly dangerous. H...
Risk ManagementRisk ResponseRisk Transference - Question #172Selection and Approval of Framework, Security, and Privacy Controls
Which of the following statements about the authentication concept of information security management is true?
AuthenticationInformation Security ConceptsIdentity Verification - Question #173Security and Privacy Governance, Risk Management, and Compliance Program
You and your project team have identified the project risks and now are analyzing the probability and impact of the risks. What type of analysis of the risks provides a quick and h...
Risk analysisQualitative risk analysisRisk assessmentProject risk management - Question #174Assessment/Audit of Security and Privacy Controls
NIST SP 800-53A defines three types of interview depending on the level of assessment conducted. Which of the following NIST SP 800-53A interviews consists of informal and ad hoc i...
NIST SP 800-53AAssessment MethodsInterview TypesControl Assessment - Question #175System Compliance
What are the responsibilities of a system owner? Each correct answer represents a complete solution. Choose all that apply.
System Owner ResponsibilitiesSecurity ControlsVulnerability ManagementSecurity Governance - Question #176Security and Privacy Governance, Risk Management, and Compliance Program
During which of the following processes, probability and impact matrix is prepared?
Risk ManagementQualitative Risk AnalysisProbability and Impact MatrixRisk Assessment - Question #177System Compliance
Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing s...
CertificationAccreditationC&ARisk Management Framework - Question #178Security and Privacy Governance, Risk Management, and Compliance Program
You work as a project manager for BlueWell Inc. Your project is running late and you must respond to the risk. Which risk response can you choose that will also cause you to update...
Project ManagementRisk ResponseHuman Resource ManagementProject Crashing - Question #179Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following groups represents the most likely source of an asset loss through the inappropriate use of computers?
Insider ThreatRisk ManagementThreat ActorsAsset Protection - Question #180Security and Privacy Governance, Risk Management, and Compliance Program
You are the project manager of the NNN project for your company. You and the project team are working together to plan the risk responses for the project. You feel that the team ha...
Risk ManagementQuantitative Risk AnalysisProject RiskRisk Response Planning - Question #181Security and Privacy Governance, Risk Management, and Compliance Program
Your project team has identified a project risk that must be responded to. The risk has been recorded in the risk register and the project team has been discussing potential risk r...
Risk ManagementRisk ResponseCorrective ActionsProject Risk - Question #182Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following documents is described in the statement below? "It is developed along with all processes of the risk management. It contains the results of the qualitative r...
Risk Management DocumentationRisk RegisterRisk AnalysisRisk Response Planning - Question #183Security and Privacy Governance, Risk Management, and Compliance Program
The Project Risk Management knowledge area focuses on which of the following processes? Each correct answer represents a complete solution. Choose all that apply.
Risk Management ProcessesQuantitative Risk AnalysisRisk MonitoringRisk Planning - Question #184Assessment/Audit of Security and Privacy Controls
Certification and Accreditation (C&A or CnA) is a process for implementing information security. Which of the following is the correct order of C&A phases in a DITSCAP assessment?
C&A phasesDITSCAPAccreditation ProcessInformation Security Process - Question #185Security and Privacy Governance, Risk Management, and Compliance Program
There are seven risk responses for any project. Which one of the following is a valid risk response for a negative risk event?
Risk ManagementRisk Response StrategiesNegative RisksRisk Acceptance - Question #186Assessment/Audit of Security and Privacy Controls
Which of the following persons is responsible for testing and verifying whether the security policy is properly implemented, and the derived security solutions are adequate or not?
Auditor responsibilitiesSecurity policy verificationControl assessmentRoles and responsibilities - Question #187Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following processes provides a standard set of activities, general tasks, and a management structure to certify and accredit systems, which maintain the information as...
NIACAPCertification and Accreditation (C&A)Information AssuranceSecurity Posture - Question #188Security and Privacy Governance, Risk Management, and Compliance Program
You work as a project manager for BlueWell Inc. You are working on a project and the management wants a rapid and cost-effective means for establishing priorities for planning risk...
Risk management processesQualitative risk analysisRisk prioritizationCost-effective risk analysis - Question #189Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following statements best describes the difference between the role of a data owner and the role of a data custodian?
Data OwnerData CustodianInformation ClassificationRoles and Responsibilities - Question #190Scope of the System
Which of the following NIST C&A documents is the guideline for identifying an information system as a National Security System?
NIST Special PublicationsNational Security Systems (NSS)Information System ClassificationCompliance Frameworks - Question #191Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following system security policies is used to address specific issues of concern to the organization?
Security PolicyPolicy TypesIssue-specific Policy - Question #192Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following individuals is responsible for ensuring the security posture of the organization's information system?
Authorizing OfficialRoles and ResponsibilitiesSecurity PostureRisk Management Framework - Question #193Selection and Approval of Framework, Security, and Privacy Controls
In which of the following Risk Management Framework (RMF) phases is a risk profile created for threats?
RMF PhasesRisk ProfileThreat IdentificationControl Selection - Question #194Security and Privacy Governance, Risk Management, and Compliance Program
In which of the following DITSCAP phases is the SSAA developed?
DITSCAPSSAACertification and Accreditation (C&A)Security Plan Development - Question #195Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following recovery plans includes a monitoring process and triggers for initiating planned actions?
Contingency PlanningRecovery PlanningRisk ResponseBusiness Resilience - Question #196Security and Privacy Governance, Risk Management, and Compliance Program
What does RTM stand for?
RTMRequirements Traceability MatrixDocumentationCompliance Management - Question #197Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following parts of BS 7799 covers risk analysis and management?
BS 7799Risk AnalysisRisk ManagementInformation Security Standards - Question #198Assessment/Audit of Security and Privacy Controls
Which of the following NIST documents includes components for penetration testing?
NIST Special PublicationsPenetration TestingRisk AssessmentVulnerability Identification - Question #199Security and Privacy Governance, Risk Management, and Compliance Program
According to FIPS Publication 199, what are the three levels of potential impact on organizations in the event of a compromise on confidentiality, integrity, and availability?
FIPS 199Impact LevelsCIA Triad - Question #200Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following individuals is responsible for the final accreditation decision?
RMFAccreditationAuthorization OfficialSystem Owner Responsibilities - Question #201Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following is a risk that is created by the response to another risk?
Risk managementSecondary riskRisk responseRisk terminology - Question #202Compliance Maintenance
Which of the following processes has the goal to ensure that any change does not lead to reduced or compromised security?
Change controlSecurity change managementSystem integrityOperational security - Question #203Security and Privacy Governance, Risk Management, and Compliance Program
Which of the following is not a part of Identify Risks process?
Risk Identification TechniquesRisk Management ProcessDecision Analysis Tools - Question #204Compliance Maintenance
In which of the following phases does the SSAA maintenance take place?
SSAAAuthorization processMaintenance phaseCompliance - Question #205Compliance Maintenance
Which of the following statements is true about the continuous monitoring process?
Continuous MonitoringRisk Management Framework (RMF)System AuthorizationAccreditation - Question #206Compliance Maintenance
In which of the following phases do the system security plan update and the Plan of Action and Milestones (POAM) update take place?
Continuous MonitoringSystem Security Plan (SSP)Plan of Action and Milestones (POAM)Risk Management Framework (RMF) phases - Question #207Implementation of Security and Privacy Controls
In which of the following phases does the change management process start?
RMF PhasesChange ManagementImplementation PhaseNIST SP 800-37