CAP Exam Questions

Which of the following is used in the practice of Information Assurance (IA) to define assurance requirements?

Joan is the project manager of the BTT project for her company. She has worked with her project to create risk responses for both positive and negative risk events within the proje...

Which of the following access control models uses a predefined set of access privileges for an object of a system?

Which of the following describes residual risk as the risk remaining after risk mitigation has occurred?

You work as the project manager for Bluewell Inc. There has been a delay in your project work that is adversely affecting the project schedule. You decide, with your stakeholders'...

Which of the following components ensures that risks are examined for all new proposed change requests in the change control system?

Which of the following classification levels defines the information that, if disclosed to the unauthorized parties, could be reasonably expected to cause exceptionally grave damag...

Mary is the project manager of the HGH Project for her company. She and her project team have agreed that if the vendor is late by more than ten days they will cancel the order and...

Which of the following individuals is responsible for monitoring the information system environment for factors that can negatively impact the security of the system and its accred...

Walter is the project manager of a large construction project. He'll be working with several vendors on the project. Vendors will be providing materials and labor for several parts...

Which of the following is a temporary approval to operate based on an assessment of the implementation status of the assigned IA Controls?

Nancy is the project manager of the NHH project. She and the project team have identified a significant risk in the project during the qualitative risk analysis process. Bob is fam...

The Phase 4 of DITSCAP C&A is known as Post Accreditation. This phase starts after the system has been accredited in Phase 3. What are the process activities of this phase? Each co...

The only output of the perform qualitative risk analysis are risk register updates. When the project manager updates the risk register he will need to include several pieces of inf...

Billy is the project manager of the HAR Project and is in month six of the project. The project is scheduled to last for 18 months. Management asks Billy how often the project team...

Rob is the project manager of the IDLK Project for his company. This project has a budget of $5,600,000 and is expected to last 18 months. Rob has learned that a new law may affect...

You are the project manager of the CUL project in your organization. You and the project team are assessing the risk events and creating a probability and impact matrix for the ide...

You are the project manager of a large construction project. Part of the project involves the wiring of the electricity in the building your project is creating. You and the projec...

You are the project manager of the GHY project for your organization. You are about to start the qualitative risk analysis process for the project and you need to determine the rol...

The Phase 1 of DITSCAP C&A is known as Definition Phase. The goal of this phase is to define the C&A level of effort, identify the main C&A roles and responsibilities, and create a...

You are the project manager of the GGH Project in your company. Your company is structured as a functional organization and you report to the functional manager that you are ready...

Which of the following professionals plays the role of a monitor and takes part in the organization's configuration management process?

In which of the following DIACAP phases is residual risk analyzed?

You are responsible for network and information security at a metropolitan police station. The most important concern is that unauthorized parties are not able to access data. What...

Mark is the project manager of the BFL project for his organization. He and the project team are creating a probability and impact matrix using RAG rating. There is some confusion...

Which of the following statements are true about security risks? Each correct answer represents a complete solution. Choose three.

FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems. Which of the following FITSAF...

A high-profile, high-priority project within your organization is being created. Management wants you to pay special attention to the project risks and do all that you can to ensur...

Which of the following governance bodies directs and coordinates implementations of the information security program?

What are the subordinate tasks of the Implement and Validate Assigned IA Control phase in the DIACAP process? Each correct answer represents a complete solution. Choose all that ap...

Which of the following DITSCAP C&A phases takes place between the signing of the initial version of the SSAA and the formal accreditation of the system?

The phase 0 of Risk Management Framework (RMF) is known as strategic risk assessment planning. Which of the following processes take place in phase 0? Each correct answer represent...

Which of the following fields of management focuses on establishing and maintaining consistency of a system's or product's performance and its functional and physical attributes wi...

Which of the following roles is used to ensure that the confidentiality, integrity, and availability of the services are maintained to the levels approved on the Service Level Agre...

Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?

Information Security management is a process of defining the security controls in order to protect information assets. The first action of a management program to implement informa...

Which of the following are the types of access controls? Each correct answer represents a complete solution. Choose three.

You are the project manager of the NNQ Project for your company and are working you're your project team to define contingency plans for the risks within your project. Mary, one of...

Who is responsible for the stakeholder expectations management in a high-profile, high-risk project?

Which of the following requires all general support systems and major applications to be fully certified and accredited before these systems and applications are put into productio...

Which of the following refers to a process that is used for implementing information security?

What project management plan is most likely to direct the quantitative risk analysis process for a project in a matrix environment?

Joan is a project management consultant and she has been hired by a firm to help them identify risk events within the project. Joan would first like to examine the project document...

Which of the following statements about the availability concept of Information security management is true?

Which of the following are the objectives of the security certification documentation task? Each correct answer represents a complete solution. Choose all that apply.

Which of the following statements about System Access Control List (SACL) is true?

Kelly is the project manager of the BHH project for her organization. She is completing the risk identification process for this portion of her project. Which one of the following...

You are the project manager for your organization. You are working with your project team to complete the qualitative risk analysis process. The first tool and technique you are us...

You are preparing to complete the quantitative risk analysis process with your project team and several subject matter experts. You gather the necessary inputs including the projec...

What NIACAP certification levels are recommended by the certifier? Each correct answer represents a complete solution. Choose all that apply.