CAP Practice Questions

Which of the following is not a part of Identify Risks process?

In which of the following phases does the SSAA maintenance take place?

In which of the following phases do the system security plan update and the Plan of Action and Milestones (POAM) update take place?

Which of the following refers to the ability to ensure that the data is not modified or tampered with?

Management wants you to create a visual diagram of what resources will be utilized in the project deliverables. What type of a chart is management asking you to create?

Which of the following documents is used to provide a standard approach to the assessment of NIST SP 800-53 security controls?

What is the objective of the Security Accreditation Decision task?

You are the project manager for your organization. You are working with your key stakeholders in the qualitative risk analysis process. You understand that there is certain bias to...

Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security cont...

Beth is the project manager of the BFG Project for her company. In this project Beth has decided to create a contingency response based on the performance of the project schedule....

You are the project manager of the HJK Project for your organization. You and the project team have created risk responses for many of the risk events in the project. Where should...

Ned is the program manager for his organization and he's considering some new materials for his program. He and his team have never worked with these materials before and he wants...

Which of the following acts is used to recognize the importance of information security to the economic and national security interests of the United States?

What approach can a project manager use to improve the project's performance during qualitative risk analysis?

Which of the following is used in the practice of Information Assurance (IA) to define assurance requirements?

Joan is the project manager of the BTT project for her company. She has worked with her project to create risk responses for both positive and negative risk events within the proje...

Which of the following access control models uses a predefined set of access privileges for an object of a system?

Which of the following describes residual risk as the risk remaining after risk mitigation has occurred?

You work as the project manager for Bluewell Inc. There has been a delay in your project work that is adversely affecting the project schedule. You decide, with your stakeholders'...

Which of the following components ensures that risks are examined for all new proposed change requests in the change control system?

Which of the following classification levels defines the information that, if disclosed to the unauthorized parties, could be reasonably expected to cause exceptionally grave damag...

Mary is the project manager of the HGH Project for her company. She and her project team have agreed that if the vendor is late by more than ten days they will cancel the order and...

Which of the following individuals is responsible for monitoring the information system environment for factors that can negatively impact the security of the system and its accred...

Walter is the project manager of a large construction project. He'll be working with several vendors on the project. Vendors will be providing materials and labor for several parts...

Which of the following is a temporary approval to operate based on an assessment of the implementation status of the assigned IA Controls?

Nancy is the project manager of the NHH project. She and the project team have identified a significant risk in the project during the qualitative risk analysis process. Bob is fam...

Which of the following is a standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system?

The Phase 4 of DITSCAP C&A is known as Post Accreditation. This phase starts after the system has been accredited in Phase 3. What are the process activities of this phase? Each co...

The only output of the perform qualitative risk analysis are risk register updates. When the project manager updates the risk register he will need to include several pieces of inf...

Billy is the project manager of the HAR Project and is in month six of the project. The project is scheduled to last for 18 months. Management asks Billy how often the project team...

Rob is the project manager of the IDLK Project for his company. This project has a budget of $5,600,000 and is expected to last 18 months. Rob has learned that a new law may affect...

You are the project manager of the CUL project in your organization. You and the project team are assessing the risk events and creating a probability and impact matrix for the ide...

You are the project manager of a large construction project. Part of the project involves the wiring of the electricity in the building your project is creating. You and the projec...

You are the project manager of the GHY project for your organization. You are about to start the qualitative risk analysis process for the project and you need to determine the rol...

The Phase 1 of DITSCAP C&A is known as Definition Phase. The goal of this phase is to define the C&A level of effort, identify the main C&A roles and responsibilities, and create a...

You are the project manager of the GGH Project in your company. Your company is structured as a functional organization and you report to the functional manager that you are ready...

Which of the following professionals plays the role of a monitor and takes part in the organization's configuration management process?

In which of the following DIACAP phases is residual risk analyzed?

You are responsible for network and information security at a metropolitan police station. The most important concern is that unauthorized parties are not able to access data. What...

Mark is the project manager of the BFL project for his organization. He and the project team are creating a probability and impact matrix using RAG rating. There is some confusion...

Which of the following statements are true about security risks? Each correct answer represents a complete solution. Choose three.

FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems. Which of the following FITSAF...

A high-profile, high-priority project within your organization is being created. Management wants you to pay special attention to the project risks and do all that you can to ensur...

Which of the following governance bodies directs and coordinates implementations of the information security program?

What are the subordinate tasks of the Implement and Validate Assigned IA Control phase in the DIACAP process? Each correct answer represents a complete solution. Choose all that ap...

Which of the following DITSCAP C&A phases takes place between the signing of the initial version of the SSAA and the formal accreditation of the system?

The phase 0 of Risk Management Framework (RMF) is known as strategic risk assessment planning. Which of the following processes take place in phase 0? Each correct answer represent...

Which of the following fields of management focuses on establishing and maintaining consistency of a system's or product's performance and its functional and physical attributes wi...

Which of the following roles is used to ensure that the confidentiality, integrity, and availability of the services are maintained to the levels approved on the Service Level Agre...

Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?