How Many Questions Of CAP Study Guides

NEW QUESTION 1
Which of the following assessment methods involves observing or conducting the operation of physical devices?

• A. Interview
• B. Deviation
• C. Examination
• D. Testing

Answer: D

NEW QUESTION 2
Which of the following are included in Technical Controls?
Each correct answer represents a complete solution. Choose all that apply.

• A. Implementing and maintaining access control mechanisms
• B. Password and resource management
• C. Configuration of the infrastructure
• D. Identification and authentication methods
• E. Conducting security-awareness training
• F. Security devices

Answer: ABCDF

NEW QUESTION 3
The Phase 4 of DITSCAP C&A is known as Post Accreditation. This phase starts after the system has been accredited in Phase 3. What are the process activities of this phase?
Each correct answer represents a complete solution. Choose all that apply.

• A. Maintenance of the SSAA
• B. Compliance validation
• C. Change management
• D. System operations
• E. Security operations
• F. Continue to review and refine the SSAA

Answer: ABCDE

NEW QUESTION 4
During which of the following processes, probability and impact matrix is prepared?

• A. Plan Risk Responses
• B. Perform Quantitative Risk Analysis
• C. Perform Qualitative Risk Analysis
• D. Monitoring and Control Risks

Answer: C

NEW QUESTION 5
Which of the following is a risk response planning technique associated with threats that seeks to reduce the probability of occurrence or impact of a risk to below an acceptable threshold?

• A. Exploit
• B. Transference
• C. Mitigation
• D. Avoidance

Answer: C

NEW QUESTION 6
Which of the following governance bodies directs and coordinates implementations of the information security program?

• A. Information Security Steering Committee
• B. Senior Management
• C. Business Unit Manager
• D. Chief Information Security Officer

Answer: D

NEW QUESTION 7
Mark is the project manager of the BFL project for his organization. He and the project team are creating a probability and impact matrix using RAG rating. There is some confusion and disagreement among the project team as to how a certain risk is important and priority for attention should be managed. Where can Mark determine the priority of a risk given its probability and impact?

• A. Risk response plan
• B. Project sponsor
• C. Risk management plan
• D. Look-up table

Answer: D

NEW QUESTION 8
Which of the following RMF phases is known as risk analysis?

• A. Phase 0
• B. Phase 1
• C. Phase 2
• D. Phase 3

Answer: C

NEW QUESTION 9
Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation. Which of the following statements are true about Certification and Accreditation?
Each correct answer represents a complete solution. Choose two.

• A. Accreditation is the official management decision given by a senior agency official to authorize operation of an information system.
• B. Certification is a comprehensive assessment of the management, operational, and technical security controls inan information system.
• C. Accreditation is a comprehensive assessment of the management, operational, and technical security controls in an information system.
• D. Certification is the official management decision given by a senior agency official to authorize operation of an information system.

Answer: AB

NEW QUESTION 10
Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. Which of the following are the U.S. Federal Government information security standards?
Each correct answer represents a complete solution. Choose all that apply.

• A. SA System and Services Acquisition
• B. CA Certification, Accreditation, and Security Assessments
• C. IR Incident Response
• D. Information systems acquisition, development, and maintenance

Answer: ABC

NEW QUESTION 11
Which of the following is NOT a responsibility of a data owner?

• A. Maintaining and protecting data
• B. Ensuring that the necessary security controls are in place
• C. Delegating responsibility of the day-to-day maintenance of the data protection mechanisms to the data custodian
• D. Approving access requests

Answer: A

NEW QUESTION 12
According to FIPS Publication 199, what are the three levels of potential impact on organizations in the event of a compromise on confidentiality, integrity, and availability?

• A. Confidential, Secret, and High
• B. Minimum, Moderate, and High
• C. Low, Normal, and High
• D. Low, Moderate, and High

Answer: D

NEW QUESTION 13
Which of the following risk responses delineates that the project plan will not be changed to deal with the risk?

• A. Acceptance
• B. Mitigation
• C. Exploitation
• D. Transference

Answer: A

NEW QUESTION 14
A Web-based credit card company had collected financial and personal details of Mark before issuing him a credit card. The company has now provided Mark's financial and personal details to another company. Which of the following Internet laws has the credit card issuing company violated?

• A. Security law
• B. Privacy law
• C. Copyright law
• D. Trademark law

Answer: B

NEW QUESTION 15
What are the subordinate tasks of the Implement and Validate Assigned IA Control phase in the DIACAP process?
Each correct answer represents a complete solution. Choose all that apply.

• A. Conduct activities related to the disposition of the system data and objects.
• B. Execute and update IA implementation plan.
• C. Conduct validation activities.
• D. Combine validation results in DIACAP scorecard.

Answer: BCD

NEW QUESTION 16
Rob is the project manager of the IDLK Project for his company. This project has a budget of $5,600,000 and is expected to last 18 months. Rob has learned that a new law may affect how the project is allowed to proceed - even though the organization has already invested over $750,000 in the project. What risk response is the most appropriate for this instance?

• A. Transference
• B. Mitigation
• C. Enhance
• D. Acceptance

Answer: D

NEW QUESTION 17
You work as a project manager for BlueWell Inc. You are about to complete the quantitative risk analysis process for your project. You can use three available tools and techniques to complete this process. Which one of the following is NOT a tool or technique that is appropriate for the quantitative risk analysis process?

• A. Quantitative risk analysis andmodeling techniques
• B. Data gathering and representation techniques
• C. Expert judgment
• D. Organizational process assets

Answer: D

NEW QUESTION 18
......