Certified Authorization Professional CAP Study Guides

1. Which of the following professionals plays the role of a monitor and takes part in the organization's configuration management process?

2. The Chief Information Officer (CIO), or Information Technology (IT) director, is a job title commonly given to the most senior executive in an enterprise.

What are the responsibilities of a Chief Information Officer? Each correct answer represents a complete solution. Choose all that apply.

3. The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively.

Which of the following statements are true about ISSO and ISSE? Each correct answer represents a complete solution. Choose all that apply.

4. Which of the following professionals is responsible for starting the Certification & Accreditation (C&A) process?

5. Which of the following assessment methodologies defines a six-step technical security evaluation?

6. DIACAP applies to the acquisition, operation, and sustainment of any DoD system that collects, stores, transmits, or processes unclassified or classified information since December 1997.

What phases are identified by DIACAP? Each correct answer represents a complete solution. Choose all that apply.

7. Mark works as a Network Administrator for NetTech Inc. He wants users to access only those resources that are required for them.

Which of the following access control models will he use?

8. Which of the following refers to an information security document that is used in the United States Department of Defense (DoD) to describe and accredit networks and systems?

9. James work as an IT systems personnel in SoftTech Inc. He performs the following tasks: Runs regular backups and routine tests of the validity of the backup data. Performs data restoration from the backups whenever required. Maintains the retained records in accordance with the established information classification policy.

What is the role played by James in the organization?

10. FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems.

Which of the following FITSAF levels shows that the procedures and controls have been implemented?

11. Certification and Accreditation (C&A or CnA) is a process for implementing information security.

Which of the following is the correct order of C&A phases in a DITSCAP assessment?

12. System Authorization is the risk management process. System Authorization Plan (SAP) is a comprehensive and uniform approach to the System Authorization Process.

What are the different phases of System Authorization Plan? Each correct answer represents a part of the solution. Choose all that apply.

13. Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation.

Which of the following statements are true about Certification and Accreditation? Each correct answer represents a complete solution. Choose two.

14. Which of the following requires all general support systems and major applications to be fully certified and accredited before these systems and applications are put into production? Each correct answer represents a part of the solution. Choose all that apply.

15. The National Information Assurance Certification and Accreditation Process (NIACAP) is the minimum standard process for the certification and accreditation of computer and telecommunications systems that handle U.S. national security information.

What are the different types of NIACAP accreditation? Each correct answer represents a complete solution. Choose all that apply.

16. According to U.S. Department of Defense (DoD) Instruction 8500.2, there are eight Information Assurance (IA) areas, and the controls are referred to as IA controls.

Which of the following are among the eight areas of IA defined by DoD? Each correct answer represents a complete solution. Choose all that apply.

17. DIACAP applies to the acquisition, operation, and sustainment of any DoD system that collects, stores, transmits, or processes unclassified or classified information since December 1997.

What phases are identified by DIACAP? Each correct answer represents a complete solution. Choose all that apply.

18. Which of the following is a subset discipline of Corporate Governance focused on information security systems and their performance and risk management?

19. Ben is the project manager of the YHT Project for his company. Alice, one of his team members, is confused about when project risks will happen in the project.

Which one of the following statements is the most accurate about when project risk happens?

20. You are the project manager of the NKJ Project for your company. The project's success or failure will have a significant impact on your organization's profitability for the coming year. Management has asked you to identify the risk events and communicate the event's probability and impact as early as possible in the project. Management wants to avoid risk events and needs to analyze the cost-benefits of each risk event in this project.

What term is assigned to the low-level of stakeholder tolerance in this project?

21. Where can a project manager find risk-rating rules?

22. There are five inputs to the quantitative risk analysis process.

Which one of the following is NOT an input to the perform quantitative risk analysis process?

23. Your project has several risks that may cause serious financial impact should they happen. You have studied the risk events and made some potential risk responses for the risk events but management wants you to do more. They'd like for you to create some type of a chart that identified the risk probability and impact with a financial amount for each risk event.

What is the likely outcome of creating this type of chart?

24. Which of the following professionals is responsible for starting the Certification & Accreditation (C&A) process?

25. You are working as a project manager in your organization. You are nearing the final stages of project execution and looking towards the final risk monitoring and controlling activities.

For your project archives, which one of the following is an output of risk monitoring and control?

26. Which of the following DoD directives is referred to as the Defense Automation Resources Management Manual?

27. The phase 3 of the Risk Management Framework (RMF) process is known as mitigation planning.

Which of the following processes take place in phase 3? Each correct answer represents a complete solution. Choose all that apply.

28. Gary is the project manager of his organization. He is managing a project that is similar to a project his organization completed recently. Gary has decided that he will use the information from the past project to help him and the project team to identify the risks that may be present in the project. Management agrees that this checklist approach is ideal and will save time in the project.

Which of the following statement is most accurate about the limitations of the checklist analysis approach for Gary?

29. What are the subordinate tasks of the Initiate and Plan IA C&A phase of the DIACAP process? Each correct answer represents a complete solution. Choose all that apply.

30. Information risk management (IRM) is the process of identifying and assessing risk, reducing it to an acceptable level, and implementing the right mechanisms to maintain that level.

What are the different categories of risk? Each correct answer represents a complete solution. Choose all that apply.

31. Neil works as a project manager for SoftTech Inc. He is working with Tom, the COO of his company, on several risks within the project. Tom understands that through qualitative analysis Neil has identified many risks in the project. Tom's concern, however, is that the priority list of these risk events are sorted in "high­risk," "moderate-risk," and "low-risk" as conditions apply within the project. Tom wants to know that is there any other objective on which Neil can make the priority list for project risks.

What will be Neil's reply to Tom?

32. In which type of access control do user ID and password system come under?

33. You and your project team are identifying the risks that may exist within your project. Some of the risks are small risks that won't affect your project much if they happen.

What should you do with these identified risk events?

34. Your project uses a piece of equipment that if the temperature of the machine goes above 450 degree Fahrenheit the machine will overheat and have to be shut down for 48 hours. Should this machine overheat even once it will delay the project's end date. You work with your project to create a response that should the temperature of the machine reach 430, the machine will be paused for at least an hour to cool it down.

The temperature of 430 is called what?

35. Adrian is the project manager of the NHP Project. In her project there are several work packages that deal with electrical wiring. Rather than to manage the risk internally she has decided to hire a vendor to complete all work packages that deal with the electrical wiring. By removing the risk internally to a licensed electrician Adrian feels more comfortable with project team being safe.

What type of risk response has Adrian used in this example?

36. James work as an IT systems personnel in SoftTech Inc. He performs the following tasks: Runs regular backups and routine tests of the validity of the backup data. Performs data restoration from the backups whenever required. Maintains the retained records in accordance with the established information classification policy.

What is the role played by James in the organization?

37. Which of the following is an entry in an object's discretionary access control list (DACL) that grants permissions to a user or group?

38. You are the project manager for your organization. You have identified a risk event you’re your organization could manage internally or externally. If you manage the event internally it will cost your project $578,000 and an additional $12,000 per month the solution is in use. A vendor can manage the risk event for you. The vendor will charge $550,000 and $14,500 per month that the solution is in use.

How many months will you need to use the solution to pay for the internal solution in comparison to the vendor's solution?

39. Which of the following refers to the ability to ensure that the data is not modified or tampered with?

40. Management wants you to create a visual diagram of what resources will be utilized in the project deliverables.

What type of a chart is management asking you to create?

41. You are preparing to start the qualitative risk analysis process for your project. You will be relying on some organizational process assets to influence the process.

Which one of the following is NOT a probable reason for relying on organizational process assets as an input for qualitative risk analysis?

42. System Authorization is the risk management process. System Authorization Plan (SAP) is a comprehensive and uniform approach to the System Authorization Process.

What are the different phases of System Authorization Plan? Each correct answer represents a part of the solution. Choose all that apply.

43. A part of a project deals with the hardware work. As a project manager, you have decided to hire a company to deal with all hardware work on the project.

Which type of risk response is this?

44. Risks with low ratings of probability and impact are included on a ____ for future monitoring.

45. Penetration testing (also called pen testing) is the practice of testing a computer system, network, or Web application to find vulnerabilities that an attacker could exploit.

Which of the following areas can be exploited in a penetration test? Each correct answer represents a complete solution. Choose all that apply.

46. Frank is the project manager of the NHH Project. He is working with the project team to create a plan to document the procedures to manage risks throughout the project. This document will define how risks will be identified and quantified. It will also define how contingency plans will be implemented by the project team.

What document is Frank and the NHH Project team creating in this scenario?

47. In which of the following testing methodologies do assessors use all available documentation and work under no constraints, and attempt to circumvent the security features of an information system?

48. Which of the following DITSCAP phases validates that the preceding work has produced an IS that operates in a specified computing environment?

49. Which of the following techniques are used after a security breach and are intended to limit the extent of any damage caused by the incident?

50. Which of the following roles is also known as the accreditor?

51. In which of the following phases of the DITSCAP process does Security Test and Evaluation (ST&E) occur?

52. You are the project manager of the NHH project for your company. You have completed the first round of risk management planning and have created four outputs of the risk response planning process.

Which one of the following is NOT an output of the risk response planning?

53. Thomas is a key stakeholder in your project. Thomas has requested several changes to the project scope for the project you are managing. Upon review of the proposed changes, you have discovered that these new requirements are laden with risks and you recommend to the change control board that the changes be excluded from the project scope. The change control board agrees with you.

What component of the change control system communicates the approval or denial of a proposed change request?

54. Which of the following assessment methodologies defines a six-step technical security evaluation?

55. You are the project manager of the NNH Project. In this project you have created a contingency response that the schedule performance index should be less than 0.93. The NHH Project has a budget at completion of $945,000 and is 45 percent complete though the project should be 49 percent complete. The project has spent $455,897 to reach the 45 percent complete milestone.

What is the project's schedule performance index?

56. A Web-based credit card company had collected financial and personal details of Mark before issuing him a credit card. The company has now provided Mark's financial and personal details to another company.

Which of the following Internet laws has the credit card issuing company violated?

57. Which of the following is a 1996 United States federal law, designed to improve the way the federal government acquires, uses, and disposes information technology?

58. Gary is the project manager for his project. He and the project team have completed the qualitative risk analysis process and are about to enter the quantitative risk analysis process when Mary, the project sponsor, wants to know what quantitative risk analysis will review.

Which of the following statements best defines what quantitative risk analysis will review?

59. Which of the following is used to indicate that the software has met a defined quality level and is ready for mass distribution either by electronic means or by physical media?

60. Amy is the project manager for her company. In her current project the organization has a very low tolerance for risk events that will affect the project schedule. Management has asked Amy to consider the affect of all the risks on the project schedule.

What approach can Amy take to create a bias against risks that will affect the schedule of the project?

61. Which of the following processes is a structured approach to transitioning individuals, teams, and organizations from a current state to a desired future state?

62. You are the project manager for your company and a new change request has been approved for your project. This change request, however, has introduced several new risks to the project. You have communicated these risk events and the project stakeholders understand the possible effects these risks could have on your project. You elect to create a mitigation response for the identified risk events.

Where will you record the mitigation response?

63. Which of the following RMF phases is known as risk analysis?

64. Jenny is the project manager of the NHJ Project for her company. She has identified several positive risk events within the project and she thinks these events can save the project time and money. You, a new team member wants to know that how many risk responses are available for a positive risk event.

What will Jenny reply to you?

65. Wendy is about to perform qualitative risk analysis on the identified risks within her project.

Which one of the following will NOT help Wendy to perform this project management activity?

66. Which of the following roles is responsible for review and risk analysis of all contracts on a regular basis?

67. You are the project manager for the NHH project. You are working with your project team to examine the project from four different defined perspectives to increase the breadth of identified risks by including internally generated risks.

What risk identification approach are you using in this example?

68. Which of the following are included in Physical Controls? Each correct answer represents a complete solution. Choose all that apply.

69. Which of the following NIST Special Publication documents provides a guideline on network security testing?

70. Which one of the following is the only output for the qualitative risk analysis process?

71. You are the project manager of the GHG project. You are preparing for the quantitative risk analysis process. You are using organizational process assets to help you complete the quantitative risk analysis process.

Which one of the following is NOT a valid reason to utilize organizational process assets as a part of the quantitative risk analysis process?

72. Which of the following objectives are defined by integrity in the C.I.A triad of information security systems? Each correct answer represents a part of the solution. Choose three.

73. You and your project team are just starting the risk identification activities for a project that is scheduled to last for 18 months. Your project team has already identified a long list of risks that need to be analyzed.

How often should you and the project team do risk identification?

74. Eric is the project manager of the MTC project for his company. In this project a vendor has offered Eric a sizeable discount on all hardware if his order total for the project is more than $125,000. Right now, Eric is likely to spend $118,000 with vendor. If Eric spends $7,000 his cost savings for the project will be $12,500, but he cannot purchase hardware if he cannot implement the hardware immediately due to organizational policies. Eric consults with Amy and Allen, other project managers in the organization, and asks if she needs any hardware for their projects. Both Amy and Allen need hardware and they agree to purchase the hardware through Eric's relationship with the vendor.

What positive risk response has happened in this instance?

75. You work as a project manager for BlueWell Inc. You are preparing to plan risk responses for your project with your team.

How many risk response types are available for a negative risk event in the project?

76. Sam is the project manager of a construction project in south Florida. This area of the United States is prone to hurricanes during certain parts of the year. As part of the project plan Sam and the project team acknowledge the possibility of hurricanes and the damage the hurricane could have on the project's deliverables, the schedule of the project, and the overall cost of the project. Once Sam and the project stakeholders acknowledge the risk of the hurricane they go on planning the project as if the risk is not likely to happen.

What type of risk response is Sam using?

77. Fred is the project manager of the PKL project. He is working with his project team to complete the quantitative risk analysis process as a part of risk management planning. Fred understands that once the quantitative risk analysis process is complete, the process will need to be completed again in at least two other times in the project.

When will the quantitative risk analysis process need to be repeated?

78. You are the project manager for a construction project. The project includes a work that involves very high financial risks. You decide to insure processes so that any ill happening can be compensated.

Which type of strategies have you used to deal with the risks involved with that particular work?

79. Which of the following are included in Administrative Controls? Each correct answer represents a complete solution. Choose all that apply.

80. The Phase 2 of DITSCAP C&A is known as Verification. The goal of this phase is to obtain a fully integrated system for certification testing and accreditation.

What are the process activities of this phase? Each correct answer represents a complete solution. Choose all that apply.

81. You are the project manager for GHY Project and are working to create a risk response for a negative risk. You and the project team have identified the risk that the project may not complete on time, as required by the management, due to the creation of the user guide for the software you're creating. You have elected to hire an external writer in order to satisfy the requirements and to alleviate the risk event.

What type of risk response have you elected to use in this instance?

82. You are the project manager of the GHQ project for your company. You are working you’re your project team to prepare for the qualitative risk analysis process. Mary, a project team member, does not understand why you need to complete qualitative risks analysis. You explain to Mary that qualitative risks analysis helps you determine which risks needs additional analysis. There are also some other benefits that qualitative risks analysis can do for the project.

Which one of the following is NOT an accomplishment of the qualitative risk analysis process?

83. Mark works as a Network Administrator for NetTech Inc. He wants users to access only those resources that are required for them.

Which of the following access control models will he use?

84. Which of the following are the common roles with regard to data in an information classification program? Each correct answer represents a complete solution. Choose all that apply.

85. To help review or design security controls, they can be classified by several criteria. One of these criteria is based on nature.

According to this criteria, which of the following controls consists of incident response processes, management oversight, security awareness, and training?

86. An Authorizing Official plays the role of an approver.

What are the responsibilities of an Authorizing Official? Each correct answer represents a complete solution. Choose all that apply.

87. Jeff, a key stakeholder in your project, wants to know how the risk exposure for the risk events is calculated during quantitative risk analysis. He is worried about the risk exposure which is too low for the events surrounding his project requirements.

How is the risk exposure calculated?

88. You work as a project manager for SoftTech Inc. You are working with the project stakeholders to begin the qualitative risk analysis process.

You will need all of the following as inputs to the qualitative risk analysis process except for which one?

89. What component of the change management system is responsible for evaluating, testing, and documenting changes created to the project scope?

90. A project team member has just identified a new project risk. The risk event is determined to have significant impact but a low probability in the project. Should the risk event happen it'll cause the project to be delayed by three weeks, which will cause new risk in the project.

What should the project manager do with the risk event?

91. Which of the following concepts represent the three fundamental principles of information security? Each correct answer represents a complete solution. Choose three.

92. Which of the following governance bodies provides management, operational and technical controls to satisfy security requirements?

93. Your organization has a project that is expected to last 20 months but the customer would really like the project completed in 18 months. You have worked on similar projects in the past and believe that you could fast track the project and reach the 18 month deadline.

What increases when you fast track a project?

94. The IAM/CA makes certification accreditation recommendations to the DAA. The DAA issues accreditation determinations.

Which of the following are the accreditation determinations issued by the DAA? Each correct answer represents a complete solution. Choose all that apply.

95. Tom is the project manager for his organization. In his project he has recently finished the risk response planning. He tells his manager that he will now need to update the cost and schedule baselines.

Why would the risk response planning cause Tom the need to update the cost and schedule baselines?

96. During qualitative risk analysis you want to define the risk urgency assessment. All of the following are indicators of risk priority except for which one?

97. You are the project manager of the NKQ project for your organization. You have completed the quantitative risk analysis process for this portion of the project.

What is the only output of the quantitative risk analysis process?

98. You work as the project manager for Bluewell Inc. You are working on NGQQ Projectyou’re your company. You have completed the risk analysis processes for the risk events. You and the project team have created risk responses for most of the identified project risks.

Which of the following risk response planning techniques will you use to shift the impact of a threat to a third party, together with the responses?

99. You work as a project manager for BlueWell Inc. You are currently working with the project stakeholders to identify risks in your project. You understand that the qualitative risk assessment and analysis can reflect the attitude of the project team and other stakeholders to risk. Effective assessment of risk requires management of the risk attitudes of the participants.

What should you, the project manager, do with assessment of identified risks in consideration of the attitude and bias of the participants towards the project risk?

100. Which of the following evidences are the collection of facts that, when considered together, can be used to infer a conclusion about the malicious activity/person?

101. Courtney is the project manager for her organization. She is working with the project team to complete the qualitative risk analysis for her project. During the analysis Courtney encourages the project team to begin the grouping of identified risks by common causes.

What is the primary advantage to group risks by common causes during qualitative risk analysis?

102. You work as a project manager for BlueWell Inc. You are working with Nancy, the COO of your company, on several risks within the project. Nancy understands that through qualitative analysis you have identified 80 risks that have a low probability and low impact as the project is currently planned. Nancy's concern, however, is that the impact and probability of these risk events may change as conditions within the project may change. She would like to know where will you document and record these 80 risks that have low probability and low impact for future reference.

What should you tell Nancy?

103. You work as a project manager for BlueWell Inc. Management has asked you to work with the key project stakeholder to analyze the risk events you have identified in the project. They would like you to analyze the project risks with a goal of improving the project's performance as a whole.

What approach can you use to achieve the goal of improving the project's performance through risk analysis with your project stakeholders?

104. Your project is an agricultural-based project that deals with plant irrigation systems. You have discovered a byproduct in your project that your organization could use to make a profit you’re your organization seizes this opportunity it would be an example of what risk response?

105. You are the program manager for your project. You are working with the project managers regarding the procurement processes for their projects. You have ruled out one particular contract type because it is considered too risky for the program.

Which one of the following contract types is usually considered to be the most dangerous for the buyer?

106. Which of the following NIST documents provides a guideline for identifying an information system as a National Security System?

107. You are the project manager of the GHY project for your organization. You are working with your project team to begin identifying risks for the project. As part of your preparation for identifying the risks within the project you will need eleven inputs for the process.

Which one of the following is NOT an input to the risk identification process?

108. There are seven risks responses that a project manager can choose from.

Which risk response is appropriate for both positive and negative risk events?

109. What course of action can be taken by a party if the current negotiations fail and an agreement cannot be reached?

110. Which of the following is the acronym of RTM?

111. Thomas is the project manager of the NHJ Project for his company. He has identified several positive risk events within his project and he thinks these events can save the project time and money.

Positive risk events, such as these within the NHJ Project are also known as what?

112. You are the project manager of the GGG project. You have completed the risk identification process for the initial phases of your project.

As you begin to document the risk events in the risk register what additional information can you associate with the identified risk events?

113. Which of the following are the tasks performed by the owner in the information classification schemes? Each correct answer represents a part of the solution. Choose three.

114. Which of the following approaches can be used to build a security program? Each correct answer represents a complete solution. Choose all that apply.

115. Mary is the project manager for the BLB project. She has instructed the project team to assemble, to review the risks. She has included the schedule management plan as an input for the quantitative risk analysis process.

Why is the schedule management plan needed for quantitative risk analysis?

116. Sammy is the project manager for her organization. She would like to rate each risk based on its probability and affect on time, cost, and scope. Harry, a project team member, has never done this before and thinks Sammy is wrong to attempt this approach. Harry says that an accumulative risk score should be created, not three separate risk scores.

Who is correct in this scenario?

117. Which of the following phases of the DITSCAP C&A process is used to define the C&A level of effort, to identify the main C&A roles and responsibilities, and to create an agreement on the method for implementing the security requirements?

118. A security policy is an overall general statement produced by senior management that dictates what role security plays within the organization.

Which of the following are required to be addressed in a well designed policy? Each correct answer represents a part of the solution. Choose all that apply.

119. The Project Risk Management knowledge area focuses on which of the following processes? Each correct answer represents a complete solution. Choose all that apply.