CAP : Certified Authorization Professional : Part 04
-
Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?
- Safeguard
- Single Loss Expectancy (SLE)
- Exposure Factor (EF)
- Annualized Rate of Occurrence (ARO)
-
You are the project manager of a large construction project. Part of the project involves the wiring of the electricity in the building your project is creating. You and the project team determine the electrical work is too dangerous to perform yourself so you hire an electrician to perform the work for the project. This is an example of what type of risk response?
- Transference
- Mitigation
- Avoidance
- Acceptance
-
You are the project manager of the GHY project for your organization. You are about to start the qualitative risk analysis process for the project and you need to determine the roles and responsibilities for conducting risk management. Where can you find this information?
- Risk management plan
- Enterprise environmental factors
- Staffing management plan
- Risk register
-
The Phase 1 of DITSCAP C&A is known as Definition Phase. The goal of this phase is to define the C&A level of effort, identify the main C&A roles and responsibilities, and create an agreement on the method for implementing the security requirements. What are the process activities of this phase?
Each correct answer represents a complete solution. Choose all that apply.
- Registration
- Document mission need
- Negotiation
- Initial Certification Analysis
-
Billy is the project manager of the HAR Project and is in month six of the project. The project is scheduled to last for 18 months. Management asks Billy how often the project team is participating in risk reassessment in this project. What should Billy tell management if he’s following the best practices for risk management?
- At every status meeting the project team project risk management is an agenda item.
- Project risk management happens at every milestone.
- Project risk management has been concluded with the project planning.
- Project risk management is scheduled for every month in the 18-month project.
-
Rob is the project manager of the IDLK Project for his company. This project has a budget of $5,600,000 and is expected to last 18 months. Rob has learned that a new law may affect how the project is allowed to proceed – even though the organization has already invested over $750,000 in the project. What risk response is the most appropriate for this instance?
- Transference
- Mitigation
- Enhance
- Acceptance
-
You are the project manager of the CUL project in your organization. You and the project team are assessing the risk events and creating a probability and impact matrix for the identified risks.
Which one of the following statements best describes the requirements for the data type used in qualitative risk analysis?
- A qualitative risk analysis requires fast and simple data to complete the analysis.
- A qualitative risk analysis requires accurate and unbiased data if it is to be credible.
- A qualitative risk analysis required unbiased stakeholders with biased risk tolerances.
- A qualitative risk analysis encourages biased data to reveal risk tolerances.
-
You are responsible for network and information security at a metropolitan police station. The most important concern is that unauthorized parties are not able to access data. What is this called?
- Confidentiality
- Encryption
- Integrity
- Availability
-
Mark is the project manager of the BFL project for his organization. He and the project team are creating a probability and impact matrix using RAG rating. There is some confusion and disagreement among the project team as to how a certain risk is important and priority for attention should be managed. Where can Mark determine the priority of a risk given its probability and impact?
- Risk response plan
- Project sponsor
- Risk management plan
- Look-up table
-
Which of the following statements are true about security risks?
Each correct answer represents a complete solution. Choose three.
- They can be removed completely by taking proper actions.
- They can be analyzed and measured by the risk analysis process.
- They can be mitigated by reviewing and taking responsible actions based on possible risks.
- They are considered an indicator of threats coupled with vulnerability.
-
You are the project manager of the GGH Project in your company. Your company is structured as a functional organization and you report to the functional manager that you are ready to move onto the quantitative risk analysis process. What things will you need as inputs for the quantitative risk analysis of the project in this scenario?
- You will need the risk register, risk management plan, permission from the functional manager, and any relevant organizational process assets.
- You will need the risk register, risk management plan, outputs of qualitative risk analysis, and any relevant organizational process assets.
- You will need the risk register, risk management plan, cost management plan, schedule management plan, and any relevant organizational process assets.
- Quantitative risk analysis does not happen through the project manager in a functional stru cture.
-
Which of the following professionals plays the role of a monitor and takes part in the organization’s configuration management process?
- Senior Agency Information Security Officer
- Authorizing Official
- Chief Information Officer
- Common Control Provider
-
In which of the following DIACAP phases is residual risk analyzed?
- Phase 2
- Phase 4
- Phase 5
- Phase 3
- Phase 1
-
Who is responsible for the stakeholder expectations management in a high-profile, high-risk project?
- Project management office
- Project sponsor
- Project risk assessment officer
- Project manager
-
Which of the following are included in Technical Controls?
Each correct answer represents a complete solution. Choose all that apply.
- Implementing and maintaining access control mechanisms
- Password and resource management
- Configuration of the infrastructure
- Identification and authentication methods
- Conducting security-awareness training
- Security devices
-
You are the project manager of the HJK project for your organization. You and the project team have created risk responses for many of the risk events in the project. A teaming agreement is an example of what risk response?
- Acceptance
- Mitigation
- Sharing
- Transference
-
Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in. What are the different categories of penetration testing?
Each correct answer represents a complete solution. Choose all that apply.
- Full-box
- Zero-knowledge test
- Full-knowledge test
- Open-box
- Partial-knowledge test
- Closed-box
-
What NIACAP certification levels are recommended by the certifier?
Each correct answer represents a complete solution. Choose all that apply.
- Minimum Analysis
- Basic System Review
- Detailed Analysis
- Maximum Analysis
- Comprehensive Analysis
- Basic Security Review
-
You work as a project manager for BlueWell Inc. There has been a delay in your project work that is adversely affecting the project schedule. You decided, with your stakeholders’ approval, to fast track the project work to get the project done faster. When you fast track the project which of the following are likely to increase?
- Quality control concerns
- Costs
- Risks
- Human resource needs
-
Information Security management is a process of defining the security controls in order to protect information assets. What are the security management responsibilities?
Each correct answer represents a complete solution. Choose all that apply.
- Evaluating business objectives, security risks, user productivity, and functionality requirem ents
- Determining actual goals that are expected to be accomplished from a security program
- Defining steps to ensure that all the responsibilities are accounted for and properly address ed
- Determining objectives, scope, policies, priorities, standards, and strategies
Subscribe
0 Comments
Newest