CAP Practice Exam Tests Latest Updated on Oct-2021
Pass CAP Exam in First Attempt Guaranteed Dumps!
NEW QUESTION 192
According to FIPS Publication 199, what are the three levels of potential impact on organizations in the event of a compromise on confidentiality, integrity, and availability?
- A. Low, Moderate, and High
- B. Minimum, Moderate, and High
- C. Low, Normal, and High
- D. Confidential, Secret, and High
Answer: A
NEW QUESTION 193
Which of the following are the types of assessment tests addressed in NIST SP 800-53A?
- A. Functional, structural, penetration
- B. Validation, penetration, evaluation
- C. Functional, penetration, validation
- D. Validation, evaluation, penetration
Answer: A
NEW QUESTION 194
Joan is a project management consultant and she has been hired by a firm to help them identify risk events within the project. Joan would first like to examine the project documents including the plans, assumptions lists, project files, and contracts. What key thing will help Joan to discover risks within the review of the project documents?
- A. Plans that have loose definitions of terms and disconnected approaches will reveal risks.
- B. Lack of consistency between the plans and the project requirements and assumptions can be the indicators of risk in the project.
- C. Poorly written requirements will reveal inconsistencies in the project plans and documents.
- D. The project documents will help the project manager, or Joan, to identify what risk identification approach is best to pursue.
Answer: B
NEW QUESTION 195
Mary is the project manager for the BLB project. She has instructed the project team to assemble, to review the risks. She has included the schedule management plan as an input for the quantitative risk analysis process. Why is the schedule management plan needed for quantitative risk analysis?
- A. Mary will utilize the schedule controls to determine how risks may be allowed to change the project schedule.
- B. Mary will schedule when the identified risks are likely to happen and affect the project schedule.
- C. Mary will use the schedule management plan to schedule the risk identification meetings throughout the remaining project.
- D. Mary will utilize the schedule controls and the nature of the schedule for the quantitative analysis of the schedule.
Answer: D
NEW QUESTION 196
Which of the following is NOT considered an environmental threat source?
- A. Hurricane
- B. Water
- C. Chemical
- D. Pollution
Answer: A
Explanation:
Section: Volume B
NEW QUESTION 197
Which of the following relations correctly describes residual risk?
- A. Residual Risk = Threats x Vulnerability x Asset Gap x Control Gap
- B. Residual Risk = Threats x Vulnerability x Asset Value x Control Gap
- C. Residual Risk = Threats x Exploit x Asset Value x Control Gap
- D. Residual Risk = Threats x Exploit x Asset Value x Control Gap
Answer: B
NEW QUESTION 198
Which of the following individuals informs all C&A participants about life cycle actions, security requirements, and documented user needs?
- A. IS program manager
- B. DAA
- C. Certification Agent
- D. User representative
Answer: A
Explanation:
Section: Volume B
NEW QUESTION 199
You are the project manager for a construction project. The project involves casting of a column in a very narrow space. Because of lack of space, casting it is highly dangerous. High technical skill will be required for casting that column. You decide to hire a local expert team for casting that column. Which of the following types of risk response are you following?
- A. Mitigation
- B. Avoidance
- C. Transference
- D. Acceptance
Answer: C
NEW QUESTION 200
Which of the following NIST documents includes components for penetration testing?
- A. NIST SP 800-30
- B. NIST SP 800-26
- C. NIST SP 800-53
- D. NIST SP 800-37
Answer: A
NEW QUESTION 201
A high-profile, high-priority project within your organization is being created. Management wants you to pay special attention to the project risks and do all that you can to ensure that all of the risks are identified early in the project. Management has to ensure that this project succeeds.
Management's risk aversion in this project is associated with what term?
- A. Risk conscience
- B. Quantitative risk analysis
- C. Utility function
- D. Risk mitigation
Answer: C
NEW QUESTION 202
Certification and Accreditation (C&A or CnA) is a process for implementing information security.
Which of the following is the correct order of C&A phases in a DITSCAP assessment?
- A. Verification, Definition, Validation, and Post Accreditation
- B. Verification, Validation, Definition, and Post Accreditation
- C. Definition, Verification, Validation, and Post Accreditation
- D. Definition, Validation, Verification, and Post Accreditation
Answer: C
NEW QUESTION 203
Mark works as a project manager for TechSoft Inc. Mark, the project team, and the key project stakeholders have completed a round of qualitative risk analysis. He needs to update the risk register with his findings so that he can communicate the risk results to the project stakeholders - including management. Mark will need to update all of the following information except for which one?
- A. Watchlist of low-priority risks
- B. Risks grouped by categories
- C. Trends in qualitative risk analysis
- D. Prioritized list of quantified risks
Answer: D
NEW QUESTION 204
Which of the following individuals is responsible for monitoring the information system environment for factors that can negatively impact the security of the system and its accreditation?
- A. Chief Information Security Officer
- B. Information System Owner
- C. Chief Risk Officer
- D. Chief Information Officer
Answer: B
NEW QUESTION 205
To help review or design security controls, they can be classified by several criteria. One of these criteria is based on time. According to this criteria, which of the following controls are intended to prevent an incident from occurring?
- A. Adaptive controls
- B. Preventive controls
- C. Corrective controls
- D. Detective controls
Answer: B
NEW QUESTION 206
You are the project manager for the NHH project. You are working with your project team to examine the project from four different defined perspectives to increase the breadth of identified risks by including internally generated risks. What risk identification approach are you using in this example?
- A. Root cause analysis
- B. SWOT analysis
- C. Assumptions analysis
- D. Influence diagramming techniques
Answer: B
NEW QUESTION 207
Which of the following DoD directives is referred to as the Defense Automation Resources Management Manual?
- A. DoD 8910.1
- B. DoD 5200.22-M
- C. DoDD 8000.1
- D. DoD 7950.1-M
- E. DoD 5200.1-R
Answer: D
NEW QUESTION 208
Which one of the following is the only output for the qualitative risk analysis process?
- A. Project management plan
- B. Risk register updates
- C. Enterprise environmental factors
- D. Organizational process assets
Answer: B
NEW QUESTION 209
Which of the following parts of BS 7799 covers risk analysis and management?
- A. Part 1
- B. Part 2
- C. Part 3
- D. Part 4
Answer: C
Explanation:
Section: Volume D
NEW QUESTION 210
You are the project manager for your organization. You have identified a risk event you're your organization could manage internally or externally. If you manage the event internally
it will cost your project $578,000 and an additional $12,000 per month the solution is in use. A vendor can manage the risk event for you. The vendor will charge $550,000 and $14,500 per month that the solution is in use. How many months will you need to use the solution to pay for the internal solution in comparison to the vendor's solution?
- A. Approximately 11 months
- B. Approximately 13 months
- C. Approximately 15 months
- D. Approximately 8 months
Answer: A
NEW QUESTION 211
......
ISC Certification Free Certification Exam Material from Free4Dump with 395 Questions: https://www.free4dump.com/CAP-braindumps-torrent.html
CAP Dumps Full Questions - Exam Study Guide: https://drive.google.com/open?id=1JQiHPbbWyXPqeGxmkXxT7tjnifu1w-Ls