Question 1

Which of the following RMF phases is known as risk analysis?

Accepted Answer

A)  Phase 0 
B)  Phase 1 
C)  Phase 2 
D)  Phase 3 
A)  Phase 0 
B)  Phase 1 
C)  Phase 2 
D)  Phase 3

Question 2

Which of the following is a standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system?

Accepted Answer

A)  FITSAF 
B)  TCSEC 
C)  FIPS 
D)  SSAA 
A)  FITSAF 
B)  TCSEC 
C)  FIPS 
D)  SSAA

Question 3

Which of the following objectives are defined by integrity in the C.I.A triad of information security systems? Each correct answer represents a part of the solution. Choose three.

Accepted Answer

A)  It preserves the internal and external consistency of information. 
B)  It prevents the unauthorized or unintentional modification of information by the authorized users. 
C)  It prevents the intentional or unintentional unauthorized disclosure of a message's contents . 
D)  It prevents the modification of information by the unauthorized users. 
A)  It preserves the internal and external consistency of information. 
B)  It prevents the unauthorized or unintentional modification of information by the authorized users. 
C)  It prevents the intentional or unintentional unauthorized disclosure of a message's contents . 
D)  It prevents the modification of information by the unauthorized users.

Question 4

BS 7799 is an internationally recognized ISM standard that provides high level, conceptual recommendations on enterprise security. BS 7799 is basically divided into three parts. Which of the following statements are true about BS 7799? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

A)  BS 7799 Part 1 was adopted by ISO as ISO/IEC 27001 in November 2005. 
B)  BS 7799 Part 2 was adopted by ISO as ISO/IEC 27001 in November 2005. 
C)  BS 7799 Part 1 was a standard originally published as BS 7799 by the British Standards Institute (BSI) in 1995. 
D)  BS 7799 Part 3 was published in 2005, covering risk analysis and management. 
A)  BS 7799 Part 1 was adopted by ISO as ISO/IEC 27001 in November 2005. 
B)  BS 7799 Part 2 was adopted by ISO as ISO/IEC 27001 in November 2005. 
C)  BS 7799 Part 1 was a standard originally published as BS 7799 by the British Standards Institute (BSI) in 1995. 
D)  BS 7799 Part 3 was published in 2005, covering risk analysis and management.

Question 5

Information risk management (IRM) is the process of identifying and assessing risk, reducing it to an acceptable level, and implementing the right mechanisms to maintain that level. What are the different categories of risk? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

A)  System interaction 
B)  Human interaction 
C)  Equipment malfunction 
D)  Inside and outside attacks 
E)  Social status
F) Physical damage 
A)  System interaction 
B)  Human interaction 
C)  Equipment malfunction 
D)  Inside and outside attacks 
E)  Social status
F) Physical damage

Question 6

Which of the following individuals informs all C&A participants about life cycle actions, security requirements, and documented user needs?

Accepted Answer

A)  IS program manager 
B)  Certification Agent 
C)  User representative 
D)  DAA 
A)  IS program manager 
B)  Certification Agent 
C)  User representative 
D)  DAA

Question 7

Which of the following individuals is responsible for the final accreditation decision?

Accepted Answer

A)  Information System Owner 
B)  Certification Agent 
C)  User Representative 
D)  Risk Executive 
A)  Information System Owner 
B)  Certification Agent 
C)  User Representative 
D)  Risk Executive

Question 8

A ________ points to a statement in a policy or procedure that helps determine a course of action.

Accepted Answer

A)  Comment 
B)  Guideline 
C)  Procedure 
D)  Baseline 
A)  Comment 
B)  Guideline 
C)  Procedure 
D)  Baseline

Question 9

Which of the following processes has the goal to ensure that any change does not lead to reduced or compromised security?

Accepted Answer

A)  Change control management 
B)  Security management 
C)  Configuration management 
D)  Risk management 
A)  Change control management 
B)  Security management 
C)  Configuration management 
D)  Risk management

Question 10

Which of the following describes residual risk as the risk remaining after risk mitigation has occurred?

Accepted Answer

A)  DIACAP 
B)  ISSO 
C)  SSAA 
D)  DAA 
A)  DIACAP 
B)  ISSO 
C)  SSAA 
D)  DAA

Question 11

Which of the following formulas was developed by FIPS 199 for categorization of an information system?

Accepted Answer

A)  SC information system = {(confidentiality, impact), (integrity, controls), (availability, risk)} 
B)  SC information system = {(confidentiality, impact), (integrity, impact), (availability, impact)} 
C)  SC information system = {(confidentiality, controls), (integrity, controls), (availability, controls )} 
D)  SC information system = {(confidentiality, risk), (integrity, impact), (availability, controls)} 
A)  SC information system = {(confidentiality, impact), (integrity, controls), (availability, risk)} 
B)  SC information system = {(confidentiality, impact), (integrity, impact), (availability, impact)} 
C)  SC information system = {(confidentiality, controls), (integrity, controls), (availability, controls )} 
D)  SC information system = {(confidentiality, risk), (integrity, impact), (availability, controls)}

Question 12

You work as the project manager for Bluewell Inc. You are working on NGQQ Projectyou're your company. You have completed the risk analysis processes for the risk events. You and the project team have created risk responses for most of the identified project risks. Which of the following risk response planning techniques will you use to shift the impact of a threat to a third party, together with the responses?

Accepted Answer

A)  Risk acceptance 
B)  Risk avoidance 
C)  Risk transference 
D)  Risk mitigation 
A)  Risk acceptance 
B)  Risk avoidance 
C)  Risk transference 
D)  Risk mitigation

Question 13

Courtney is the project manager for her organization. She is working with the project team to complete the qualitative risk analysis for her project. During the analysis Courtney encourages the project team to begin the grouping of identified risks by common causes. What is the primary advantage to group risks by common causes during qualitative risk analysis?

Accepted Answer

A)  It can lead to developing effective risk responses. 
B)  It can lead to the creation of risk categories unique to each project. 
C)  It helps the project team realize the areas of the project most laden with risks. 
D)  It saves time by collecting the related resources, such as project team members, to analyze the risk events. 
A)  It can lead to developing effective risk responses. 
B)  It can lead to the creation of risk categories unique to each project. 
C)  It helps the project team realize the areas of the project most laden with risks. 
D)  It saves time by collecting the related resources, such as project team members, to analyze the risk events.

Question 14

You work as a project manager for BlueWell Inc. You are about to complete the quantitative risk analysis process for your project. You can use three available tools and techniques to complete this process. Which one of the following is NOT a tool or technique that is appropriate for the quantitative risk analysis process?

Accepted Answer

A)  Quantitative risk analysis and modeling techniques 
B)  Data gathering and representation techniques 
C)  Expert judgment 
D)  Organizational process assets 
A)  Quantitative risk analysis and modeling techniques 
B)  Data gathering and representation techniques 
C)  Expert judgment 
D)  Organizational process assets

Question 15

In which of the following Risk Management Framework (RMF) phases is strategic risk assessment planning performed?

Accepted Answer

A)  Phase 0 
B)  Phase 1 
C)  Phase 2 
D)  Phase 3 
A)  Phase 0 
B)  Phase 1 
C)  Phase 2 
D)  Phase 3

Question 16

Which of the following refers to a process that is used for implementing information security?

Accepted Answer

A)  Certification and Accreditation (C&
A)  
B)  Information Assurance (I
A)  
C)  Five Pillars model 
D)  Classic information security model 
A)  Certification and Accreditation (C&
A)  
B)  Information Assurance (I
A)  
C)  Five Pillars model 
D)  Classic information security model

Question 17

Which of the following is used throughout the entire C&A process?

Accepted Answer

A)  DAA 
B)  DITSCAP 
C)  SSAA 
D)  DIACAP 
A)  DAA 
B)  DITSCAP 
C)  SSAA 
D)  DIACAP

Question 18

Which of the following evidences are the collection of facts that, when considered together, can be used to infer a conclusion about the malicious activity/person?

Accepted Answer

A)  Circumstantial 
B)  Incontrovertible 
C)  Direct 
D)  Corroborating 
A)  Circumstantial 
B)  Incontrovertible 
C)  Direct 
D)  Corroborating

Question 19

Which of the following is used in the practice of Information Assurance (IA) to define assurance requirements?

Accepted Answer

A)  Classic information security model 
B)  Communications Management Plan 
C)  Five Pillars model 
D)  Parkerian Hexad 
A)  Classic information security model 
B)  Communications Management Plan 
C)  Five Pillars model 
D)  Parkerian Hexad

Question 20

You work as the project manager for Bluewell Inc. There has been a delay in your project work that is adversely affecting the project schedule. You decide, with your stakeholders' approval, to fast track the project work to get the project done faster. When you fast track the project, what is likely to increase?

Accepted Answer

A)  Human resource needs 
B)  Risks 
C)  Costs 
D)  Quality control concerns 
A)  Human resource needs 
B)  Risks 
C)  Costs 
D)  Quality control concerns

Which of the following RMF phases is known as risk analysis?

Which of the following is a standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system?

Which of the following objectives are defined by integrity in the C.I.A triad of information security systems? Each correct answer represents a part of the solution. Choose three.

Information risk management (IRM) is the process of identifying and assessing risk, reducing it to an acceptable level, and implementing the right mechanisms to maintain that level. What are the different categories of risk? Each correct answer represents a complete solution. Choose all that apply.

Which of the following individuals informs all C&A participants about life cycle actions, security requirements, and documented user needs?

Which of the following individuals is responsible for the final accreditation decision?

A ________ points to a statement in a policy or procedure that helps determine a course of action.

Which of the following processes has the goal to ensure that any change does not lead to reduced or compromised security?

Which of the following describes residual risk as the risk remaining after risk mitigation has occurred?

Which of the following formulas was developed by FIPS 199 for categorization of an information system?

In which of the following Risk Management Framework (RMF) phases is strategic risk assessment planning performed?

Which of the following refers to a process that is used for implementing information security?

Which of the following is used throughout the entire C&A process?

Which of the following evidences are the collection of facts that, when considered together, can be used to infer a conclusion about the malicious activity/person?

Which of the following is used in the practice of Information Assurance (IA) to define assurance requirements?

Certified Cloud Security Professional (CCSP)

Certified Information Systems Security Professional

Filters

Exam 1: Certified Authorization Professional

Which of the following RMF phases is known as risk analysis?

Which of the following is a standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system?

Which of the following objectives are defined by integrity in the C.I.A triad of information security systems? Each correct answer represents a part of the solution. Choose three.

Information risk management (IRM) is the process of identifying and assessing risk, reducing it to an acceptable level, and implementing the right mechanisms to maintain that level. What are the different categories of risk? Each correct answer represents a complete solution. Choose all that apply.

Which of the following individuals informs all C&A participants about life cycle actions, security requirements, and documented user needs?

Which of the following individuals is responsible for the final accreditation decision?

A ________ points to a statement in a policy or procedure that helps determine a course of action.

Which of the following processes has the goal to ensure that any change does not lead to reduced or compromised security?

Which of the following describes residual risk as the risk remaining after risk mitigation has occurred?

Which of the following formulas was developed by FIPS 199 for categorization of an information system?

In which of the following Risk Management Framework (RMF) phases is strategic risk assessment planning performed?

Which of the following refers to a process that is used for implementing information security?

Which of the following is used throughout the entire C&A process?

Which of the following evidences are the collection of facts that, when considered together, can be used to infer a conclusion about the malicious activity/person?

Which of the following is used in the practice of Information Assurance (IA) to define assurance requirements?

Certified Cloud Security Professional (CCSP)

Certified Information Systems Security Professional

Filters