Question 1

In which of the following phases of the DITSCAP process does Security Test and Evaluation (ST&E) occur?

Accepted Answer

A)  Phase 2 
B)  Phase 3 
C)  Phase 1 
D)  Phase 4 
A)  Phase 2 
B)  Phase 3 
C)  Phase 1 
D)  Phase 4

Question 2

Which of the following NIST documents defines impact?

Accepted Answer

A)  NIST SP 800-53 
B)  NIST SP 800-26 
C)  NIST SP 800-30 
D)  NIST SP 800-53A 
A)  NIST SP 800-53 
B)  NIST SP 800-26 
C)  NIST SP 800-30 
D)  NIST SP 800-53A

Question 3

According to FIPS Publication 199, what are the three levels of potential impact on organizations in the event of a compromise on confidentiality, integrity, and availability?

Accepted Answer

A)  Confidential, Secret, and High 
B)  Minimum, Moderate, and High 
C)  Low, Normal, and High 
D)  Low, Moderate, and High 
A)  Confidential, Secret, and High 
B)  Minimum, Moderate, and High 
C)  Low, Normal, and High 
D)  Low, Moderate, and High

Question 4

You are the project manager of the NHQ project for your company. Management has told you that you must implement an agreed upon contingency response if the Cost Performance Index in your project is less than 0.90. Consider that your project has a budget at completion of $250,000 and is 60 percent complete. You are scheduled to be however, 75 percent complete, and you have spent $165,000 to date. What is the Cost Performance Index for this project to determine if the contingency response should happen?

Accepted Answer

A)  0.88 
B)  0.80 
C)  -$37,500 
D)  0.91 
A)  0.88 
B)  0.80 
C)  -$37,500 
D)  0.91

Question 5

Certification and Accreditation (C&A or CnA) is a process for implementing information security. Which of the following is the correct order of C&A phases in a DITSCAP assessment?

Accepted Answer

A)  Definition, Validation, Verification, and Post Accreditation 
B)  Verification, Definition, Validation, and Post Accreditation 
C)  Verification, Validation, Definition, and Post Accreditation 
D)  Definition, Verification, Validation, and Post Accreditation 
A)  Definition, Validation, Verification, and Post Accreditation 
B)  Verification, Definition, Validation, and Post Accreditation 
C)  Verification, Validation, Definition, and Post Accreditation 
D)  Definition, Verification, Validation, and Post Accreditation

Question 6

Fred is the project manager of the CPS project. He is working with his project team to prioritize the identified risks within the CPS project. He and the team are prioritizing risks for further analysis or action by assessing and combining the risks probability of occurrence and impact. What process is Fred completing?

Accepted Answer

A)  Risk identification 
B)  Perform qualitative analysis 
C)  Perform quantitative analysis 
D)  Risk Breakdown Structure creation 
A)  Risk identification 
B)  Perform qualitative analysis 
C)  Perform quantitative analysis 
D)  Risk Breakdown Structure creation

Question 7

Billy is the project manager of the HAR Project and is in month six of the project. The project is scheduled to last for 18 months. Management asks Billy how often the project team is participating in risk reassessment in this project. What should Billy tell management if he's following the best practices for risk management?

Accepted Answer

A)  At every status meeting the project team project risk management is an agenda item. 
B)  Project risk management happens at every milestone. 
C)  Project risk management has been concluded with the project planning. 
D)  Project risk management is scheduled for every month in the 18-month project. 
A)  At every status meeting the project team project risk management is an agenda item. 
B)  Project risk management happens at every milestone. 
C)  Project risk management has been concluded with the project planning. 
D)  Project risk management is scheduled for every month in the 18-month project.

Question 8

The phase 3 of the Risk Management Framework (RMF) process is known as mitigation planning. Which of the following processes take place in phase 3? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

A)  Identify threats, vulnerabilities, and controls that will be evaluated. 
B)  Document and implement a mitigation plan. 
C)  Agree on a strategy to mitigate risks. 
D)  Evaluate mitigation progress and plan next assessment. 
A)  Identify threats, vulnerabilities, and controls that will be evaluated. 
B)  Document and implement a mitigation plan. 
C)  Agree on a strategy to mitigate risks. 
D)  Evaluate mitigation progress and plan next assessment.

Question 9

In which of the following DIACAP phases is residual risk analyzed?

Accepted Answer

A)  Phase 2 
B)  Phase 4 
C)  Phase 5 
D)  Phase 3 
E)  Phase 1 
A)  Phase 2 
B)  Phase 4 
C)  Phase 5 
D)  Phase 3 
E)  Phase 1

Question 10

You work as a project manager for BlueWell Inc. Management has asked you to work with the key project stakeholder to analyze the risk events you have identified in the project. They would like you to analyze the project risks with a goal of improving the project's performance as a whole. What approach can you use to achieve the goal of improving the project's performance through risk analysis with your project stakeholders?

Accepted Answer

A)  Involve subject matter experts in the risk analysis activities 
B)  Focus on the high-priority risks through qualitative risk analysis 
C)  Use qualitative risk analysis to quickly assess the probability and impact of risk events 
D)  Involve the stakeholders for risk identification only in the phases where the project directly affects them 
A)  Involve subject matter experts in the risk analysis activities 
B)  Focus on the high-priority risks through qualitative risk analysis 
C)  Use qualitative risk analysis to quickly assess the probability and impact of risk events 
D)  Involve the stakeholders for risk identification only in the phases where the project directly affects them

Question 11

Penetration testing (also called pen testing) is the practice of testing a computer system, network, or Web application to find vulnerabilities that an attacker could exploit. Which of the following areas can be exploited in a penetration test? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

A)  Race conditions 
B)  Social engineering 
C)  Information system architectures 
D)  Buffer overflows 
E)  Kernel flaws
F) Trojan horses
G) File and directory permissions 
A)  Race conditions 
B)  Social engineering 
C)  Information system architectures 
D)  Buffer overflows 
E)  Kernel flaws
F) Trojan horses
G) File and directory permissions

Question 12

According to U.S. Department of Defense (DoD) Instruction 8500.2, there are eight Information Assurance (IA) areas, and the controls are referred to as IA controls. Which of the following are among the eight areas of IA defined by DoD? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

A)  DC Security Design & Configuration 
B)  VI Vulnerability and Incident Management 
C)  EC Enclave and Computing Environment 
D)  Information systems acquisition, development, and maintenance 
A)  DC Security Design & Configuration 
B)  VI Vulnerability and Incident Management 
C)  EC Enclave and Computing Environment 
D)  Information systems acquisition, development, and maintenance

Question 13

Your organization has a project that is expected to last 20 months but the customer would really like the project completed in 18 months. You have worked on similar projects in the past and believe that you could fast track the project and reach the 18 month deadline. What increases when you fast track a project?

Accepted Answer

A)  Risks 
B)  Costs 
C)  Resources 
D)  Communication 
A)  Risks 
B)  Costs 
C)  Resources 
D)  Communication

Question 14

The IAM/CA makes certification accreditation recommendations to the DAA. The DAA issues accreditation determinations. Which of the following are the accreditation determinations issued by the DAA? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

A)  IATO 
B)  ATO 
C)  IATT 
D)  ATT 
E)  DATO 
A)  IATO 
B)  ATO 
C)  IATT 
D)  ATT 
E)  DATO

Question 15

Which types of project tends to have more well-understood risks?

Accepted Answer

A)  State-of-art technology projects 
B)  Recurrent projects 
C)  Operational work projects 
D)  First-of-its kind technology projects 
A)  State-of-art technology projects 
B)  Recurrent projects 
C)  Operational work projects 
D)  First-of-its kind technology projects

Question 16

Information Security management is a process of defining the security controls in order to protect information assets. The first action of a management program to implement information security is to have a security program in place. What are the objectives of a security program? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

A)  Security organization 
B)  System classification 
C)  Information classification 
D)  Security education 
A)  Security organization 
B)  System classification 
C)  Information classification 
D)  Security education

Question 17

Tom is the project manager for his organization. In his project he has recently finished the risk response planning. He tells his manager that he will now need to update the cost and schedule baselines. Why would the risk response planning cause Tom the need to update the cost and schedule baselines?

Accepted Answer

A)  New or omitted work as part of a risk response can cause changes to the cost and/or schedule baseline. 
B)  Risk responses protect the time and investment of the project. 
C)  Baselines should not be updated, but refined through versions. 
D)  Risk responses may take time and money to implement. 
A)  New or omitted work as part of a risk response can cause changes to the cost and/or schedule baseline. 
B)  Risk responses protect the time and investment of the project. 
C)  Baselines should not be updated, but refined through versions. 
D)  Risk responses may take time and money to implement.

Question 18

Harry is a project manager of a software development project. In the early stages of planning, he and the stakeholders operated with the belief that the software they were developing would work with their organization's current computer operating system. Now that the project team has started developing the software it has become apparent that the software will not work with nearly half of the organization's computer operating systems. The incorrect belief Harry had in the software compatibility is an example of what in project management?

Accepted Answer

A)  Issue 
B)  Risk 
C)  Constraint 
D)  Assumption 
A)  Issue 
B)  Risk 
C)  Constraint 
D)  Assumption

Question 19

Which of the following assessment methods involves observing or conducting the operation of physical devices?

Accepted Answer

A)  Interview 
B)  Deviation 
C)  Examination 
D)  Testing 
A)  Interview 
B)  Deviation 
C)  Examination 
D)  Testing

Question 20

Which of the following are the objectives of the security certification documentation task? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

A)  To prepare the Plan of Action and Milestones (POAM) based on the security assessment 
B)  To provide the certification findings and recommendations to the information system owner 
C)  To assemble the final security accreditation package and then submit it to the authorizing o fficial 
D)  To update the system security plan based on the results of the security assessment 
E)  None of the above 
A)  To prepare the Plan of Action and Milestones (POAM) based on the security assessment 
B)  To provide the certification findings and recommendations to the information system owner 
C)  To assemble the final security accreditation package and then submit it to the authorizing o fficial 
D)  To update the system security plan based on the results of the security assessment 
E)  None of the above

In which of the following phases of the DITSCAP process does Security Test and Evaluation (ST&E) occur?

Which of the following NIST documents defines impact?

According to FIPS Publication 199, what are the three levels of potential impact on organizations in the event of a compromise on confidentiality, integrity, and availability?

Certification and Accreditation (C&A or CnA) is a process for implementing information security. Which of the following is the correct order of C&A phases in a DITSCAP assessment?

The phase 3 of the Risk Management Framework (RMF) process is known as mitigation planning. Which of the following processes take place in phase 3? Each correct answer represents a complete solution. Choose all that apply.

In which of the following DIACAP phases is residual risk analyzed?

The IAM/CA makes certification accreditation recommendations to the DAA. The DAA issues accreditation determinations. Which of the following are the accreditation determinations issued by the DAA? Each correct answer represents a complete solution. Choose all that apply.

Which types of project tends to have more well-understood risks?

Which of the following assessment methods involves observing or conducting the operation of physical devices?

Which of the following are the objectives of the security certification documentation task? Each correct answer represents a complete solution. Choose all that apply.

Certified Cloud Security Professional (CCSP)

Certified Information Systems Security Professional

Filters

Exam 1: Certified Authorization Professional

In which of the following phases of the DITSCAP process does Security Test and Evaluation (ST&E) occur?

Which of the following NIST documents defines impact?

According to FIPS Publication 199, what are the three levels of potential impact on organizations in the event of a compromise on confidentiality, integrity, and availability?

Certification and Accreditation (C&A or CnA) is a process for implementing information security. Which of the following is the correct order of C&A phases in a DITSCAP assessment?

The phase 3 of the Risk Management Framework (RMF) process is known as mitigation planning. Which of the following processes take place in phase 3? Each correct answer represents a complete solution. Choose all that apply.

In which of the following DIACAP phases is residual risk analyzed?

The IAM/CA makes certification accreditation recommendations to the DAA. The DAA issues accreditation determinations. Which of the following are the accreditation determinations issued by the DAA? Each correct answer represents a complete solution. Choose all that apply.

Which types of project tends to have more well-understood risks?

Which of the following assessment methods involves observing or conducting the operation of physical devices?

Which of the following are the objectives of the security certification documentation task? Each correct answer represents a complete solution. Choose all that apply.

Certified Cloud Security Professional (CCSP)

Certified Information Systems Security Professional

Filters