Question 1

In which type of access control do user ID and password system come under?

Accepted Answer

User ID and password systems are a form of technical access control, as they involve the use of technology to restrict access to systems and data.

Question 2

Which of the following parts of BS 7799 covers risk analysis and management?

Accepted Answer

Part 3 of BS 7799 covers risk analysis and management, providing guidelines for information security risk management.

Question 3

Which of the following are included in Technical Controls? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

Technical controls involve mechanisms and tools that enforce security policies, including access control, password management, infrastructure configuration, identification and authentication methods, and security devices. Security-awareness training is not a technical control; it is an administrative control.

Question 4

Henry is the project manager of the QBG Project for his company. This project has a budget of $4,576,900 and is expected to last 18 months to complete. The CIO, a stakeholder in the project, has introduced a scope change request for additional deliverables as part of the project work. What component of the change control system would review the proposed changes' impact on the features and functions of the project's product?

Accepted Answer

The configuration management system is responsible for reviewing changes to the features and functions of the project's product, ensuring that all changes are documented and controlled.

Question 5

Mary is the project manager of the HGH Project for her company. She and her project team have agreed that if the vendor is late by more than ten days they will cancel the order and hire the NBG Company to fulfill the order. The NBG Company can guarantee orders within three days, but the costs of their products are significantly more expensive than the current vendor. What type of a response strategy is this?

Accepted Answer

This is a contingent response strategy because it involves a predefined action plan (hiring NBG Company) that will be executed if a specific risk event (vendor being late by more than ten days) occurs.

Question 6

Which of the following NIST Special Publication documents provides a guideline on questionnaires and checklists through which systems can be evaluated for compliance against specific control objectives?

Accepted Answer

The answer of Which of the following NIST Special Publication...

Question 7

The Phase 1 of DITSCAP C&A is known as Definition Phase. The goal of this phase is to define the C&A level of effort, identify the main C&A roles and responsibilities, and create an agreement on the method for implementing the security requirements. What are the process activities of this phase? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

The process activities of the Definition Phase in DITSCAP include Registration, Documenting mission need, and Negotiation. These activities help in defining the scope and requirements for the C&A process.

Question 8

The only output of the perform qualitative risk analysis are risk register updates. When the project manager updates the risk register he will need to include several pieces of information including all of the following except for which one?

Accepted Answer

The risk probability-impact matrix is a tool used during the qualitative risk analysis process, but it is not an update to the risk register itself. The risk register updates include trends, watchlists, and categorization of risks.

Question 9

Shoulder surfing is a type of in-person attack in which the attacker gathers information about the premises of an organization. This attack is often performed by looking surreptitiously at the keyboard of an employee's computer while he is typing in his password at any access point such as a terminal/Web site. Which of the following is violated in a shoulder surfing attack?

Accepted Answer

Shoulder surfing violates confidentiality because it involves unauthorized access to sensitive information, such as passwords, by observing someone entering them.

Question 10

Which of the following formulas was developed by FIPS 199 for categorization of an information system?

Accepted Answer

FIPS 199 defines the security categorization of an information system based on the potential impact on confidentiality, integrity, and availability, all of which are assessed for impact.

Question 11

Fred is the project manager of the PKL project. He is working with his project team to complete the quantitative risk analysis process as a part of risk management planning. Fred understands that once the quantitative risk analysis process is complete, the process will need to be completed again in at least two other times in the project. When will the quantitative risk analysis process need to be repeated?

Accepted Answer

The answer of Fred is the project manager of the...

Question 12

Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation. Which of the following statements are true about Certification and Accreditation? Each correct answer represents a complete solution. Choose two.

Accepted Answer

Accreditation is the official management decision to authorize system operation, while certification involves assessing security controls.

Question 13

The Project Risk Management knowledge area focuses on which of the following processes? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

The answer of The Project Risk Management knowledge area focuses...

Question 14

Which of the following individuals informs all C&A participants about life cycle actions, security requirements, and documented user needs?

Accepted Answer

The IS program manager is responsible for informing all participants about life cycle actions, security requirements, and documented user needs in the context of Certification and Accreditation (C&A) processes.

Question 15

Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation. Which of the following statements are true about Certification and Accreditation? Each correct answer represents a complete solution. Choose two.

Accepted Answer

Accreditation is the official management decision to authorize system operation, while certification involves assessing security controls.

Question 16

Which of the following administrative policy controls requires individuals or organizations to be engaged in good business practices relative to the organization's industry?

Accepted Answer

Due care refers to the obligation of individuals or organizations to engage in good business practices and act responsibly within their industry to prevent harm or legal issues.

Question 17

You and your project team are just starting the risk identification activities for a project that is scheduled to last for 18 months. Your project team has already identified a long list of risks that need to be analyzed. How often should you and the project team do risk identification?

Accepted Answer

Risk identification is an iterative process that should be conducted throughout the project lifecycle to ensure new risks are identified and managed as the project progresses.

Question 18

You are the project manager for your organization. You have identified a risk event you're your organization could manage internally or externally. If you manage the event internally it will cost your project $578,000 and an additional $12,000 per month the solution is in use. A vendor can manage the risk event for you. The vendor will charge $550,000 and $14,500 per month that the solution is in use. How many months will you need to use the solution to pay for the internal solution in comparison to the vendor's solution?

Accepted Answer

To find the breakeven point, set the costs equal: $578,000 + $12,000x = $550,000 + $14,500x. Solving for x gives approximately 11 months.

Question 19

You work as a project manager for BlueWell Inc. You are working with Nancy, the COO of your company, on several risks within the project. Nancy understands that through qualitative analysis you have identified 80 risks that have a low probability and low impact as the project is currently planned. Nancy's concern, however, is that the impact and probability of these risk events may change as conditions within the project may change. She would like to know where will you document and record these 80 risks that have low probability and low impact for future reference. What should you tell Nancy?

Accepted Answer

Risks with low probability and low impact are typically recorded in a watchlist for future monitoring to ensure they are reassessed if project conditions change.

Question 20

In which of the following testing methodologies do assessors use all available documentation and work under no constraints, and attempt to circumvent the security features of an information system?

Accepted Answer

A penetration test involves assessors using all available documentation and working without constraints to try to bypass the security features of an information system.

Exam 1: Certified Authorization Professional