Question 1

In which of the following Risk Management Framework (RMF) phases is strategic risk assessment planning performed?

Accepted Answer

Strategic risk assessment planning is performed in Phase 0, which involves preparing for the RMF process by establishing a risk management strategy.

Question 2

Which of the following individuals is responsible for configuration management and control task?

Accepted Answer

The Information System Owner is responsible for the overall management and control of the information system, including configuration management and control tasks.

Question 3

Which of the following is NOT a type of penetration test?

Accepted Answer

A cursory test is not a recognized type of penetration test. The other options refer to different levels of knowledge the tester has about the system being tested.

Question 4

Sammy is the project manager for her organization. She would like to rate each risk based on its probability and affect on time, cost, and scope. Harry, a project team member, has never done this before and thinks Sammy is wrong to attempt this approach. Harry says that an accumulative risk score should be created, not three separate risk scores. Who is correct in this scenario?

Accepted Answer

Organizations can create separate risk scores for each project objective, such as time, cost, and scope, to better understand and manage the impact of risks on different aspects of the project.

Question 5

What does RTM stand for?

Accepted Answer

RTM stands for Requirements Traceability Matrix, which is a document used in project management to ensure that all requirements are linked to their corresponding deliverables.

Question 6

Which of the following are the tasks performed by the owner in the information classification schemes? Each correct answer represents a part of the solution. Choose three.

Accepted Answer

The owner is responsible for determining the classification level of information, reviewing and updating classifications as needed, and delegating data protection responsibilities to custodians.

Question 7

The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statements are true about ISSO and ISSE? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

An ISSO manages the security of the information system for C&A. An ISSE provides advice on continuous monitoring and the impacts of system changes.

Question 8

Which of the following individuals is responsible for the final accreditation decision?

Accepted Answer

The Information System Owner is typically responsible for the final accreditation decision, as they have the authority to accept the risk associated with operating the system.

Question 9

Which of the following professionals plays the role of a monitor and takes part in the organization's configuration management process?

Accepted Answer

A Common Control Provider is responsible for providing security controls that can be inherited by multiple information systems, and they play a role in monitoring and configuration management within an organization.

Question 10

Which of the following assessment methodologies defines a six-step technical security evaluation?

Accepted Answer

The answer of Which of the following assessment methodologies defines...

Question 11

Certification and Accreditation (C&A or CnA) is a process for implementing information security. Which of the following is the correct order of C&A phases in a DITSCAP assessment?

Accepted Answer

The answer of Certification and Accreditation (C&A or CnA) is...

Question 12

In which of the following phases do the system security plan update and the Plan of Action and Milestones (POAM) update take place?

Accepted Answer

The Continuous Monitoring Phase involves ongoing updates to the system security plan and the Plan of Action and Milestones (POAM) to ensure that security controls remain effective over time.

Question 13

FITSAF stands for Federal Information Technology Security Assessment Framework. It is a methodology for assessing the security of information systems. Which of the following FITSAF levels shows that the procedures and controls are tested and reviewed?

Accepted Answer

Level 4 in the FITSAF framework indicates that procedures and controls are tested and reviewed, ensuring that they are effective and functioning as intended.

Question 14

You are the project manager of the NHQ project for your company. Management has told you that you must implement an agreed upon contingency response if the Cost Performance Index in your project is less than 0.90. Consider that your project has a budget at completion of $250,000 and is 60 percent complete. You are scheduled to be however, 75 percent complete, and you have spent $165,000 to date. What is the Cost Performance Index for this project to determine if the contingency response should happen?

Accepted Answer

The answer of You are the project manager of the...

Question 15

You are the program manager for your project. You are working with the project managers regarding the procurement processes for their projects. You have ruled out one particular contract type because it is considered too risky for the program. Which one of the following contract types is usually considered to be the most dangerous for the buyer?

Accepted Answer

Cost plus percentage of costs contracts are considered most risky for the buyer because the seller is reimbursed for all costs plus a percentage of those costs, which can lead to increased costs without incentive for efficiency.

Question 16

Which of the following roles is used to ensure that the confidentiality, integrity, and availability of the services are maintained to the levels approved on the Service Level Agreement (SLA)?

Accepted Answer

The IT Security Manager is responsible for ensuring that the confidentiality, integrity, and availability of services are maintained according to the levels agreed upon in the Service Level Agreement (SLA).

Question 17

Kelly is the project manager of the BHH project for her organization. She is completing the risk identification process for this portion of her project. Which one of the following is the only thing that the risk identification process will create for Kelly?

Accepted Answer

The risk identification process results in the creation of the risk register, which is a document that lists all identified risks, their characteristics, and potential responses.

Question 18

You work as a project manager for BlueWell Inc. You are working on a project and the management wants a rapid and cost-effective means for establishing priorities for planning risk responses in your project. Which risk management process can satisfy management's objective for your project?

Accepted Answer

Qualitative risk analysis is a rapid and cost-effective method for prioritizing risks based on their probability and impact, which helps in planning risk responses efficiently.

Question 19

Walter is the project manager of a large construction project. He'll be working with several vendors on the project. Vendors will be providing materials and labor for several parts of the project. Some of the works in the project are very dangerous so Walter has implemented safety requirements for all of the vendors and his own project team. Stakeholders for the project have added new requirements, which have caused new risks in the project. A vendor has identified a new risk that could affect the project if it comes into fruition. Walter agrees with the vendor and has updated the risk register and created potential risk responses to mitigate the risk. What should Walter also update in this scenario considering the risk event?

Accepted Answer

Walter should update the project management plan to reflect the new risk and the planned responses, ensuring that all aspects of the project are aligned with the updated risk management strategy.

Question 20

Which of the following DoD directives is referred to as the Defense Automation Resources Management Manual ?

Accepted Answer

DoD 7950.1-M is known as the Defense Automation Resources Management Manual, which provides guidelines for managing automation resources within the Department of Defense.

Exam 1: Certified Authorization Professional