Question 1

James work as an IT systems personnel in SoftTech Inc. He performs the following tasks: Runs regular backups and routine tests of the validity of the backup data. Performs data restoration from the backups whenever required. Maintains the retained records in accordance with the established information classification policy. What is the role played by James in the organization?

Accepted Answer

James is acting as a custodian because he is responsible for maintaining and protecting the data, ensuring backups are performed, and restoring data when necessary.

Question 2

Which of the following roles is also known as the accreditor?

Accepted Answer

The Designated Approving Authority (DAA) is also known as the accreditor, responsible for formally accepting the security posture of a system.

Question 3

Diana is the project manager of the QPS project for her company. In this project Diana and the project team have identified a pure risk. Diana and the project team decided, along with the key stakeholders, to remove the pure risk from the project by changing the project plan altogether. What is a pure risk?

Accepted Answer

A pure risk is a risk event that only has a negative side, such as loss of life or limb, and does not present any opportunity for gain.

Question 4

Which of the following NIST C&A documents is the guideline for identifying an information system as a National Security System?

Accepted Answer

NIST SP 800-59 provides guidelines for identifying an information system as a National Security System.

Question 5

Which types of project tends to have more well-understood risks?

Accepted Answer

Recurrent projects tend to have more well-understood risks because they have been done before, allowing for the identification and management of potential risks based on past experiences.

Question 6

Which of the following formulas was developed by FIPS 199 for categorization of an information type?

Accepted Answer

The answer of Which of the following formulas was developed...

Question 7

You are the project manager of the GHG project. You are preparing for the quantitative risk analysis process. You are using organizational process assets to help you complete the quantitative risk analysis process. Which one of the following is NOT a valid reason to utilize organizational process assets as a part of the quantitative risk analysis process?

Accepted Answer

Organizational process assets are not typically used to determine the costs of all risk events within the current project; they are more often used for historical information, lessons learned, and data from previous projects.

Question 8

The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statements are true about ISSO and ISSE? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

The answer of The Information System Security Officer (ISSO) and...

Question 9

Which of the following DITSCAP C&A phases takes place between the signing of the initial version of the SSAA and the formal accreditation of the system?

Accepted Answer

Phase 2 of the DITSCAP (DoD Information Technology Security Certification and Accreditation Process) involves the verification of the system's security posture and occurs between the signing of the initial version of the System Security Authorization Agreement (SSAA) and the formal accreditation of the system.

Question 10

There are five inputs to the quantitative risk analysis process. Which one of the following is NOT an input to the perform quantitative risk analysis process?

Accepted Answer

Enterprise environmental factors are not an input to the perform quantitative risk analysis process. The inputs typically include the risk register, cost management plan, risk management plan, and other relevant project documents.

Question 11

You work as a project manager for BlueWell Inc. You are about to complete the quantitative risk analysis process for your project. You can use three available tools and techniques to complete this process. Which one of the following is NOT a tool or technique that is appropriate for the quantitative risk analysis process?

Accepted Answer

Organizational process assets are not a tool or technique for quantitative risk analysis; they are inputs to many project management processes.

Question 12

Which of the following are included in Physical Controls? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

Physical controls include mechanisms like locking systems, environmental controls, monitoring for intrusion, and controlling access to facilities and departments to protect physical assets and environments.

Question 13

Walter is the project manager of a large construction project. He'll be working with several vendors on the project. Vendors will be providing materials and labor for several parts of the project. Some of the works in the project are very dangerous so Walter has implemented safety requirements for all of the vendors and his own project team. Stakeholders for the project have added new requirements, which have caused new risks in the project. A vendor has identified a new risk that could affect the project if it comes into fruition. Walter agrees with the vendor and has updated the risk register and created potential risk responses to mitigate the risk. What should Walter also update in this scenario considering the risk event?

Accepted Answer

Walter should update the project management plan to reflect the new risk and the potential risk responses, ensuring that all aspects of the project are aligned with the updated risk management strategy.

Question 14

Which of the following is NOT a responsibility of a data owner?

Accepted Answer

The answer of Which of the following is NOT a...

Question 15

What are the responsibilities of a system owner? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

The answer of What are the responsibilities of a system...

Question 16

You work as a project manager for BlueWell Inc. You are working with your team members on the risk responses in the project. Which risk response will likely cause a project to use the procurement processes?

Accepted Answer

Sharing a risk response often involves partnering with another party, which may require procurement processes to formalize the partnership or agreement.

Question 17

Which of the following are the objectives of the security certification documentation task? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

The objectives of the security certification documentation task include preparing the POAM, providing certification findings and recommendations, assembling the final security accreditation package, and updating the system security plan based on the security assessment results.

Question 18

Harry is the project manager of the MMQ Construction Project. In this project Harry has identified a supplier who can create stained glass windows for 1,000 window units in the construction project. The supplier is an artist who works by himself, but creates windows for several companies throughout the United States. Management reviews the proposal to use this supplier and while they agree that the supplier is talented, they do not think the artist can fulfill the 1,000 window units in time for the project's deadline. Management asked Harry to find a supplier who will guarantee the completion of the windows by the needed date in the schedule. What risk response has management asked Harry to implement?

Accepted Answer

The answer of Harry is the project manager of the...

Question 19

Which of the following statements about Discretionary Access Control List (DACL) is true?

Accepted Answer

The answer of Which of the following statements about Discretionary...

Question 20

What are the subordinate tasks of the Implement and Validate Assigned IA Control phase in the DIACAP process? Each correct answer represents a complete solution. Choose all that apply.

Accepted Answer

The subordinate tasks of the Implement and Validate Assigned IA Control phase in the DIACAP process include executing and updating the IA implementation plan, conducting validation activities, and combining validation results in the DIACAP scorecard.

Exam 1: Certified Authorization Professional