The Chief Information Officer (CIO), or Information Technology (IT) director, is a job title commonly given to the most senior executive in an enterprise. What are the responsibilities of a Chief Information Officer?Each correct answer represents a complete solution. Choose all that apply.

Preserving high-level communications and working group relationships in an organization

Establishing effective continuous monitoring program for the organization

Proposing the information technology needed by an enterprise to achieve its goals and then working within a budget to implement the plan

Preserving high-level communications and working group relationships in an organization

Facilitating the sharing of security risk-related information among authorizing officials

Establishing effective continuous monitoring program for the organization

Proposing the information technology needed by an enterprise to achieve its goals and then working within a budget to implement the plan

The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statements are true about ISSO and ISSE?Each correct answer represents a complete solution. Choose all that apply.

An ISSE provides advice on the impacts of system changes.

An ISSO manages the security of the information system that is slated for Certification & Accreditation (C&A).

An ISSE provides advice on the continuous monitoring of the information system.

An ISSE provides advice on the impacts of system changes.

An ISSE manages the security of the information system that is slated for Certification & Accreditation (C&A).

An ISSO manages the security of the information system that is slated for Certification & Accreditation (C&A).

An ISSO takes part in the development activities that are required to implement system changes.

An ISSE provides advice on the continuous monitoring of the information system.

Which of the following professionals is responsible for starting the Certification & Accreditation (C&A) process?

Chief Information Officer (CIO)

Certification and Accreditation (C&A or CnA) is a process for implementing information security. Which of the following is the correct order of C&A phases in aDITSCAP assessment?

Definition, Verification, Validation, and Post Accreditation

Definition, Validation, Verification, and Post Accreditation

Verification, Definition, Validation, and Post Accreditation

Verification, Validation, Definition, and Post Accreditation

Definition, Verification, Validation, and Post Accreditation

Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation. Which of the following statements are true about Certification and Accreditation?Each correct answer represents a complete solution. Choose two.

Accreditation is the official management decision given by a senior agency official to authorize operation of an information system.

Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system.

Accreditation is the official management decision given by a senior agency official to authorize operation of an information system.

Accreditation is a comprehensive assessment of the management, operational, and technical security controls in an information system.

Certification is the official management decision given by a senior agency official to authorize operation of an information system.

Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system.

Which of the following requires all general support systems and major applications to be fully certified and accredited before these systems and applications are put into production?Each correct answer represents a part of the solution. Choose all that apply.

Office of Management and Budget (OMB)

According to U.S. Department of Defense (DoD) Instruction 8500.2, there are eight Information Assurance (IA) areas, and the controls are referred to as IA controls. Which of the following are among the eight areas of IA defined by DoD? Each correct answer represents a complete solution. Choose all that apply.

VI Vulnerability and Incident Management

DC Security Design & Configuration

EC Enclave and Computing Environment

VI Vulnerability and Incident Management

DC Security Design & Configuration

EC Enclave and Computing Environment

Information systems acquisition, development, and maintenance

Ben is the project manager of the YHT Project for his company. Alice, one of his team members, is confused about when project risks will happen in the project.Which one of the following statements is the most accurate about when project risk happens?

Project risk is always in the future.

Project risk can happen at any moment.

Project risk is uncertain, so no one can predict when the event will happen.

Project risk happens throughout the project execution.

Project risk is always in the future.

You are the project manager of the NKJ Project for your company. The project's success or failure will have a significant impact on your organization's profitability for the coming year. Management has asked you to identify the risk events and communicate the event's probability and impact as early as possible in the project. Management wants to avoid risk events and needs to analyze the cost-benefits of each risk event in this project. What term is assigned to the low-level of stakeholder tolerance in this project?

Mitigation-ready project management

Where can a project manager find risk-rating rules?

Risk probability and impact matrix

Enterprise environmental factors

There are five inputs to the quantitative risk analysis process. Which one of the following is NOT an input to the perform quantitative risk analysis process?

Enterprise environmental factors

Which of the following professionals is responsible for starting the Certification & Accreditation (C&A) process?

Chief Information Officer (CIO)

The phase 3 of the Risk Management Framework (RMF) process is known as mitigation planning.Which of the following processes take place in phase 3?Each correct answer represents a complete solution. Choose all that apply.

Document and implement a mitigation plan.

Agree on a strategy to mitigate risks.

Evaluate mitigation progress and plan next assessment.

Identify threats, vulnerabilities, and controls that will be evaluated.

Document and implement a mitigation plan.

Agree on a strategy to mitigate risks.

Evaluate mitigation progress and plan next assessment.

Gary is the project manager of his organization. He is managing a project that is similar to a project his organization completed recently. Gary has decided that he will use the information from the past project to help him and the project team to identify the risks that may be present in the project. Management agrees that this checklist approach is ideal and will save time in the project. Which of the following statement is most accurate about the limitations of the checklist analysis approach for Gary?

The checklist analysis approach is fast but it is impossible to build and exhaustive checklist.

The checklist analysis approach only uses qualitative analysis.

The checklist analysis approach saves time, but can cost more.

The checklist is also known as top down risk assessment

What are the subordinate tasks of the Initiate and Plan IA C&A phase of the DIACAP process?Each correct answer represents a complete solution. Choose all that apply.

Initiate IA implementation plan.

Register system with DoD Component IA Program.

Initiate IA implementation plan.

Register system with DoD Component IA Program.

Neil works as a project manager for SoftTech Inc. He is working with Tom, the COO of his company, on several risks within the project. Tom understands that through qualitative analysis Neil has identified many risks in the project. Tom's concern, however, is that the priority list of these risk events are sorted in "high-risk," "moderate-risk," and "low-risk" as conditions apply within the project. Tom wants to know that is there any other objective on which Neil can make the priority list for project risks. What will be Neil's reply to Tom?

Risks may be listed by priority separately for schedule, cost, and performance

Risk may be listed by the responses in the near-term

Risks may be listed by categories

Risks may be listed by the additional analysis and response

Risks may be listed by priority separately for schedule, cost, and performance

You and your project team are identifying the risks that may exist within your project. Some of the risks are small risks that won't affect your project much if they happen. What should you do with these identified risk events?

These risks can be added to a low priority risk watch list.

All risks must have a valid, documented risk response.

Which of the following is an entry in an object's discretionary access control list (DACL) that grants permissions to a user or group?

Discretionary access control entry (DACE)

Management wants you to create a visual diagram of what resources will be utilized in the project deliverables. What type of a chart is management asking you to create?

Roles and responsibility matrix

ISC CAP Practice Test 1 - Free Online Exam Prep & Questions

Which of the following professionals plays the role of a monitor and takes part in the organization's configuration management process?

Senior Agency Information Security Officer

Authorizing Official

Common Control Provider

Chief Information Officer

Comment (0)

ISC CAP Practice Test 1

Question

ISC CAP Practice Tests

Practice Tests