Which of the following relations correctly describes total risk?

Total Risk = Threats x Vulnerability x Asset Value

Total Risk = Viruses x Vulnerability x Asset Value

Total Risk = Threats x Exploit x Asset Value

Total Risk = Viruses x Exploit x Asset Value

Which of the following are the types of assessment tests addressed in NIST SP 800-53A?

Functional, structural, penetration

Functional, penetration, validation

Validation, evaluation, penetration

Validation, penetration, evaluation

Functional, structural, penetration

Tom is the project manager for his organization. In his project he has recently finished the risk response planning. He tells his manager that he will now need to update the cost and schedule baselines. Why would the risk response planning cause Tom the need to update the cost and schedule baselines?

New or omitted work as part of a risk response can cause changes to the cost and/or schedule baseline.

Risk responses protect the time and investment of the project.

Risk responses may take time and money to implement.

Baselines should not be updated, but refined through versions.

Management wants you to create a visual diagram of what resources will be utilized in the project deliverables. What type of a chart is management asking you to create?

Roles and responsibility matrix

Eric is the project manager of the NQQ Project and has hired the ZAS Corporation to complete part of the project work for Eric's organization. Due to a change request the ZAS Corporation is no longer needed on the project even though they have completed nearly all of the project work. Is Eric's organization liable to pay the ZAS Corporation for the work they have completed so far on the project?

It depends on what the termination clause of the contract stipulates

No, the ZAS Corporation did not complete all of the work.

Yes, the ZAS Corporation did not choose to terminate the contract work.

It depends on what the outcome of a lawsuit will determine.

It depends on what the termination clause of the contract stipulates

Which of the following processes is described in the statement below?"It is the process of implementing risk response plans, tracking identified risks, monitoring residual risk, identifying new risks, and evaluating risk process effectiveness throughout the project."

Perform Quantitative Risk Analysis

Perform Qualitative Risk Analysis

The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statements are true about ISSO and ISSE?Each correct answer represents a complete solution. Choose all that apply.

An ISSE provides advice on the continuous monitoring of the information system.

An ISSE provides advice on the impacts of system changes.

An ISSO manages the security of the information system that is slated for Certification & Accreditation (C&A).

An ISSE manages the security of the information system that is slated for Certification & Accreditation (C&A).

An ISSO takes part in the development activities that are required to implement system ch anges.

An ISSE provides advice on the continuous monitoring of the information system.

An ISSE provides advice on the impacts of system changes.

An ISSO manages the security of the information system that is slated for Certification & Accreditation (C&A).

Which one of the following is the only output for the qualitative risk analysis process?

Enterprise environmental factors

Walter is the project manager of a large construction project. He'll be working with several vendors on the project. Vendors will be providing materials and labor for several parts of the project. Some of the works in the project are very dangerous so Walter has implemented safety requirements for all of the vendors and his own project team. Stakeholders for the project have added new requirements, which have caused new risks in the project. A vendor has identified a new risk that could affect the project if it comes into fruition. Walter agrees with the vendor and has updated the risk register and created potential risk responses to mitigate the risk. What should Walter also update in this scenario considering the risk event?

Project contractual relationship with the vendor

During which of the following processes, probability and impact matrix is prepared?

Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Perform Qualitative Risk Analysis

Which of the following statements about Discretionary Access Control List (DACL) is true?

It is a list containing user accounts, groups, and computers that are allowed (or denied) access to the object.

It is a rule list containing access control entries.

It specifies whether an audit activity should be performed when an object attempts to access a resource.

It is a list containing user accounts, groups, and computers that are allowed (or denied) access to the object.

It is a unique number that identifies a user, group, and computer account

Which of the following statements correctly describes DIACAP residual risk?

It is the remaining risk to the information system after risk palliation has occurred.

It is a process of security authorization.

It is the technical implementation of the security design.

It is used to validate the information system.

ISC CAP Practice Test 10 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

ISC CAP Practice Test 10

Question

ISC CAP Practice Tests

Practice Tests