Penetration testing (also called pen testing) is the practice of testing a computer system, network, or Web application to find vulnerabilities that an attacker could exploit. Which of the following areas can be exploited in a penetration test? Each correct answer represents a complete solution. Choose all that apply.

Information system architectures

You are the project manager of the NHH project for your company. You have completed the first round of risk management planning and have created four outputs of the risk response planning process. Which one of the following is NOT an output of the risk response planning?

Organizational process assets updates

Risk-related contract decisions

Organizational process assets updates

Thomas is a key stakeholder in your project. Thomas has requested several changes to the project scope for the project you are managing. Upon review of the proposed changes, you have discovered that these new requirements are laden with risks and you recommend to the change control board that the changes be excluded from the project scope. The change control board agrees with you. What component of the change control system communicates the approval or denial of a proposed change request?

Configuration management system

Gary is the project manager for his project. He and the project team have completed the qualitative risk analysis process and are about to enter the quantitative risk analysis process when Mary, the project sponsor, wants to know what quantitative risk analysis will review. Which of the following statements best defines what quantitative risk analysis will review?

The quantitative risk analysis process will analyze the effect of risk events that may substantially impact the project's competing demands.

The quantitative risk analysis seeks to determine the true cost of each identified risk event and the probability of each risk event to determine the risk exposure.

The quantitative risk analysis process will review risk events for their probability and impact on the project objectives.

The quantitative risk analysis reviews the results of risk identification and prepares the project for risk response management.

The quantitative risk analysis process will analyze the effect of risk events that may substantially impact the project's competing demands.

Amy is the project manager for her company. In her current project the organization has a very low tolerance for risk events that will affect the project schedule.Management has asked Amy to consider the affect of all the risks on the project schedule. What approach can Amy take to create a bias against risks that will affect the schedule of the project?

She can create an overall project rating scheme to reflect the bias towards risks that affect the project schedule.

She can have the project team pad their time estimates to alleviate delays in the project schedule.

She can create an overall project rating scheme to reflect the bias towards risks that affect the project schedule.

She can filter all risks based on their affect on schedule versus other project objectives.

She can shift risk-laden activities that affect the project schedule from the critical path as much as possible.

Jenny is the project manager of the NHJ Project for her company. She has identified several positive risk events within the project and she thinks these events can save the project time and money. You, a new team member wants to know that how many risk responses are available for a positive risk event. What willJenny reply to you?

Acceptance is the only risk response for positive risk events.

Which of the following roles is responsible for review and risk analysis of all contracts on a regular basis?

The IT Service Continuity Manager

You are the project manager for the NHH project. You are working with your project team to examine the project from four different defined perspectives to increase the breadth of identified risks by including internally generated risks. What risk identification approach are you using in this example?

Influence diagramming techniques

Which of the following are included in Physical Controls?Each correct answer represents a complete solution. Choose all that apply.

Locking systems and removing unnecessary floppy or CD-ROM drives

Controlling individual access into the facility and different departments

Locking systems and removing unnecessary floppy or CD-ROM drives

Password and resource management

Identification and authentication methods

Controlling individual access into the facility and different departments

Which one of the following is the only output for the qualitative risk analysis process?

Enterprise environmental factors

You are the project manager of the GHG project. You are preparing for the quantitative risk analysis process. You are using organizational process assets to help you complete the quantitative risk analysis process. Which one of the following is NOT a valid reason to utilize organizational process assets as a part of the quantitative risk analysis process?

You will use organizational process assets to determine costs of all risks events within the current project.

You will use organizational process assets for risk databases that may be available from industry sources.

You will use organizational process assets for studies of similar projects by risk specialists.

You will use organizational process assets to determine costs of all risks events within the current project.

You will use organizational process assets for information from prior similar projects.

Which of the following objectives are defined by integrity in the C.I.A triad of information security systems? Each correct answer represents a part of the solution.Choose three.

It preserves the internal and external consistency of information.

It prevents the unauthorized or unintentional modification of information by the authorized users.

It prevents the modification of information by the unauthorized users.

It preserves the internal and external consistency of information.

It prevents the unauthorized or unintentional modification of information by the authorized users.

It prevents the modification of information by the unauthorized users.

It prevents the intentional or unintentional unauthorized disclosure of a message's contents .

You and your project team are just starting the risk identification activities for a project that is scheduled to last for 18 months. Your project team has already identified a long list of risks that need to be analyzed. How often should you and the project team do risk identification?

Identify risks is an iterative process.

It depends on how many risks are initially identified.

Several times until the project moves into execution

Fred is the project manager of the PKL project. He is working with his project team to complete the quantitative risk analysis process as a part of risk management planning. Fred understands that once the quantitative risk analysis process is complete, the process will need to be completed again in at least two other times in the project. When will the quantitative risk analysis process need to be repeated?

Quantitative risk analysis process will be completed again after the risk response planning and as a part of monitoring and controlling.

Quantitative risk analysis process will be completed again after the plan risk response planning and as part of procurement.

Quantitative risk analysis process will be completed again after the cost management planning and as a part of monitoring and controlling.

Quantitative risk analysis process will be completed again after new risks are identified and as part of monitoring and controlling.

Quantitative risk analysis process will be completed again after the risk response planning and as a part of monitoring and controlling.

Which of the following are included in Administrative Controls?Each correct answer represents a complete solution. Choose all that apply.

Conducting security-awareness training

Implementing change control procedures

Conducting security-awareness training

Implementing change control procedures

The Phase 2 of DITSCAP C&A is known as Verification. The goal of this phase is to obtain a fully integrated system for certification testing and accreditation.What are the process activities of this phase?Each correct answer represents a complete solution. Choose all that apply.

Configuring refinement of the SSAA

Assessment of the Analysis Results

Configuring refinement of the SSAA

Assessment of the Analysis Results

ISC CAP Practice Test 2 - Free Online Exam Prep & Questions

Question 1 / 40

You are preparing to start the qualitative risk analysis process for your project. You will be relying on some organizational process assets to influence the process. Which one of the following is NOT a probable reason for relying on organizational process assets as an input for qualitative risk analysis?

Information on prior, similar projects

Review of vendor contracts to examine risks in past projects

Risk databases that may be available from industry sources

Studies of similar projects by risk specialists

Comment (0)

ISC CAP Practice Test 2

Question

ISC CAP Practice Tests

Practice Tests