You are the project manager of the GHG project. You are preparing for the quantitative risk analysis process. You are using organizational process assets to help you complete the quantitative risk analysis process. Which one of the following is NOT a valid reason to utilize organizational process assets as a part of the quantitative risk analysis process?

You will use organizational process assets to determine costs of all risks events within the current project.

You will use organizational process assets for studies of similar projects by risk specialists.

You will use organizational process assets to determine costs of all risks events within the current project.

You will use organizational process assets for information from prior similar projects.

You will use organizational process assets for risk databases that may be available from industry sources.

Which of the following statements is true about residual risks?

It is the probabilistic risk after implementing all security measures.

It is a weakness or lack of safeguard that can be exploited by a threat.

It can be considered as an indicator of threats coupled with vulnerability.

It is the probabilistic risk after implementing all security measures.

It is the probabilistic risk before implementing all security measures.

Mary is the project manager of the HGH Project for her company. She and her project team have agreed that if the vendor is late by more than ten days they will cancel the order and hire the NBG Company to fulfill the order. The NBG Company can guarantee orders within three days, but the costs of their products are significantly more expensive than the current vendor. What type of a response strategy is this?

Internal risk management strategy

According to U.S. Department of Defense (DoD) Instruction 8500.2, there are eight Information Assurance (IA) areas, and the controls are referred to as IA controls. Which of the following are among the eight areas of IA defined by DoD? Each correct answer represents a complete solution. Choose all that apply.

DC Security Design & Configuration

VI Vulnerability and Incident Management

EC Enclave and Computing Environment

DC Security Design & Configuration

VI Vulnerability and Incident Management

EC Enclave and Computing Environment

Information systems acquisition, development, and maintenance

Which of the following is an Information Assurance (IA) model that protects and defends information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation?

Capability Maturity Model (CMM)

Classic information security model

The Phase 2 of DITSCAP C&A is known as Verification. The goal of this phase is to obtain a fully integrated system for certification testing and accreditation.What are the process activities of this phase?Each correct answer represents a complete solution. Choose all that apply.

Assessment of the Analysis Results

Configuring refinement of the SSAA

Assessment of the Analysis Results

Configuring refinement of the SSAA

ISO 17799 has two parts. The first part is an implementation guide with guidelines on how to build a comprehensive information security infrastructure and the second part is an auditing guide based on requirements that must be met for an organization to be deemed compliant with ISO 17799. What are the ISO 17799 domains?Each correct answer represents a complete solution. Choose all that apply.

Information security policy for the organization

System development and maintenance

Information security policy for the organization

System development and maintenance

Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation. Which of the following statements are true about Certification and Accreditation?Each correct answer represents a complete solution. Choose two.

Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system.

Accreditation is the official management decision given by a senior agency official to authorize operation of an information system.

Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system.

Accreditation is a comprehensive assessment of the management, operational, and technical security controls in an information system.

Certification is the official management decision given by a senior agency official to authorize operation of an information system.

Accreditation is the official management decision given by a senior agency official to authorize operation of an information system.

Amy is the project manager for her company. In her current project the organization has a very low tolerance for risk events that will affect the project schedule.Management has asked Amy to consider the affect of all the risks on the project schedule. What approach can Amy take to create a bias against risks that will affect the schedule of the project?

She can create an overall project rating scheme to reflect the bias towards risks that affect the project schedule.

She can have the project team pad their time estimates to alleviate delays in the project schedule.

She can shift risk-laden activities that affect the project schedule from the critical path as much as possible.

She can create an overall project rating scheme to reflect the bias towards risks that affect the project schedule.

She can filter all risks based on their affect on schedule versus other project objectives.

Joan is a project management consultant and she has been hired by a firm to help them identify risk events within the project. Joan would first like to examine the project documents including the plans, assumptions lists, project files, and contracts. What key thing will help Joan to discover risks within the review of the project documents?

Lack of consistency between the plans and the project requirements and assumptions can be the indicators of risk in the project.

The project documents will help the project manager, or Joan, to identify what risk identification approach is best to pursue.

Plans that have loose definitions of terms and disconnected approaches will reveal risks.

Poorly written requirements will reveal inconsistencies in the project plans and documents.

You and your project team are just starting the risk identification activities for a project that is scheduled to last for 18 months. Your project team has already identified a long list of risks that need to be analyzed. How often should you and the project team do risk identification?

Identify risks is an iterative process.

Several times until the project moves into execution

It depends on how many risks are initially identified.

Identify risks is an iterative process.

Which of the following documents were developed by NIST for conducting Certification & Accreditation (C&A)? Each correct answer represents a complete solution. Choose all that apply.

NIST Special Publication 800-53A

NIST Special Publication 800-59

NIST Special Publication 800-53

NIST Special Publication 800-37

NIST Special Publication 800-60

NIST Special Publication 800-53A

NIST Special Publication 800-37A

NIST Special Publication 800-59

NIST Special Publication 800-53

NIST Special Publication 800-37

NIST Special Publication 800-60

Gary is the project manager for his project. He and the project team have completed the qualitative risk analysis process and are about to enter the quantitative risk analysis process when Mary, the project sponsor, wants to know what quantitative risk analysis will review. Which of the following statements best defines what quantitative risk analysis will review?

The quantitative risk analysis process will analyze the effect of risk events that may substantially impact the project's competing demands.

The quantitative risk analysis reviews the results of risk identification and prepares the project for risk response management.

The quantitative risk analysis process will review risk events for their probability and impact on the project objectives.

The quantitative risk analysis seeks to determine the true cost of each identified risk event and the probability of each risk event to determine the risk exposure.

Which of the following is NOT a responsibility of a data owner?

Maintaining and protecting data

Ensuring that the necessary security controls are in place

Delegating responsibility of the day-to-day maintenance of the data protection mechanisms to the data custodian

Walter is the project manager of a large construction project. He'll be working with several vendors on the project. Vendors will be providing materials and labor for several parts of the project. Some of the works in the project are very dangerous so Walter has implemented safety requirements for all of the vendors and his own project team. Stakeholders for the project have added new requirements, which have caused new risks in the project. A vendor has identified a new risk that could affect the project if it comes into fruition. Walter agrees with the vendor and has updated the risk register and created potential risk responses to mitigate the risk. What should Walter also update in this scenario considering the risk event?

Project contractual relationship with the vendor

Penetration testing (also called pen testing) is the practice of testing a computer system, network, or Web application to find vulnerabilities that an attacker could exploit. Which of the following areas can be exploited in a penetration test? Each correct answer represents a complete solution. Choose all that apply.

Information system architectures

ISC CAP Practice Test 4 - Free Online Exam Prep & Questions

Which of the following are the goals of risk management?

Each correct answer represents a complete solution. Choose three.

Finding an economic balance between the impact of the risk and the cost of the countermeasure

Identifying the risk

Assessing the impact of potential threats

Identifying the accused

Comment (0)

ISC CAP Practice Test 4

Question

ISC CAP Practice Tests

Practice Tests