You are the project manager of the GHY project for your organization. You are about to start the qualitative risk analysis process for the project and you need to determine the roles and responsibilities for conducting risk management. Where can you find this information?

Enterprise environmental factors

You are the project manager of the GGH Project in your company. Your company is structured as a functional organization and you report to the functional manager that you are ready to move onto the quantitative risk analysis process. What things will you need as inputs for the quantitative risk analysis of the project in this scenario?

You will need the risk register, risk management plan, cost management plan, schedule management plan, and any relevant organizational process assets.

You will need the risk register, risk management plan, permission from the functional manager, and any relevant organizational process assets.

You will need the risk register, risk management plan, outputs of qualitative risk analysis, and any relevant organizational process assets.

You will need the risk register, risk management plan, cost management plan, schedule management plan, and any relevant organizational process assets.

Quantitative risk analysis does not happen through the project manager in a functional stru cture.

Which of the following professionals plays the role of a monitor and takes part in the organization's configuration management process?

Senior Agency Information Security Officer

Which of the following statements are true about security risks?Each correct answer represents a complete solution. Choose three.

They can be analyzed and measured by the risk analysis process.

They can be mitigated by reviewing and taking responsible actions based on possible risks.

They are considered an indicator of threats coupled with vulnerability.

They can be removed completely by taking proper actions.

They can be analyzed and measured by the risk analysis process.

They can be mitigated by reviewing and taking responsible actions based on possible risks.

They are considered an indicator of threats coupled with vulnerability.

Which of the following governance bodies directs and coordinates implementations of the information security program?

Chief Information Security Officer

Information Security Steering Committee

Chief Information Security Officer

What are the subordinate tasks of the Implement and Validate Assigned IA Controlphase in the DIACAP process? Each correct answer represents a complete solution. Choose all that apply.

Execute and update IA implementation plan.

Combine validation results in DIACAP scorecard.

Conduct activities related to the disposition of the system data and objects.

Execute and update IA implementation plan.

Combine validation results in DIACAP scorecard.

The phase 0 of Risk Management Framework (RMF) is known as strategic risk assessment planning. Which of the following processes take place in phase 0?Each correct answer represents a complete solution. Choose all that apply.

Apply classification criteria to rank data assets and related IT resources.

Establish criteria that will be used to classify and rank data assets.

Identify threats, vulnerabilities, and controls that will be evaluated.

Establish criteria that will be used to evaluate threats, vulnerabilities, and controls.

Review documentation and technical data.

Apply classification criteria to rank data assets and related IT resources.

Establish criteria that will be used to classify and rank data assets.

Identify threats, vulnerabilities, and controls that will be evaluated.

Establish criteria that will be used to evaluate threats, vulnerabilities, and controls.

Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?

Annualized Rate of Occurrence (ARO)

You are the project manager of the NNQ Project for your company and are working you're your project team to define contingency plans for the risks within your project. Mary, one of your project team members, asks what a contingency plan is. Which of the following statements best defines what a contingency response is?

Some responses are designed for use only if certain events occur.

Some responses have a cost and a time factor to consider for each risk event.

Some responses must counteract pending risk events.

Quantified risks should always have contingency responses.

Who is responsible for the stakeholder expectations management in a high-profile, high-risk project?

Project risk assessment officer

Which of the following requires all general support systems and major applications to be fully certified and accredited before these systems and applications are put into production?Each correct answer represents a part of the solution. Choose all that apply.

Office of Management and Budget (OMB)

Which of the following refers to a process that is used for implementing information security?

Certification and Accreditation (C&A)

Classic information security model

Your project team has identified a project risk that must be responded to. The risk has been recorded in the risk register and the project team has been discussing potential risk responses for the risk event. The event is not likely to happen for several months but the probability of the event is high. Which one of the following is a valid response to the identified risk event?

Technical performance measurement

Joan is a project management consultant and she has been hired by a firm to help them identify risk events within the project. Joan would first like to examine the project documents including the plans, assumptions lists, project files, and contracts. What key thing will help Joan to discover risks within the review of the project documents?

Lack of consistency between the plans and the project requirements and assumptions can be the indicators of risk in the project.

The project documents will help the project manager, or Joan, to identify what risk identification approach is best to pursue.

Plans that have loose definitions of terms and disconnected approaches will reveal risks.

Poorly written requirements will reveal inconsistencies in the project plans and documents.

Lack of consistency between the plans and the project requirements and assumptions can be the indicators of risk in the project.

Which of the following statements about the availability concept of Information security management is true?

It ensures reliable and timely access to resources.

It ensures that modifications are not made to data by unauthorized personnel or processes .

It ensures reliable and timely access to resources.

It determines actions and behaviors of a single individual within a system.

It ensures that unauthorized modifications are not made to data by authorized personnel or processes.

Which of the following are the objectives of the security certification documentation task? Each correct answer represents a complete solution. Choose all that apply.

To prepare the Plan of Action and Milestones (POAM) based on the security assessment

To provide the certification findings and recommendations to the information system owner

To assemble the final security accreditation package and then submit it to the authorizing o fficial

To update the system security plan based on the results of the security assessment

To prepare the Plan of Action and Milestones (POAM) based on the security assessment

To provide the certification findings and recommendations to the information system owner

To assemble the final security accreditation package and then submit it to the authorizing o fficial

To update the system security plan based on the results of the security assessment

Which of the following statements about System Access Control List (SACL) is true?

It contains a list of any events that are set to audit for that particular object.

It is a mechanism for reducing the need for globally unique IP addresses.

It contains a list of both users and groups and whatever permissions they have.

It exists for each and every permission entry assigned to any object.

You are preparing to complete the quantitative risk analysis process with your project team and several subject matter experts. You gather the necessary inputs including the project's cost management plan. Why is it necessary to include the project's cost management plan in the preparation for the quantitative risk analysis process?

The project's cost management plan provides control that may help determine the structure for quantitative analysis of the budget.

The project's cost management plan can help you to determine what the total cost of the project is allowed to be.

The project's cost management plan provides direction on how costs may be changed due to identified risks.

The project's cost management plan provides control that may help determine the structure for quantitative analysis of the budget.

The project's cost management plan is not an input to the quantitative risk analysis process .

Information Security management is a process of defining the security controls in order to protect information assets. What are the security management responsibilities?Each correct answer represents a complete solution. Choose all that apply.

Evaluating business objectives, security risks, user productivity, and functionality requirem ents

Determining actual goals that are expected to be accomplished from a security program

Defining steps to ensure that all the responsibilities are accounted for and properly address ed

Determining objectives, scope, policies, priorities, standards, and strategies

Evaluating business objectives, security risks, user productivity, and functionality requirem ents

Determining actual goals that are expected to be accomplished from a security program

Defining steps to ensure that all the responsibilities are accounted for and properly address ed

Determining objectives, scope, policies, priorities, standards, and strategies

Which of the following are included in Technical Controls?Each correct answer represents a complete solution. Choose all that apply.

Implementing and maintaining access control mechanisms

Password and resource management

Configuration of the infrastructure

Identification and authentication methods

Implementing and maintaining access control mechanisms

Password and resource management

Configuration of the infrastructure

Identification and authentication methods

Conducting security-awareness training

ISC CAP Practice Test 6 - Free Online Exam Questions 201-240

You are the project manager of the CUL project in your organization. You and the project team are assessing the risk events and creating a probability and impact matrix for the identified risks.

Which one of the following statements best describes the requirements for the data type used in qualitative risk analysis?

Become a Premium Member for full access

Unlock Premium Member

ISC CAP Practice Test 6

Question

ISC CAP Practice Tests

Practice Tests