The Software Configuration Management (SCM) process defines the need to trace changes, and the ability to verify that the final delivered software has all of the planned enhancements that are supposed to be included in the release. What are the procedures that must be defined for each software project to ensure that a sound SCM process is implemented?Each correct answer represents a complete solution. Choose all that apply.

Configuration status accounting

Which of the following processes is described in the statement below?"It is the process of implementing risk response plans, tracking identified risks, monitoring residual risk, identifying new risks, and evaluating risk process effectiveness throughout the project."

Perform Quantitative Risk Analysis

Perform Qualitative Risk Analysis

You are the project manager of the GHY Project for your company. You have completed the risk response planning with your project team. You now need to update the WBS. Why would the project manager need to update the WBS after the risk response planning process? Choose the best answer.

Because of new work generated by the risk responses

Because of risks associated with work packages

Because of work that was omitted during the WBS creation

Because of risk responses that are now activities

Because of new work generated by the risk responses

BS 7799 is an internationally recognized ISM standard that provides high level, conceptual recommendations on enterprise security. BS 7799 is basically divided into three parts. Which of the following statements are true about BS 7799? Each correct answer represents a complete solution. Choose all that apply.

BS 7799 Part 2 was adopted by ISO as ISO/IEC 27001 in November 2005.

BS 7799 Part 1 was a standard originally published as BS 7799 by the British Standards Institute (BSI) in 1995.

BS 7799 Part 3 was published in 2005, covering risk analysis and management.

BS 7799 Part 1 was adopted by ISO as ISO/IEC 27001 in November 2005.

BS 7799 Part 2 was adopted by ISO as ISO/IEC 27001 in November 2005.

BS 7799 Part 1 was a standard originally published as BS 7799 by the British Standards Institute (BSI) in 1995.

BS 7799 Part 3 was published in 2005, covering risk analysis and management.

Gary is the project manager for his organization. He is working with the project stakeholders on the project requirements and how risks may affect their project.One of the stakeholders is confused about what constitutes risks in the project. Which of the following is the most accurate definition of a project risk?

It is an uncertain event that can affect at least one project objective.

It is an uncertain event that can affect the project costs.

It is an uncertain event or condition within the project execution.

It is an uncertain event that can affect at least one project objective.

It is an unknown event that can affect the project scope.

Diana is the project manager of the QPS project for her company. In this project Diana and the project team have identified a pure risk. Diana and the project team decided, along with the key stakeholders, to remove the pure risk from the project by changing the project plan altogether. What is a pure risk?

It is a risk event that only has a negative side, such as loss of life or limb.

It is a risk event that cannot be avoided because of the order of the work.

It is a risk event that is created by a risk response.

It is a risk event that is generated due to errors or omission in the project work.

You work as a project manager for BlueWell Inc. You are about to complete the quantitative risk analysis process for your project. You can use three available tools and techniques to complete this process. Which one of the following is NOT a tool or technique that is appropriate for the quantitative risk analysis process?

Quantitative risk analysis and modeling techniques

Data gathering and representation techniques

You work as a project manager for TechSoft Inc. You, the project team, and the key project stakeholders have completed a round of quantitative risk analysis.You now need to update the risk register with your findings so that you can communicate the risk results to the project stakeholders - including management. You will need to update all of the following information except for which one?

Risk distributions within the project schedule

Probability of achieving cost and time objectives

Risk distributions within the project schedule

Probabilistic analysis of the project

Trends in quantitative risk analysis

Lisa is the project manager of the SQL project for her company. She has completed the risk response planning with her project team and is now ready to update the risk register to reflect the risk response. Which of the following statements best describes the level of detail Lisa should include with the risk responses she has created?

The level of detail should correspond with the priority ranking

The level of detail is set by historical information.

The level of detail must define exactly the risk response for each identified risk.

The level of detail is set of project risk governance.

The level of detail should correspond with the priority ranking

David is the project manager of HGF project for his company. David, the project team, and several key stakeholders have completed risk identification and are ready to move into qualitative risk analysis. Tracy, a project team member, does not understand why they need to complete qualitative risk analysis. Which one of the following is the best explanation for completing qualitative risk analysis?

It is a rapid and cost-effective means of establishing priorities for the plan risk responses and lays the foundation for quantitative analysis.

It is a cost-effective means of establishing probability and impact for the project risks.

Qualitative risk analysis helps segment the project risks, create a risk breakdown structure, and create fast and accurate risk responses.

The Identify Risk process determines the risks that affect the project and document their characteristics. Why should the project team members be involved in the Identify Risk process?

They are the individuals that will need a sense of ownership and responsibility for the risk e vents.

They are the individuals that will have the best responses for identified risks events within the project.

They are the individuals that are most affected by the risk events.

They are the individuals that will need a sense of ownership and responsibility for the risk e vents.

They are the individuals that will most likely cause and respond to the risk events.

ISO 17799 has two parts. The first part is an implementation guide with guidelines on how to build a comprehensive information security infrastructure and the second part is an auditing guide based on requirements that must be met for an organization to be deemed compliant with ISO 17799. What are the ISO 17799 domains?Each correct answer represents a complete solution. Choose all that apply.

Information security policy for the organization

System development and maintenance

Information security policy for the organization

System development and maintenance

Sammy is the project manager for her organization. She would like to rate each risk based on its probability and affect on time, cost, and scope. Harry, a project team member, has never done this before and thinks Sammy is wrong to attempt this approach. Harry says that an accumulative risk score should be created, not three separate risk scores. Who is correct in this scenario?

Sammy is correct, because organizations can create risk scores for each objective of the pr oject.

Harry is correct, because the risk probability and impact considers all objectives of the proj ect.

Harry is correct, the risk probability and impact matrix is the only approach to risk assessm ent.

Sammy is correct, because she is the project manager.

Sammy is correct, because organizations can create risk scores for each objective of the pr oject.

Which of the following statements reflect the 'Code of Ethics Canons' in the '(ISC)2 Code of Ethics'? Each correct answer represents a complete solution.Choose all that apply.

Protect society, the commonwealth, and the infrastructure.

Act honorably, honestly, justly, responsibly, and legally.

Provide diligent and competent service to principals.

Protect society, the commonwealth, and the infrastructure.

Act honorably, honestly, justly, responsibly, and legally.

Provide diligent and competent service to principals.

Give guidance for resolving good versus good and bad versus bad dilemmas.

The Phase 3 of DITSCAP C&A is known as Validation. The goal of Phase 3 is to validate that the preceding work has produced an IS that operates in a specified computing environment. What are the process activities of this phase? Each correct answer represents a complete solution. Choose all that apply.

Perform certification evaluation of the integrated system

Certification and accreditation decision

Develop recommendation to the DAA

Continue to review and refine the SSAA

Perform certification evaluation of the integrated system

Certification and accreditation decision

Develop recommendation to the DAA

Continue to review and refine the SSAA

Your organization has named you the project manager of the JKN Project. This project has a BAC of $1,500,000 and it is expected to last 18 months.Management has agreed that if the schedule baseline has a variance of more than five percent then you will need to crash the project. What happens when the project manager crashes a project?

The amount of hours a resource can be used will diminish.

The project will take longer to complete, but risks will diminish.

Virginia is the project manager for her organization. She has hired a subject matter expert to interview the project stakeholders on certain identified risks within the project. The subject matter expert will assess the risk event with what specific goal in mind?

To determine the level of probability and impact for each risk event

To determine the bias of the risk event based on each person interviewed

To determine the probability and cost of the risk event

To determine the validity of each risk event

To determine the level of probability and impact for each risk event

ISC CAP Practice Test 7 - Free Online Exam Prep & Questions

Penetration tests are sometimes called white hat attacks because in a pen test, the good guys are attempting to break in. What are the different categories of penetration testing?

Each correct answer represents a complete solution. Choose all that apply.

Become a Premium Member for full access

Unlock Premium Member

ISC CAP Practice Test 7

Question

ISC CAP Practice Tests

Practice Tests