Which of the following statements about Discretionary Access Control List (DACL) is true?

It is a list containing user accounts, groups, and computers that are allowed (or denied) access to the object.

It is a rule list containing access control entries.

It specifies whether an audit activity should be performed when an object attempts to access a resource.

It is a unique number that identifies a user, group, and computer account.

It is a list containing user accounts, groups, and computers that are allowed (or denied) access to the object.

Which types of project tends to have more well-understood risks?

State-of-art technology projects

First-of-its kind technology projects

The Information System Security Officer (ISSO) and Information System Security Engineer (ISSE) play the role of a supporter and advisor, respectively. Which of the following statements are true about ISSO and ISSE?Each correct answer represents a complete solution. Choose all that apply.

An ISSO manages the security of the information system that is slated for Certification & Accreditation (C&A).

An ISSE provides advice on the continuous monitoring of the information system.

An ISSE provides advice on the impacts of system changes.

An ISSO manages the security of the information system that is slated for Certification & Accreditation (C&A).

An ISSE manages the security of the information system that is slated for Certification & Accreditation (C&A).

An ISSE provides advice on the continuous monitoring of the information system.

An ISSO takes part in the development activities that are required to implement system ch anges.

An ISSE provides advice on the impacts of system changes.

Which of the following processes is described in the statement below?"This is the process of numerically analyzing the effect of identified risks on overall project objectives."

Perform Quantitative Risk Analysis

Perform Qualitative Risk Analysis

The Chief Information Officer (CIO), or Information Technology (IT) director, is a job title commonly given to the most senior executive in an enterprise. What are the responsibilities of a Chief Information Officer?Each correct answer represents a complete solution. Choose all that apply.

Proposing the information technology needed by an enterprise to achieve its goals and then working within a budget to implement the plan

Preserving high-level communications and working group relationships in an organization

Establishing effective continuous monitoring program for the organization

Proposing the information technology needed by an enterprise to achieve its goals and then working within a budget to implement the plan

Preserving high-level communications and working group relationships in an organization

Establishing effective continuous monitoring program for the organization

Facilitating the sharing of security risk-related information among authorizing officials

Eric is the project manager of the NQQ Project and has hired the ZAS Corporation to complete part of the project work for Eric's organization. Due to a change request the ZAS Corporation is no longer needed on the project even though they have completed nearly all of the project work. Is Eric's organization liable to pay the ZAS Corporation for the work they have completed so far on the project?

It depends on what the termination clause of the contract stipulates.

It depends on what the outcome of a lawsuit will determine.

No, the ZAS Corporation did not complete all of the work.

It depends on what the termination clause of the contract stipulates.

Yes, the ZAS Corporation did not choose to terminate the contract work.

Mark works as a project manager for TechSoft Inc. Mark, the project team, and the key project stakeholders have completed a round of qualitative risk analysis.He needs to update the risk register with his findings so that he can communicate the risk results to the project stakeholders - including management. Mark will need to update all of the following information except for which one?

Prioritized list of quantified risks

Watchlist of low-priority risks

Prioritized list of quantified risks

Trends in qualitative risk analysis

Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. Which of the following are the U.S. Federal Government information security standards? Each correct answer represents a complete solution. Choose all that apply.

SA System and Services Acquisition

CA Certification, Accreditation, and Security Assessments

SA System and Services Acquisition

CA Certification, Accreditation, and Security Assessments

Information systems acquisition, development, and maintenance

Which of the following tasks are identified by the Plan of Action and Milestones document? Each correct answer represents a complete solution. Choose all that apply.

The resources needed to accomplish the elements of the plan

Any milestones that are needed in meeting the tasks

The tasks that are required to be accomplished

Scheduled completion dates for the milestones

The plans that need to be implemented

The resources needed to accomplish the elements of the plan

Any milestones that are needed in meeting the tasks

The tasks that are required to be accomplished

Scheduled completion dates for the milestones

Jenny is the project manager for the NBT projects. She is working with the project team and several subject matter experts to perform the quantitative risk analysis process. During this process she and the project team uncover several risks events that were not previously identified. What should Jenny do with these risk events?

The events should be entered into the risk register.

The events should be determined if they need to be accepted or responded to.

The events should be entered into qualitative risk analysis.

The events should continue on with quantitative risk analysis.

The events should be entered into the risk register.

You are the project manager of the BlueStar project in your company. Your company is structured as a functional organization and you report to the functional manager that you are ready to move onto the qualitative risk analysis process. What will you need as inputs for the qualitative risk analysis of the project in this scenario?

You will need the risk register, risk management plan, project scope statement, and any relevant organizational process assets.

You will need the risk register, risk management plan, outputs of qualitative risk analysis, and any relevant organizational process assets.

You will need the risk register, risk management plan, permission from the functional manager, and any relevant organizational process assets.

Qualitative risk analysis does not happen through the project manager in a functional struc ture.

Henry is the project manager of the QBG Project for his company. This project has a budget of $4,576,900 and is expected to last 18 months to complete. The CIO, a stakeholder in the project, has introduced a scope change request for additional deliverables as part of the project work. What component of the change control system would review the proposed changes' impact on the features and functions of the project's product?

Configuration management system

Security Test and Evaluation (ST&E) is a component of risk assessment. It is useful in discovering system vulnerabilities. For what purposes is ST&E used?Each correct answer represents a complete solution. Choose all that apply.

To determine the adequacy of security mechanisms, assurances, and other properties to enforce the security policy

To assess the degree of consistency between the system documentation and its implement ation

To uncover design, implementation, and operational flaws that may allow the violation of security policy

To implement the design of system architecture

To determine the adequacy of security mechanisms, assurances, and other properties to enforce the security policy

To assess the degree of consistency between the system documentation and its implement ation

To uncover design, implementation, and operational flaws that may allow the violation of security policy

Which of the following are the goals of risk management?Each correct answer represents a complete solution. Choose three.

Finding an economic balance between the impact of the risk and the cost of the counterme asure

Assessing the impact of potential threats

Finding an economic balance between the impact of the risk and the cost of the counterme asure

Assessing the impact of potential threats

Elizabeth is a project manager for her organization and she finds risk management to be very difficult for her to manage. She asks you, a lead project manager, at what stage in the project will risk management become easier. What answer best resolves the difficulty of risk management practices and the effort required?

Risk management only becomes easier the more often it is practiced.

Risk management is an iterative process and never becomes easier.

Risk management only becomes easier when the project moves into project execution.

Risk management only becomes easier when the project is closed.

You work as a project manager for BlueWell Inc. You with your team are using a method or a (technical) process that conceives the risks even if all theoretically possible safety measures would be applied. One of your team member wants to know that what is a residual risk. What will you reply to your team member?

It is a risk that remains after planned risk responses are taken.

It is a risk that remains because no risk response is taken.

It is a risk that remains after planned risk responses are taken.

It is a risk that can not be addressed by a risk response.

It is a risk that will remain no matter what type of risk response is offered.

You are the project manager for your organization. You are preparing for the quantitative risk analysis. Mark, a project team member, wants to know why you need to do quantitative risk analysis when you just completed qualitative risk analysis. Which one of the following statements best defines what quantitative risk analysis is?

Quantitative risk analysis is the process of numerically analyzing the effect of identified risks on overall project objectives.

Quantitative risk analysis is the planning and quantification of risk responses based on probability and impact of each risk event.

Quantitative risk analysis is the process of prioritizing risks for further analysis or action by assessing and combining their probability of occurrence and impact.

Quantitative risk analysis is the review of the risk events with the high probability and the highest impact on the project objectives.

Quantitative risk analysis is the process of numerically analyzing the effect of identified risks on overall project objectives.

Fred is the project manager of the CPS project. He is working with his project team to prioritize the identified risks within the CPS project. He and the team are prioritizing risks for further analysis or action by assessing and combining the risks probability of occurrence and impact. What process is Fred completing?

Risk Breakdown Structure creation

Ned is the project manager of the HNN project for your company. Ned has asked you to help him complete some probability distributions for his project. What portion of the project will you most likely use for probability distributions?

Uncertainty in values such as duration of schedule activities

Bias towards risk in new resources

Risk probability and impact matrixes

Which of the following statements about the authentication concept of information security management is true?

It establishes the users' identity and ensures that the users are who they say they are.

It determines the actions and behaviors of a single individual within a system, and identifies that particular individual.

It ensures that modifications are not made to data by unauthorized personnel or processes .

It establishes the users' identity and ensures that the users are who they say they are.

It ensures the reliable and timely access to resources.

You and your project team have identified the project risks and now are analyzing the probability and impact of the risks. What type of analysis of the risks provides a quick and high-level review of each identified risk event?

A risk probability-impact matrix

What are the responsibilities of a system owner?Each correct answer represents a complete solution. Choose all that apply.

Integrates security considerations into application and system purchasing decisions and development projects.

Ensures that the systems are properly assessed for vulnerabilities and must report any to the incident response team and data owner.

Ensures that adequate security is being provided by the necessary controls, password management, remote access controls, operating system configurations, and so on.

Integrates security considerations into application and system purchasing decisions and development projects.

Ensures that the systems are properly assessed for vulnerabilities and must report any to the incident response team and data owner.

Ensures that adequate security is being provided by the necessary controls, password management, remote access controls, operating system configurations, and so on.

Ensures that the necessary security controls are in place.

During which of the following processes, probability and impact matrix is prepared?

Perform Qualitative Risk Analysis

Perform Quantitative Risk Analysis

Perform Qualitative Risk Analysis

Certification and Accreditation (C&A or CnA) is a process for implementing information security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation. Which of the following statements are true about Certification and Accreditation?Each correct answer represents a complete solution. Choose two.

Accreditation is the official management decision given by a senior agency official to authorize operation of an information system.

Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system.

Accreditation is the official management decision given by a senior agency official to authorize operation of an information system.

Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system.

Accreditation is a comprehensive assessment of the management, operational, and technical security controls in an information system.

Certification is the official management decision given by a senior agency official to authorize operation of an information system.

ISC CAP Practice Test 8 - Free Online Exam Prep & Questions

In 2003, NIST developed a new Certification & Accreditation (C&A) guideline known as FIPS 199.

What levels of potential impact are defined by FIPS 199?

Each correct answer represents a complete solution. Choose all that apply.

Become a Premium Member for full access

Unlock Premium Member

ISC CAP Practice Test 8

Question

ISC CAP Practice Tests

Practice Tests