ISC2 Certified Authorization Professional (CAP) — Questions and Answers

Question 1: Which document in the authorization package describes known vulnerabilities and the schedule to fix them?

Authorization Decision Letter
System Security Plan
Security Assessment Report
Plan of Action and Milestones (Correct answer)

Correct answer: Plan of Action and Milestones

The Plan of Action and Milestones (POA&M) tracks identified weaknesses, responsible parties, resources needed, and target completion dates.

Question 2: Which section of the SSP typically describes how the system processes, stores, or transmits federal information?

Authorization Decision
System Description / Operational Environment (Correct answer)
POA&M Appendix
Control Implementation Summary

Correct answer: System Description / Operational Environment

The system description section explains the system's purpose, data flows, and operational context including what information it handles.

Question 3: What is the primary goal of tailoring baseline security controls in the RMF?

To adjust controls to the specific conditions, threat environment, and risk tolerance of the system (Correct answer)
To reduce the number of controls to the minimum possible
To align controls with vendor recommendations
To replace government controls with industry standards

Correct answer: To adjust controls to the specific conditions, threat environment, and risk tolerance of the system

Tailoring allows organizations to customize baseline controls to fit their specific operational environment, threat landscape, and risk posture.

Question 4: What must the POA&M include for each identified security weakness?

Only the vulnerability CVE number
Description of the weakness, responsible party, scheduled completion date, and resources needed (Correct answer)
A sign-off from the system owner
The name of the penetration tester who found it

Correct answer: Description of the weakness, responsible party, scheduled completion date, and resources needed

A complete POA&M entry includes what the weakness is, who owns remediation, when it will be fixed, and what resources are required.

Question 5: What role does the Information System Security Engineer (ISSE) play in security control implementation?

Making the final authorization decision for the information system
Providing technical expertise to ensure controls are properly engineered into the system (Correct answer)
Conducting the formal security assessment and producing the SAR
Approving and managing the Plan of Action and Milestones

Correct answer: Providing technical expertise to ensure controls are properly engineered into the system

The ISSE applies security engineering expertise to ensure that security controls and requirements are correctly designed and integrated into the system architecture and implementation.

Question 6: Control tailoring in NIST SP 800-53 allows organizations to do which of the following?

Ignore privacy controls
Add only compensating controls
Remove all baseline controls
Adjust baseline controls to meet specific operational needs (Correct answer)

Correct answer: Adjust baseline controls to meet specific operational needs

Tailoring lets organizations add, remove, or modify baseline controls to fit their unique environment and risk tolerance.

Question 7: What is the purpose of defining monitoring frequencies in a continuous monitoring strategy?

To comply with mandatory daily scanning requirements
To define the schedule for penetration tests only
To establish how often each control is assessed based on its volatility, importance, and available resources (Correct answer)
To set how many times per year the AO must review the system

Correct answer: To establish how often each control is assessed based on its volatility, importance, and available resources

Monitoring frequencies are tailored to each control based on how often it changes, its criticality, and the resources available to monitor it.

Question 8: What is the purpose of a System of Records Notice (SORN) in the federal authorization context?

To announce a new information system deployment to agency staff
To notify the public about a federal system that collects and maintains PII under the Privacy Act (Correct answer)
To document the system's network topology for the ATO package
To list authorized users of a classified system

Correct answer: To notify the public about a federal system that collects and maintains PII under the Privacy Act

A SORN is published in the Federal Register to inform the public about systems that collect and use personally identifiable information under the Privacy Act.

Question 9: Executive Order 14028, issued in May 2021, directed federal agencies to take which key action?

Transfer all systems to on-premises data centers
Reduce IT budgets by 10%
Improve the nation's cybersecurity through software supply chain security, zero trust, and enhanced incident reporting (Correct answer)
Eliminate use of commercial cloud services

Correct answer: Improve the nation's cybersecurity through software supply chain security, zero trust, and enhanced incident reporting

EO 14028 required federal agencies to modernize cybersecurity by adopting zero trust, improving software supply chain security, and enhancing incident logging.

Question 10: Which process ensures that security controls remain correctly configured as a system evolves and changes are introduced?

Business impact analysis
Risk assessment
Incident response
Configuration management (Correct answer)

Correct answer: Configuration management

Configuration management controls changes to system components and ensures that security controls remain properly implemented as the system evolves.

Question 11: What type of security control is implemented centrally by an organization and inherited by multiple information systems?

Common control (Correct answer)
Compensating control
Hybrid control
System-specific control

Correct answer: Common control

Common controls are security controls whose implementation results in a capability that is inherited by one or more organizational information systems.

Question 12: Which document should the system owner consult when determining information types for categorization?

NIST SP 800-60 Volume II (Correct answer)
FIPS 200
NIST SP 800-53 Appendix
OMB Circular A-130

Correct answer: NIST SP 800-60 Volume II

NIST SP 800-60 Volume II contains the tables that map federal information types to recommended security impact levels.

Question 13: Which federal agency is responsible for issuing FIPS publications that federal agencies must comply with?

CISA
NSA
NIST (Correct answer)
OMB

Correct answer: NIST

The National Institute of Standards and Technology (NIST) issues Federal Information Processing Standards (FIPS) publications.

Question 14: What NIST publication provides guidance on organizational risk management as the overarching context for the RMF?

NIST SP 800-37
NIST SP 800-39 (Correct answer)
NIST SP 800-30
NIST SP 800-53

Correct answer: NIST SP 800-39

NIST SP 800-39 addresses managing information security risk at the organization, mission/business, and information system tiers.

Question 15: Under FISMA, what annual requirement must federal agencies fulfill regarding their information security programs?

Replace all security tools
Submit an annual report to OMB and Congress on their security program status (Correct answer)
Conduct a full system re-authorization
Publish a public cybersecurity report

Correct answer: Submit an annual report to OMB and Congress on their security program status

FISMA requires federal agencies to report annually to OMB and Congress on the effectiveness of their information security programs.

Question 16: What is the primary goal of an Information Security Continuous Monitoring (ISCM) program?

To reduce the number of security staff required
To maintain ongoing awareness of information security, vulnerabilities, and threats (Correct answer)
To automate all security control implementation
To replace the need for ATOs entirely

Correct answer: To maintain ongoing awareness of information security, vulnerabilities, and threats

ISCM maintains situational awareness of the security posture so organizations can make risk-based decisions in a timely manner.

Question 17: Which NIST SP 800-53 control family covers configuration management?

CM (Correct answer)
AC
CA
CP

Correct answer: CM

The CM (Configuration Management) family includes controls for baseline configurations, change control, and software usage restrictions.

Question 18: What is the purpose of a Plan of Action and Milestones (POA&M) update in the continuous monitoring process?

To request additional budget for security tools
To terminate the ATO when a vulnerability is found
To replace the SAR after the initial assessment
To document newly identified weaknesses and track remediation progress over time (Correct answer)

Correct answer: To document newly identified weaknesses and track remediation progress over time

Regular POA&M updates during continuous monitoring ensure that newly found weaknesses are documented and remediation activities are tracked and reported.

Question 19: What should happen when continuous monitoring detects a significant security change to a system?

The system must be immediately shut down
The ISSO must notify the AO and update the SSP and risk assessment to reflect the new security posture (Correct answer)
The POA&M is automatically closed
The ATO period resets to three years automatically

Correct answer: The ISSO must notify the AO and update the SSP and risk assessment to reflect the new security posture

Significant changes detected during monitoring must be reported to the AO, and associated documentation must be updated to reflect the current risk posture.

Question 20: A system is categorized as SC = {Confidentiality: High, Integrity: Moderate, Availability: Low}. What is the overall system impact level?

High (Correct answer)
Critical
Moderate
Low

Correct answer: High

The overall system impact level is determined by the highest value across all three security objectives, which is High in this case.

Question 21: The CAP needs to communicate non-compliance findings from a recent internal audit to the leadership team. What is the best communication strategy?

Forward the raw audit data and let leadership interpret the results
Schedule a meeting but provide no prior documentation for review
Present a summary report highlighting key findings and recommended actions (Correct answer)
Only report findings related to high-priority issues

Correct answer: Present a summary report highlighting key findings and recommended actions

When communicating non-compliance findings to leadership, the most effective strategy is to provide a concise summary report. This report should clearly highlight the key findings, explain their significance, and, crucially, propose recommended actions or a corrective action plan. Leadership needs actionable insights, not raw data, to make informed decisions and support necessary improvements.

Question 22: Which of the following steps is critical when conducting a risk assessment as part of monitoring?

Prioritizing risks based on their likelihood and potential impact (Correct answer)
Focusing only on risks identified in the previous external audit
Delegating risk identification entirely to department heads
Addressing all potential risks equally, regardless of their severity

Correct answer: Prioritizing risks based on their likelihood and potential impact

A critical step in conducting a risk assessment is prioritizing identified risks. This involves evaluating each risk based on two key factors: its likelihood of occurring and its potential impact if it does occur. Prioritization allows the CAP to allocate resources effectively, focusing on mitigating the most significant threats first, rather than treating all risks equally.

Question 23: A Plan of Action and Milestones (POA&M) is used to track what?

Weaknesses and remediation plans for security controls (Correct answer)
Approved system features
Employee training records
System backup schedules

Correct answer: Weaknesses and remediation plans for security controls

The POA&M documents identified security weaknesses, responsible parties, and scheduled remediation milestones.

Question 24: During the accreditation preparation phase, the CAP receives conflicting feedback from different departments about their readiness. What is the CAP’s best approach to address this?

Organize a cross-departmental meeting to align on the preparation status (Correct answer)
Escalate the issue to senior leadership immediately
Focus only on departments reporting full readiness
Document the conflicts but take no further action until the audit

Correct answer: Organize a cross-departmental meeting to align on the preparation status

When faced with conflicting feedback on readiness from different departments, the CAP's best approach is to facilitate direct communication and alignment. Organizing a cross-departmental meeting allows departments to share their perspectives, identify common challenges, and collectively work towards a unified understanding of the preparation status. This collaborative effort helps resolve discrepancies and ensures everyone is on the same page for the upcoming audit.

Question 25: Vulnerability scanning in a continuous monitoring program is primarily used to identify what?

User behavior anomalies
Known software weaknesses, missing patches, and configuration errors (Correct answer)
Network bandwidth usage
Employee access patterns

Correct answer: Known software weaknesses, missing patches, and configuration errors

Automated vulnerability scans identify unpatched software, misconfigurations, and known exploitable weaknesses across the system.

Question 26: What is the CAP’s role in ensuring ongoing compliance with accreditation standards?

Waiting for the accrediting body to point out areas of non-compliance
Overseeing external audits and delegating all internal monitoring tasks
Conducting random audits without prior notice to staff
Regularly reviewing processes and implementing improvements as needed (Correct answer)

Correct answer: Regularly reviewing processes and implementing improvements as needed

A CAP's role in ensuring ongoing compliance is proactive and continuous. This involves regularly reviewing existing processes, procedures, and practices against current accreditation standards to identify any deviations or opportunities for enhancement. Implementing improvements as needed ensures that the organization not only meets but consistently maintains and often exceeds compliance requirements, fostering a culture of sustained quality.

Question 27: Which of the following best describes the primary purpose of conducting an internal audit as part of the CAP’s responsibilities?

To identify compliance gaps before the official audit (Correct answer)
To create a summary report for marketing purposes
To fulfill a mandatory requirement by the accrediting body
To test staff knowledge of accreditation standards

Correct answer: To identify compliance gaps before the official audit

The primary purpose of conducting an internal audit, as part of a CAP's responsibilities, is to proactively assess the organization's adherence to accreditation standards. By performing these internal checks, the CAP can identify any compliance gaps or areas of non-conformance before the official external audit. This allows the organization to implement necessary corrective actions, thereby improving readiness and increasing the chances of successful accreditation.

Question 28: What is the purpose of a hardware and software inventory in continuous monitoring?

To satisfy FedRAMP marketing requirements
To maintain an accurate record of system components to detect unauthorized assets (Correct answer)
To document financial depreciation
To assign user access rights

Correct answer: To maintain an accurate record of system components to detect unauthorized assets

Maintaining an accurate inventory is fundamental to continuous monitoring, enabling detection of unauthorized or unknown assets that pose security risks.

Question 29: What is a Security Information and Event Management (SIEM) system's primary role in continuous monitoring?

To aggregate, correlate, and analyze security event logs from across the enterprise in near real-time (Correct answer)
To serve as the primary vulnerability scanner
To replace firewalls with AI-driven packet inspection
To generate the System Security Plan automatically

Correct answer: To aggregate, correlate, and analyze security event logs from across the enterprise in near real-time

A SIEM collects logs from multiple sources, correlates events, and generates alerts to enable rapid detection of security incidents.

Question 30: A data flow diagram (DFD) in an SSP is used to illustrate what?

How data moves through the system, including inputs, outputs, and storage (Correct answer)
Security control gaps
Network topology only
User access permissions

Correct answer: How data moves through the system, including inputs, outputs, and storage

A DFD maps how data enters, travels through, is processed, and exits the information system, supporting privacy and security analysis.

Question 31: Which NIST publication provides the primary guidance for information security continuous monitoring (ISCM)?

NIST SP 800-137 (Correct answer)
NIST SP 800-30
NIST SP 800-53
NIST SP 800-37

Correct answer: NIST SP 800-137

NIST SP 800-137 provides guidance for developing a continuous monitoring strategy and program for federal information systems.

Question 32: The System Development Life Cycle (SDLC) is important in security because integrating security early follows which principle?

Defense in depth
Shift left / security by design (Correct answer)
Least privilege
Security by obscurity

Correct answer: Shift left / security by design

Integrating security requirements and controls from the earliest SDLC phases (shifting left) is more effective and less costly than retrofitting security later.

Question 33: Which regulation governs the security requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems?

FIPS 199
NIST SP 800-171 (Correct answer)
NIST SP 800-53
OMB M-17-12

Correct answer: NIST SP 800-171

NIST SP 800-171 establishes requirements for protecting CUI in nonfederal systems and organizations, particularly for DoD contractors.

Question 34: What does the term 'Controlled Unclassified Information' (CUI) refer to?

Information the government requires safeguarding per law, regulation, or policy, but is not classified (Correct answer)
Publicly releasable federal records
Classified defense information
Top Secret/SCI data

Correct answer: Information the government requires safeguarding per law, regulation, or policy, but is not classified

CUI is sensitive government information that requires protection but does not meet the threshold for national security classification.

Question 35: When a significant system change resets an ongoing authorization, what document must be updated first?

The contingency plan
The SSP to reflect the new system configuration and updated controls (Correct answer)
The Rules of Behavior
The POA&M

Correct answer: The SSP to reflect the new system configuration and updated controls

The SSP must be updated to reflect the significant change before a new security impact analysis or re-authorization can proceed.

Question 36: CISA plays which primary role in federal cybersecurity compliance?

Coordinates federal civilian cybersecurity defense and leads incident response (Correct answer)
Issues FIPS publications
Audits agency compliance with FISMA
Approves agency ATOs

Correct answer: Coordinates federal civilian cybersecurity defense and leads incident response

CISA (Cybersecurity and Infrastructure Security Agency) leads the national effort to defend civilian federal networks and coordinate incident response.

Question 37: How does continuous monitoring support the RMF Monitor step?

It replaces the need for security assessments
It automatically grants ATOs without human review
It provides ongoing data to ensure controls remain effective and risks are within acceptable levels (Correct answer)
It eliminates the need for a POA&M

Correct answer: It provides ongoing data to ensure controls remain effective and risks are within acceptable levels

Continuous monitoring feeds ongoing assurance to the AO that the system's security posture remains acceptable between formal re-authorizations.

Question 38: Which NIST SP 800-137 activity involves reviewing and revising the continuous monitoring program based on lessons learned?

Review/Update (Correct answer)
Implement
Respond
Analyze/Report

Correct answer: Review/Update

The Review/Update step ensures the continuous monitoring program evolves based on changing threats, technology, and lessons learned from findings.

Question 39: Which federal law prohibits the use of telecommunications equipment from specific companies deemed national security risks in federal systems?

FISMA Section 3554
HSPD-12
Federal Acquisition Regulation (FAR) Part 12
National Defense Authorization Act (NDAA) Section 889 (Correct answer)

Correct answer: National Defense Authorization Act (NDAA) Section 889

NDAA Section 889 prohibits federal agencies from procuring or using telecommunications equipment from companies like Huawei and ZTE due to national security concerns.

Question 40: Which OMB memorandum introduced the 'Assume Breach' mentality and required agencies to adopt zero trust architecture?

OMB M-21-31
OMB M-17-12
OMB M-22-09 (Correct answer)
OMB A-130

Correct answer: OMB M-22-09

OMB M-22-09 established a federal zero trust architecture strategy requiring agencies to meet specific zero trust security goals.

Question 41: In the context of continuous monitoring, what is a 'security metric'?

A user access log entry
A vulnerability severity score
A quantifiable measure used to assess the effectiveness of security controls over time (Correct answer)
A financial cost associated with a security breach

Correct answer: A quantifiable measure used to assess the effectiveness of security controls over time

Security metrics provide measurable data on control effectiveness, enabling organizations to track trends and make informed risk decisions.

Question 42: What is a 'trusted supplier' program in the context of federal ICT procurement?

A vetting process to identify and use vendors who meet security standards and have demonstrated trustworthiness (Correct answer)
A certification program for cloud service providers only
A list of vendors banned from federal procurement
A program that gives preferred pricing to domestic IT vendors

Correct answer: A vetting process to identify and use vendors who meet security standards and have demonstrated trustworthiness

Trusted supplier programs establish criteria for vetting vendors' security practices, integrity, and supply chain controls before purchasing their products.

Question 43: Which document formally describes the security controls applied to a system and how they are implemented?

Security Assessment Report
System Security Plan (Correct answer)
Memorandum of Understanding
Plan of Action and Milestones

Correct answer: System Security Plan

The System Security Plan (SSP) comprehensively describes all security controls and their implementation details for the information system.

Question 44: What supply chain attack vector was demonstrated by the SolarWinds Orion incident?

Social engineering of SolarWinds customer employees
Exploitation of an unpatched zero-day in the product itself
Malicious code injected into a legitimate software update distributed to thousands of customers (Correct answer)
Physical tampering of hardware during shipping

Correct answer: Malicious code injected into a legitimate software update distributed to thousands of customers

The SolarWinds attack inserted malicious code (SUNBURST) into legitimate software updates that were then distributed and trusted by customers.

Question 45: Which RMF step ensures that security controls are correctly installed and operating as intended?

Monitor
Select
Authorize
Implement (Correct answer)

Correct answer: Implement

The Implement step involves deploying security controls and documenting how they are configured and functioning.

Question 46: What triggers the need to recategorize a federal information system?

Significant changes to the information processed, mission requirements, or operating environment (Correct answer)
The expiration of the ATO
A change in the system administrator
Annual FISMA reporting deadlines only

Correct answer: Significant changes to the information processed, mission requirements, or operating environment

Recategorization is needed when the types of information processed, mission requirements, or operational context change significantly enough to alter the system's risk profile.

Question 47: Which artifact in the authorization package summarizes the findings from security control testing?

Authorization Decision Document
System Security Plan (SSP)
POA&M
Security Assessment Report (SAR) (Correct answer)

Correct answer: Security Assessment Report (SAR)

The SAR documents the results of the security assessment, including findings, evidence, and recommendations.

Question 48: When a required security control cannot be implemented as specified in the baseline, what alternative mechanism may be used with appropriate documentation?

Control inheritance
Security overlay
Residual risk acceptance
Compensating control (Correct answer)

Correct answer: Compensating control

Compensating controls are alternative management, operational, or technical safeguards employed when standard control implementation is not feasible.

Question 49: How does a Memorandum of Agreement (MOA) differ from a Memorandum of Understanding (MOU)?

There is no practical difference
An MOU requires congressional approval; an MOA does not
An MOA is legally binding with specific commitments; an MOU is less formal and states intent (Correct answer)
An MOA applies only to classified systems; an MOU applies to unclassified systems

Correct answer: An MOA is legally binding with specific commitments; an MOU is less formal and states intent

An MOA typically outlines binding commitments and obligations, while an MOU generally expresses a less formal mutual understanding.

Question 50: Which step of the RMF involves selecting the appropriate security controls for an information system?

Implement
Select (Correct answer)
Categorize
Assess

Correct answer: Select

The Select step of the RMF involves choosing baseline security controls tailored to the system's categorization.

Question 51: What is an 'inherited control' in the context of continuous monitoring for a leveraged system?

A control that is monitored by an external auditor
A security control implemented by a common control provider whose monitoring responsibilities are inherited rather than duplicated by the leveraging system (Correct answer)
A control that has been assessed and passed during the last ATO cycle
A control that no longer needs monitoring because it is fully automated

Correct answer: A security control implemented by a common control provider whose monitoring responsibilities are inherited rather than duplicated by the leveraging system

When a system inherits a common control, the monitoring responsibility for that control lies with the common control provider, not the system owner.

Question 52: What document formally records the selected security controls for an information system during the RMF?

Plan of Action and Milestones (POA&M)
Security Assessment Report (SAR)
Authorization to Operate (ATO)
System Security Plan (SSP) (Correct answer)

Correct answer: System Security Plan (SSP)

The System Security Plan documents the security controls selected and implemented for the system.

Question 53: Under FedRAMP, what authorization path allows agencies to reuse an existing cloud ATO?

Agency ATO
Joint Authorization Board (JAB) Provisional ATO (Correct answer)
Security Impact Analysis
Reciprocity Agreement

Correct answer: Joint Authorization Board (JAB) Provisional ATO

A JAB Provisional ATO (P-ATO) issued by FedRAMP's Joint Authorization Board can be leveraged by multiple agencies through reciprocity.

Question 54: Which body conducts independent audits of federal agency information security programs and reports findings to Congress?

CISA
GAO (Government Accountability Office) (Correct answer)
OMB
NSA

Correct answer: GAO (Government Accountability Office)

The GAO conducts independent audits and evaluations of federal programs, including information security, and reports to Congress.

Question 55: What is the purpose of an Interconnection Security Agreement (ISA)?

To document the security requirements for a connection between two systems (Correct answer)
To define incident response procedures
To grant an ATO to a new system
To authorize user access to classified data

Correct answer: To document the security requirements for a connection between two systems

An ISA establishes the security interface requirements and responsibilities when two systems are interconnected.

Question 56: A CAP is designing a quality improvement project using the PDCA (Plan-Do-Check-Act) model. What is the main purpose of the “Check” phase in this model?

To plan future actions based on desired outcomes
To monitor the results of the intervention against expectations (Correct answer)
To implement the intervention or process change
To standardize the new process for organizational-wide adoption

Correct answer: To monitor the results of the intervention against expectations

In the PDCA (Plan-Do-Check-Act) cycle, the 'Check' phase is dedicated to evaluating the effectiveness of the changes implemented in the 'Do' phase. During this stage, data is collected and analyzed to determine if the intervention achieved the desired outcomes and met the established expectations or targets. This critical step allows for objective assessment of the improvement effort before deciding on further actions.

Question 57: What does an Authorization Denial (DATO) indicate?

The system has minor findings that need remediation
The system passed all security controls but lacks documentation
The ATO has expired and requires renewal
The AO has determined the risk is unacceptable and the system must not operate (Correct answer)

Correct answer: The AO has determined the risk is unacceptable and the system must not operate

A DATO means the Authorizing Official found the risk too high to accept and prohibits the system from operating.

Question 58: Which RMF step results in the formal decision to authorize a system to operate?

Authorize (Correct answer)
Monitor
Select
Assess

Correct answer: Authorize

The Authorize step is where the Authorizing Official reviews the risk and formally grants an Authorization to Operate (ATO).

Question 59: What does it mean to 'adjust' a recommended information type impact level from NIST SP 800-60?

To apply a classification label above Secret
To reduce controls to save cost
To override FIPS 199 completely with agency-defined categories
To raise or lower the recommended level based on the specific operational context and risk environment (Correct answer)

Correct answer: To raise or lower the recommended level based on the specific operational context and risk environment

Agencies may adjust recommended impact levels up or down when local factors, mission context, or threat environment justify a different level than the default.

Question 60: OMB Circular A-130 provides federal policy guidance on which broad area?

Congressional budget procedures
Managing federal information resources, including IT security and privacy (Correct answer)
Federal procurement rules
Federal hiring standards

Correct answer: Managing federal information resources, including IT security and privacy

OMB Circular A-130 establishes federal policy for managing information resources, including requirements for information security and privacy.

Question 61: In the RMF three-tier hierarchy, which tier addresses mission and business process risk?

Tier 3
Tier 4
Tier 2 (Correct answer)
Tier 1

Correct answer: Tier 2

Tier 2 (Mission/Business Process) addresses risk at the mission and business process level between organizational leadership and system owners.

Question 62: Which term describes the maximum acceptable downtime for a system as defined in a Business Impact Analysis?

Mean Time to Repair (MTTR)
Recovery Point Objective (RPO)
Maximum Tolerable Downtime (MTD) (Correct answer)
Recovery Time Objective (RTO)

Correct answer: Maximum Tolerable Downtime (MTD)

MTD is the longest period an organization can survive without a critical system before business operations are permanently impaired.

Question 63: Which section of the System Security Plan describes the system's purpose, architecture, and operating environment?

Security Control Implementation
System Identification (Correct answer)
Interconnections
Rules of Behavior

Correct answer: System Identification

The System Identification section provides the high-level description of the system including its purpose, boundaries, architecture, and environment.

Question 64: What does FISMA stand for and what does it mandate?

Federal Information Security Management Act; mandates encryption of all federal data
Federal Information Security Modernization Act; mandates federal agencies implement RMF-based security programs (Correct answer)
Federal IT Security Modernization Act; mandates cloud-first adoption
Federal Information Systems Management Act; mandates annual security audits

Correct answer: Federal Information Security Modernization Act; mandates federal agencies implement RMF-based security programs

FISMA requires federal agencies to develop, document, and implement information security programs aligned with the RMF.

Question 65: Which federal privacy law gives US citizens the right to access and correct records held by federal agencies?

FERPA
HIPAA
Privacy Act of 1974 (Correct answer)
COPPA

Correct answer: Privacy Act of 1974

The Privacy Act of 1974 governs federal agency collection, maintenance, use, and dissemination of personally identifiable information.

Question 66: What is the minimum set of documents typically included in an authorization package?

SSP only
SSP and ATO letter only
SAR and POA&M only
SSP, SAR, and POA&M (Correct answer)

Correct answer: SSP, SAR, and POA&M

The standard authorization package contains the System Security Plan, Security Assessment Report, and Plan of Action and Milestones.

Question 67: Which mission-based information type from NIST SP 800-60 typically receives a High Confidentiality categorization?

Facilities management information
Intelligence data and law enforcement sensitive information (Correct answer)
Training and education records for public programs
Public outreach and communications data

Correct answer: Intelligence data and law enforcement sensitive information

Information types like intelligence and law enforcement sensitive data typically warrant High confidentiality due to the severe harm from unauthorized disclosure.

Question 68: Which NIST document provides guidance specifically on incident handling and response for computer security incidents?

NIST SP 800-37
NIST SP 800-30
NIST SP 800-61 (Correct answer)
NIST SP 800-53

Correct answer: NIST SP 800-61

NIST SP 800-61, the Computer Security Incident Handling Guide, provides guidance on detecting, analyzing, containing, and recovering from incidents.

Question 69: When a security control is determined to be 'not applicable' to an information system, what must the system owner do?

Remove it from the SSP entirely without any notation
Document the rationale for non-applicability in the SSP (Correct answer)
Automatically replace it with a compensating control
Escalate the decision directly to the Authorizing Official for formal approval

Correct answer: Document the rationale for non-applicability in the SSP

Non-applicability determinations must be documented with a clear rationale in the SSP so assessors and the AO can evaluate whether the decision is justified.

Question 70: The CAP notices an upward trend in patient safety incidents during routine monitoring in a healthcare organization. What should the CAP do first?

Investigate the root cause of the safety incidents (Correct answer)
Develop a corrective action plan to address the trend
Schedule a follow-up audit to confirm the trend
Inform senior management about the trend and recommend penalties

Correct answer: Investigate the root cause of the safety incidents

When an upward trend in patient safety incidents is observed, the CAP's immediate and most critical first step is to investigate the root cause. Understanding why these incidents are occurring is essential for developing effective and sustainable corrective actions. Without identifying the underlying causes, any attempts to address the trend would be superficial and unlikely to prevent future occurrences.

Question 71: What is Information and Communications Technology Supply Chain Risk Management (ICT SCRM)?

The process of identifying, assessing, and mitigating risks associated with the global supply chain for IT products and services (Correct answer)
Verifying that all hardware is manufactured domestically
Managing vendor contracts for software licenses only
Auditing the source code of all purchased applications

Correct answer: The process of identifying, assessing, and mitigating risks associated with the global supply chain for IT products and services

ICT SCRM addresses risks arising from the complex global supply chain, including malicious tampering, counterfeits, and vendor vulnerabilities.

Question 72: How does continuous monitoring support the 'Monitor' step of the RMF?

By replacing the need for the security assessment report
By generating the initial SSP before authorization
By providing ongoing assessment of controls, documenting changes, and reporting security status to the AO (Correct answer)
By automating POA&M remediation without human involvement

Correct answer: By providing ongoing assessment of controls, documenting changes, and reporting security status to the AO

The Monitor step of the RMF is implemented through a continuous monitoring program that tracks control effectiveness and reports status to decision-makers.

Question 73: What is the role of automated scanning tools in a continuous monitoring program?

To generate ATOs automatically based on scan results
To efficiently collect security state data such as patch levels, configuration compliance, and vulnerabilities at scale (Correct answer)
To replace the need for human security analysts
To conduct penetration testing on a daily basis

Correct answer: To efficiently collect security state data such as patch levels, configuration compliance, and vulnerabilities at scale

Automated tools enable continuous data collection across large environments, making it feasible to assess many controls frequently without manual effort.

Question 74: Which RMF step involves choosing security controls from NIST SP 800-53?

Authorize
Implement
Select (Correct answer)
Assess

Correct answer: Select

The Select step involves choosing appropriate security controls tailored to the system's risk profile.

Question 75: What does NIST SP 800-53A provide in direct support of the security control implementation and assessment process?

Guidance on information system impact categorization
Assessment procedures for determining whether implemented controls are effective (Correct answer)
Templates for completing authorization packages
A catalog of new security controls not in SP 800-53

Correct answer: Assessment procedures for determining whether implemented controls are effective

NIST SP 800-53A provides the assessment procedures used to evaluate whether security controls have been correctly implemented and are operating effectively.

Question 76: What is the primary purpose of a System Security Plan (SSP)?

To list all software vulnerabilities found during testing
To describe security requirements and document controls implemented for an information system (Correct answer)
To define the organization's overall security policy
To track remediation milestones for security weaknesses

Correct answer: To describe security requirements and document controls implemented for an information system

The SSP is the central document describing system characteristics, the security environment, and how controls are implemented.

Question 77: What is a 'counterfeit component' threat in the context of ICT supply chain risk?

Hardware or software that is fraudulently represented as genuine but may contain malicious functionality or quality defects (Correct answer)
An outdated firmware version that has known vulnerabilities
A software license purchased from an unauthorized reseller
A configuration setting that deviates from vendor defaults

Correct answer: Hardware or software that is fraudulently represented as genuine but may contain malicious functionality or quality defects

Counterfeit components are fake products that may contain backdoors, poor quality components, or malicious code inserted during manufacturing.

Question 78: In the RMF, which step involves the Authorizing Official making an accept/reject risk decision?

Assess
Select
Authorize (Correct answer)
Monitor

Correct answer: Authorize

The Authorize step is where the AO reviews the risk assessment package and decides to grant or deny an ATO.

Question 79: Which FIPS publication establishes the standards for categorizing federal information and information systems?

FIPS 140-2
FIPS 201
FIPS 200
FIPS 199 (Correct answer)

Correct answer: FIPS 199

FIPS 199 defines the standards for security categorization of federal information and information systems.

Question 80: What does NIST SP 800-60 help federal agencies determine?

How to encrypt data at rest
How to respond to security incidents
How to configure firewalls
Which information types and systems belong in which FIPS 199 impact categories (Correct answer)

Correct answer: Which information types and systems belong in which FIPS 199 impact categories

NIST SP 800-60 maps information types to security impact levels, guiding agencies in applying FIPS 199 categorization consistently.

Question 81: How should organizations determine which security controls to allocate as common controls versus system-specific controls?

Allocation should be based on organizational efficiency and cost-effectiveness while ensuring adequate protection (Correct answer)
All controls should always be system-specific to maximize protection
All controls must be independently implemented by each system regardless of overlap
Common controls are only applicable to classified national security systems

Correct answer: Allocation should be based on organizational efficiency and cost-effectiveness while ensuring adequate protection

Control allocation decisions should optimize cost-effectiveness and organizational efficiency, leveraging common controls where it makes operational and security sense.

Question 82: What is the purpose of a security awareness and training program in the system lifecycle?

To comply with FedRAMP marketing standards
To replace technical security controls
To satisfy vendor contract requirements
To ensure users understand their security responsibilities and can recognize threats (Correct answer)

Correct answer: To ensure users understand their security responsibilities and can recognize threats

Security awareness and training ensures all personnel understand threats, policies, and their individual responsibilities for protecting information.

Question 83: How should organizations manage the risk of 'end-of-life' (EOL) software and hardware components in the supply chain?

By requiring vendors to provide indefinite support via contractual clauses
By continuing to use EOL components as long as no active exploits are known
By isolating EOL systems from all networks permanently
By tracking EOL dates, planning replacements before support ends, and implementing compensating controls if immediate replacement is not possible (Correct answer)

Correct answer: By tracking EOL dates, planning replacements before support ends, and implementing compensating controls if immediate replacement is not possible

EOL components no longer receive security patches, so proactive replacement planning and compensating controls are essential to manage the associated risk.

Question 84: What does the term 'authorization boundary' mean in the context of an SSP?

The organizational boundary between agencies
The network perimeter defended by a firewall
The logical or physical perimeter defining all system components under a single ATO (Correct answer)
The scope of a penetration test

Correct answer: The logical or physical perimeter defining all system components under a single ATO

The authorization boundary encompasses all system components—hardware, software, firmware, and people—included under one authorization decision.

Question 85: In RMF terminology, what is a 'common control'?

A control used only for classified systems
A mandatory FIPS control
A control applied at the network perimeter only
A control inherited by multiple systems from a shared provider (Correct answer)

Correct answer: A control inherited by multiple systems from a shared provider

Common controls are security controls that can be inherited by multiple information systems from a centralized provider, reducing duplication.

Question 86: What information must a System Security Plan include about the system boundary?

The physical location of all servers
A description of the authorization boundary defining which components are within scope (Correct answer)
Only the IP addresses of networked devices
A list of all user account names

Correct answer: A description of the authorization boundary defining which components are within scope

The SSP must clearly define the authorization boundary to establish what hardware, software, and services are in scope for the assessment.

Question 87: What does 'risk tolerance' mean in the context of defining a continuous monitoring strategy?

The maximum number of vulnerabilities allowed before an ATO is revoked
The amount of budget allocated to security monitoring tools
The degree of risk the organization is willing to accept while still achieving its mission objectives (Correct answer)
The minimum uptime percentage required for critical systems

Correct answer: The degree of risk the organization is willing to accept while still achieving its mission objectives

Risk tolerance defines how much residual risk leadership is willing to accept, which informs what to monitor, how frequently, and what triggers escalation.

Question 88: What is the primary goal of continuous monitoring in the context of the RMF?

To eliminate the need for periodic security assessments
To automate the granting of ATOs without AO review
To replace annual FISMA reporting with automated tools
To maintain ongoing situational awareness of the security state of information systems and detect changes that affect risk (Correct answer)

Correct answer: To maintain ongoing situational awareness of the security state of information systems and detect changes that affect risk

Continuous monitoring provides real-time or near real-time visibility into the security posture of systems so that risk can be managed dynamically.

Question 89: What is a compensating security control?

An alternative control providing equivalent protection when the primary control cannot be implemented (Correct answer)
A control mandated by FISMA
A control applied only to high-impact systems
A control that replaces all other controls

Correct answer: An alternative control providing equivalent protection when the primary control cannot be implemented

A compensating control provides an equivalent level of protection when the baseline control is not feasible to implement as specified.

Question 90: Under FISMA, which office provides policy guidance and oversight for federal information security programs?

GAO
OMB (Correct answer)
CISA
NSA

Correct answer: OMB

The Office of Management and Budget (OMB) issues policy guidance and oversees federal agency compliance with FISMA requirements.

Question 91: Which NIST publication provides guidance on preparing the authorization package and submitting it to the AO?

NIST SP 800-60
NIST SP 800-37 (Correct answer)
NIST SP 800-30
NIST SP 800-53A

Correct answer: NIST SP 800-37

NIST SP 800-37 describes the RMF process including the preparation and submission of the authorization package to the Authorizing Official.

Question 92: After an accreditation audit, the CAP receives a report indicating minor non-compliance issues in two departments. What should the CAP do first?

Request a re-evaluation of the audit findings from the accrediting body
Report the departments’ non-compliance issues to senior management only
Prepare a corrective action plan and meet with the departments to address the issues (Correct answer)
Document the non-compliance issues and file them without further action

Correct answer: Prepare a corrective action plan and meet with the departments to address the issues

Upon receiving a report of minor non-compliance issues, the CAP's immediate priority is to initiate the corrective action process. This involves developing a plan to address the identified issues and collaborating directly with the affected departments to implement these changes. This proactive and collaborative approach ensures that deficiencies are resolved promptly and effectively, preventing them from escalating or recurring.

Question 93: What federal initiative provides automated continuous monitoring capabilities and dashboards to federal civilian agencies?

Einstein Program
Continuous Diagnostics and Mitigation (CDM) (Correct answer)
HSPD-12
FedRAMP

Correct answer: Continuous Diagnostics and Mitigation (CDM)

The CDM program, managed by CISA, provides tools and dashboards to automate continuous monitoring across federal civilian agencies.

Question 94: How is the overall security category of an information system determined when multiple information types are present?

By using the lowest impact value to minimize security requirements
By a vote among the system owner, ISSO, and AO
By averaging the impact values of all information types
By using the high-water mark — the highest impact value across all information types and objectives (Correct answer)

Correct answer: By using the high-water mark — the highest impact value across all information types and objectives

The high-water mark principle means the system's overall category is set to the highest impact level found among all information types for each security objective.

Question 95: Which NIST publication provides the comprehensive catalog of security and privacy controls for federal information systems?

NIST SP 800-53 (Correct answer)
NIST SP 800-37
FIPS 199
NIST SP 800-60

Correct answer: NIST SP 800-53

NIST SP 800-53 provides the catalog of security and privacy controls that organizations select from when building their control baseline.

Question 96: How frequently must federal agencies review and update their System Security Plans per NIST guidance?

Only when a security incident occurs
Every five years during reauthorization
Quarterly regardless of system changes
At least annually or whenever significant changes occur (Correct answer)

Correct answer: At least annually or whenever significant changes occur

NIST recommends reviewing and updating the SSP at least annually and whenever significant changes to the system occur.

Question 97: Which federal law established the modern framework for federal information security and was significantly updated in 2014?

Sarbanes-Oxley Act
Clinger-Cohen Act of 1996
Privacy Act of 1974
Federal Information Security Modernization Act (FISMA) (Correct answer)

Correct answer: Federal Information Security Modernization Act (FISMA)

FISMA 2014 updated the original 2002 law to strengthen DHS's role, require automated monitoring, and improve incident reporting.

Question 98: What is a 'significant change' that would require reauthorization of a federal information system?

A major upgrade to system architecture, operating environment, or security posture that increases risk (Correct answer)
Adding a new user account
Routine software patching and updates
Changing the system administrator's name

Correct answer: A major upgrade to system architecture, operating environment, or security posture that increases risk

Significant changes such as new external interconnections, major software upgrades, or changes to the threat environment may trigger reauthorization.

Question 99: What is the difference between configuration management and continuous monitoring?

Continuous monitoring replaces the need for configuration management
Configuration management is only for hardware; continuous monitoring covers software
They are synonymous terms used interchangeably
Configuration management establishes and maintains secure baselines; continuous monitoring verifies those baselines are maintained over time (Correct answer)

Correct answer: Configuration management establishes and maintains secure baselines; continuous monitoring verifies those baselines are maintained over time

Configuration management defines the desired security state, while continuous monitoring checks that the system continues to operate in that desired state.

Question 100: The Federal Risk and Authorization Management Program (FedRAMP) standardizes security authorizations for which type of systems?

On-premises legacy systems
Classified national security systems
Cloud computing products and services used by federal agencies (Correct answer)
Mobile device management platforms

Correct answer: Cloud computing products and services used by federal agencies

FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud services used by the federal government.

Question 101: Which NIST RMF task requires organizations to update the System Security Plan to reflect the actual implementation of security controls?

Implement security controls (Step 4) (Correct answer)
Select security controls (Step 3)
Authorize the information system (Step 6)
Categorize the information system (Step 1)

Correct answer: Implement security controls (Step 4)

During Step 4 (Implement), organizations implement the selected controls and update the SSP to reflect how controls were actually implemented, including any deviations from the planned approach.

Question 102: What is an 'ongoing authorization' in the context of continuous monitoring?

An automated system that grants ATOs without human review
A contract with an MSSP for 24/7 monitoring
A risk management approach where the AO makes ongoing authorization decisions based on real-time monitoring data rather than periodic reassessments (Correct answer)
An ATO that never expires and requires no review

Correct answer: A risk management approach where the AO makes ongoing authorization decisions based on real-time monitoring data rather than periodic reassessments

Ongoing authorization shifts from periodic reauthorization to a continuous risk-informed process where the AO monitors security posture in real time.

Question 103: What is the purpose of an authorization boundary in the context of system documentation?

To establish the physical perimeter of a data center
To identify funding boundaries for IT projects
To define the scope of components, data, and services subject to assessment and authorization (Correct answer)
To list all users authorized to access the system

Correct answer: To define the scope of components, data, and services subject to assessment and authorization

The authorization boundary defines exactly what is included in the assessment and authorization, preventing scope creep during reviews.

Question 104: In the authorization boundary context, what does it mean when a system is described as 'multi-tenant'?

The system has multiple Authorizing Officials
Multiple organizations share the same infrastructure with logically separated environments (Correct answer)
The system spans multiple floors of a building
Multiple agencies share a single ATO

Correct answer: Multiple organizations share the same infrastructure with logically separated environments

A multi-tenant system allows multiple customers or organizations to share the same underlying infrastructure while maintaining logical separation.

Question 105: Which metric is commonly used to measure the effectiveness of a vulnerability management continuous monitoring process?

Count of security incidents per quarter
Mean Time to Remediate (MTTR) critical vulnerabilities (Correct answer)
Number of users with admin privileges
Percentage of systems with an active ATO

Correct answer: Mean Time to Remediate (MTTR) critical vulnerabilities

MTTR measures how quickly identified vulnerabilities are patched, directly reflecting the effectiveness of the vulnerability management process.

Question 106: What is a 'security status report' in the context of continuous monitoring?

The final output of a penetration test engagement
A periodic report provided to the AO summarizing the current security posture, monitoring results, and risk levels (Correct answer)
The official document granting an ATO
A daily automated scan report from a SIEM tool

Correct answer: A periodic report provided to the AO summarizing the current security posture, monitoring results, and risk levels

Security status reports keep the AO informed of the system's ongoing security posture between formal reauthorization events.

Question 107: What is the primary purpose of a security impact analysis?

To assign an impact level to data
To document the results of a penetration test
To categorize a new system
To evaluate the effect of proposed changes on a system's security posture (Correct answer)

Correct answer: To evaluate the effect of proposed changes on a system's security posture

A security impact analysis assesses how a proposed change could affect the confidentiality, integrity, or availability of an information system.

Question 108: What is the correct order of the first three steps in the NIST RMF?

Prepare, Categorize, Select (Correct answer)
Categorize, Select, Implement
Select, Implement, Assess
Prepare, Select, Categorize

Correct answer: Prepare, Categorize, Select

The RMF begins with Prepare, then Categorize, then Select controls before implementation.

Question 109: What are the six steps of the ISCM process defined in NIST SP 800-137?

Define, Establish, Implement, Analyze/Report, Respond, Review/Update (Correct answer)
Identify, Protect, Detect, Respond, Recover, Adapt
Prepare, Categorize, Select, Implement, Assess, Authorize
Plan, Do, Check, Act, Monitor, Report

Correct answer: Define, Establish, Implement, Analyze/Report, Respond, Review/Update

NIST SP 800-137 defines the ISCM process as: Define strategy, Establish program, Implement program, Analyze/Report findings, Respond to findings, and Review/Update the program.

Question 110: The National Cybersecurity Strategy released in 2023 by the Biden administration emphasized shifting cybersecurity responsibility to whom?

State and local governments
Small businesses only
Individual end users
Technology providers and organizations best positioned to reduce risk (Correct answer)

Correct answer: Technology providers and organizations best positioned to reduce risk

The 2023 National Cybersecurity Strategy called for shifting the cybersecurity burden from individuals to technology vendors and large organizations.

Question 111: What is the purpose of the 'Prepare' step added to RMF in NIST SP 800-37 Revision 2?

To authorize the information system
To establish organizational risk management roles and strategy before system-level activities (Correct answer)
To select baseline security controls
To implement controls across the enterprise

Correct answer: To establish organizational risk management roles and strategy before system-level activities

The Prepare step establishes the organizational context and risk management strategy prior to executing system-level RMF tasks.

Question 112: Which federal law requires agencies to conduct Privacy Impact Assessments for new information technology systems?

E-Government Act of 2002 (Correct answer)
Privacy Act of 1974
FISMA
Federal Records Act

Correct answer: E-Government Act of 2002

Section 208 of the E-Government Act of 2002 mandates PIAs before agencies develop or procure new IT systems that collect PII.

Question 113: Which federal policy requires agencies to report major cybersecurity incidents to CISA and Congress within a specific timeframe?

FIPS 200 requirements
FISMA 2014 and OMB reporting requirements (Correct answer)
FedRAMP authorization rules
NIST SP 800-61 only

Correct answer: FISMA 2014 and OMB reporting requirements

FISMA 2014 and related OMB memoranda require agencies to report major incidents to CISA and notify Congress within prescribed timeframes.

Question 114: Which security control family in NIST SP 800-53 addresses access control?

AU
CA
CM
AC (Correct answer)

Correct answer: AC

The AC (Access Control) family contains controls governing who can access systems, data, and functions.

Question 115: What is the role of the Information System Security Officer (ISSO) in maintaining authorization documentation?

Approving user access requests
Conducting independent security assessments
Maintaining and updating system security documentation and coordinating with the AO (Correct answer)
Granting the ATO

Correct answer: Maintaining and updating system security documentation and coordinating with the AO

The ISSO is responsible for day-to-day security operations, ensuring documentation stays current, and reporting security status to the AO.

Question 116: What federal acquisition regulation clause requires contractors to report cyber incidents affecting federal information?

FAR 52.212-1
FAR 52.239-1
DFARS 252.239-7010
DFARS 252.204-7012 (for DoD contracts) (Correct answer)

Correct answer: DFARS 252.204-7012 (for DoD contracts)

DFARS 252.204-7012 requires DoD contractors to implement NIST SP 800-171 controls and report cyber incidents affecting covered defense information within 72 hours.

Question 117: Which control overlay in NIST SP 800-53 provides additional guidance for classified national security systems?

Intelligence overlay
CNSS Instruction 1253 overlay (Correct answer)
Privacy overlay
FedRAMP overlay

Correct answer: CNSS Instruction 1253 overlay

CNSSI 1253 provides the security categorization and control selection guidance for national security systems.

Question 118: A CAP is tasked with ensuring that all departments adhere to new accreditation standards recently updated by the accrediting body. What is the CAP’s best initial step to ensure compliance?

Inform the heads of departments to make the necessary updates
Conduct an organization-wide audit to assess current compliance
Update the policies and procedures alone and distribute them
Hold a series of training sessions to educate staff on the new standards (Correct answer)

Correct answer: Hold a series of training sessions to educate staff on the new standards

When new accreditation standards are introduced, the most effective initial step for a CAP is to ensure widespread understanding among staff. Holding training sessions directly educates employees on the new requirements, clarifies expectations, and provides an opportunity for questions. This proactive approach ensures that all departments are equipped with the knowledge to implement the changes correctly, fostering compliance from the ground up.

Question 119: Which of the following describes a core responsibility of a CAP during the pre-audit phase?

Conducting mock audits to identify and address potential compliance issues (Correct answer)
Finalizing the organization’s annual budget to reflect audit costs
Scheduling team-building activities to boost morale before the audit
Drafting marketing materials that promote the organization’s accreditation status

Correct answer: Conducting mock audits to identify and address potential compliance issues

During the pre-audit phase, a core responsibility of a CAP is to proactively prepare the organization for the official audit. Conducting mock audits simulates the actual audit process, allowing the CAP to identify potential compliance gaps, test readiness, and address issues before external auditors arrive. This strategic preparation significantly increases the likelihood of a successful accreditation outcome.

Question 120: Which continuous monitoring activity involves testing a subset of controls each year rather than all controls simultaneously?

Risk acceptance
Penetration testing
Baseline reconfiguration
Rolling assessments (Correct answer)

Correct answer: Rolling assessments

Rolling assessments divide the full control set into groups assessed on a rotating schedule, providing continuous coverage without full annual assessments.

Question 121: What are the three potential impact levels defined by FIPS 199?

Level 1, Level 2, Level 3
Low, Moderate, High (Correct answer)
Critical, Important, Minor
Green, Yellow, Red

Correct answer: Low, Moderate, High

FIPS 199 defines Low, Moderate, and High as the three potential impact levels for each security objective.

Question 122: Executive Order 13800 directed federal agencies to take what primary action regarding cybersecurity risk?

Adopt zero-trust architecture immediately
Eliminate all legacy systems within one year
Transfer all systems to commercial cloud
Use the NIST Cybersecurity Framework to manage institutional risk (Correct answer)

Correct answer: Use the NIST Cybersecurity Framework to manage institutional risk

EO 13800 required agency heads to use the NIST Cybersecurity Framework to manage cybersecurity risk as part of enterprise risk management.

Question 123: In preparing for an accreditation audit, a CAP realizes that employees lack awareness of a new regulatory standard. What is the CAP's best course of action?

Schedule a training session focused on the new standard (Correct answer)
Place the new standard document in the break room
Ignore the issue, as it may not impact the audit results
Send an email with a copy of the standard to all employees

Correct answer: Schedule a training session focused on the new standard

When employees lack awareness of a new regulatory standard, a comprehensive training session is the most effective course of action. This allows for direct instruction, clarification of complex details, and opportunities for questions, ensuring a shared understanding across the workforce. Simply sending an email or placing a document is passive and less likely to achieve widespread comprehension and compliance, which is critical for accreditation.

Question 124: As part of their responsibilities, a CAP is reviewing departmental policies to ensure alignment with current regulatory standards. Which of the following actions should the CAP prioritize to complete this task effectively?

Submit all current policies to the accrediting body for feedback
Review each department’s policies for outdated content and update accordingly (Correct answer)
Assign each department the task of updating their own policies independently
Perform an external audit to see if other organizations use similar policies

Correct answer: Review each department’s policies for outdated content and update accordingly

To ensure departmental policies align with current regulatory standards, the CAP must actively review and update them. This involves systematically examining existing policies for any content that is outdated, inconsistent, or no longer compliant with the latest regulations. This direct action ensures that the organization's documented practices reflect current requirements, which is a fundamental aspect of accreditation readiness.

Question 125: A CAP is responsible for monitoring ongoing compliance within an organization. What is the most effective tool for tracking compliance metrics over time?

A centralized database for compliance tracking and reporting (Correct answer)
Regular emails requesting updates from department heads
A manual checklist completed monthly
A paper-based log for each department

Correct answer: A centralized database for compliance tracking and reporting

For monitoring ongoing compliance effectively over time, a centralized database is the most effective tool. It allows for systematic collection, storage, and analysis of compliance metrics, providing a comprehensive and up-to-date overview of the organization's status. Unlike manual or fragmented methods, a centralized system facilitates efficient reporting, trend analysis, and proactive identification of potential issues.

Question 126: Which RMF step was added in NIST SP 800-37 Revision 2 to emphasize security early in the system lifecycle?

Select
Prepare (Correct answer)
Monitor
Assess

Correct answer: Prepare

The Prepare step was introduced in RMF Rev. 2 to establish organization- and system-level context before beginning the RMF process.

ISC2 Certified Authorization Professional (CAP)

The CAP (now rebranded as CGRC) certification validates expertise in authorizing and maintaining information systems using the Risk Management Framework (RMF), covering governance, risk, and compliance for cybersecurity professionals.

125

Questions

180 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

isc2.org — Eligibility, exam format, passing score, time limit, renewal, test delivery, score validity, score release, fees, exam information · verified Oct 2026
home.pearsonvue.com — Registration · verified Oct 2026