CAP Cheat Sheet 2026

The 30 highest-yield CAP facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which of the following helps protect data from loss or corruption? → Performing regular data backups
2. What is the purpose of an access control list (ACL)? → To define and enforce access permissions
3. A federal system processes both FOUO (For Official Use Only) and publicly releasable information. What is the most appropriate data handling control? → Separate the data with access controls and label all FOUO information appropriately
4. What is the importance of staying current with trends in Network Security Fundamentals for Certified Authorization Professional? → It ensures practices remain effective and relevant
5. Under Executive Order 14028 (Improving the Nation's Cybersecurity, 2021), federal agencies must adopt which security architecture approach? → Zero Trust Architecture
6. What is the importance of staying current with trends in Cryptography & Encryption for Certified Authorization Professional? → It ensures practices remain effective and relevant
7. A web application verifies that an authenticated user can only access their own account records and not those of other users. This check enforces: → Horizontal access control
8. Which cloud security concept ensures that encryption keys are never exposed to the cloud provider in plaintext? → Bring Your Own Key (BYOK)
9. NIST SP 800-137 defines three tiers for ISCM. Which set correctly identifies these tiers? → Organization, Mission/Business Process, Information System
10. Why is a security assessment critical in risk management? → To identify vulnerabilities before exploitation
11. A penetration test reveals that a web application stores session tokens in plaintext cookies. Which security principle is most directly violated? → Confidentiality of session data and least privilege for session management
12. NIST SP 800-18 provides guidance on which RMF artifact? → System Security Plan development
13. NIST SP 800-34 recommends that contingency plans be tested at what minimum frequency? → Annually
14. What is the purpose of maintaining a chain of custody during a penetration test on a federal system? → To ensure evidence integrity and accountability for all test artifacts and findings
15. A federal agency wants to prioritize which security vulnerabilities to remediate first. Which approach is MOST aligned with risk management principles? → Prioritize based on CVSS score combined with asset criticality and threat context
16. Which approach best supports quality outcomes in Network Security Fundamentals for Certified Authorization Professional? → Systematic application of evidence-based methods
17. The Children's Online Privacy Protection Act (COPPA) applies to websites collecting personal information from children under what age? → 13
18. In a shared responsibility model, who is responsible for patching the hypervisor in an IaaS environment? → The cloud service provider
19. Under NIST SP 800-53, which control family directly addresses user provisioning, account types, and least privilege enforcement? → AC – Access Control
20. During red team exercises on federal systems, which methodology specifically simulates advanced persistent threat (APT) tactics, techniques, and procedures? → MITRE ATT&CK Framework
21. In the context of CAP and the RMF, what does the principle of 'least privilege' require? → Users receive only the minimum access rights necessary to perform their job functions
22. Under FISMA, which official has the authority to grant an Authorization to Operate (ATO) for a federal information system? → The Authorizing Official (AO), also known as the Designated Accrediting Authority (DAA)
23. What is the importance of staying current with trends in Security Operations & Monitoring for Certified Authorization Professional? → It ensures practices remain effective and relevant
24. Which access control principle ensures users only have the minimum necessary permissions? → Principle of Least Privilege (PoLP)
25. What is the term for a vulnerability assessment approach that examines only externally visible attack surfaces without any internal system knowledge? → Black-box assessment
26. Which element must be included in a POA&M entry to satisfy FISMA reporting requirements? → Source of the weakness, scheduled completion date, and responsible point of contact
27. Which access control model evaluates multiple attributes (user, resource, environment) dynamically to make access decisions? → Attribute-Based Access Control (ABAC)
28. In a federal environment, who has the authority to formally accept residual risk and grant an Authorization to Operate (ATO)? → Authorizing Official (AO)
29. Which skill is most important for success in Cloud Security Architecture within Certified Authorization Professional? → Continuous learning and adaptation
30. What is the key difference between TLS 1.2 and TLS 1.3 regarding cipher suites? → TLS 1.3 removes support for static RSA and DHE key exchange, mandating forward secrecy