Certified Authorization Professional (CAP) — Questions and Answers

Question 1: In NIST SP 800-53, security controls are organized into 'families.' Which control family specifically addresses planning for security activities?

System and Services Acquisition (SA)
Risk Assessment (RA)
Planning (PL) (Correct answer)
Program Management (PM)

Correct answer: Planning (PL)

The Planning (PL) family in NIST SP 800-53 includes controls related to security planning activities, such as developing the System Security Plan (SSP) and Rules of Behavior. The PL family is directly relevant to the authorization documentation process.

Question 2: Which U.S. federal law established the requirement for federal agencies to develop, document, and implement an information security program, and made NIST responsible for developing security standards and guidelines?

The Federal Information Security Management Act (FISMA) of 2002 (Correct answer)
The Sarbanes-Oxley Act (SOX) of 2002
The Computer Fraud and Abuse Act (CFAA) of 1986
The Gramm-Leach-Bliley Act (GLBA) of 1999

Correct answer: The Federal Information Security Management Act (FISMA) of 2002

FISMA 2002 (part of the E-Government Act) is the foundational federal law requiring agencies to implement agency-wide information security programs. It mandated NIST to develop standards (FIPS) and guidelines (SP 800-series) for federal information security.

Question 3: A vulnerability assessment reveals that a system uses TLS 1.0 for encrypting data in transit. How should this finding be categorized under NIST guidelines?

Medium vulnerability requiring monitoring only
High or Critical vulnerability due to known protocol weaknesses (Correct answer)
Low vulnerability due to encryption being present
Informational finding with no risk

Correct answer: High or Critical vulnerability due to known protocol weaknesses

TLS 1.0 has known vulnerabilities like POODLE and BEAST and is deprecated by NIST, making it a high-severity finding requiring remediation.

Question 4: Which document serves as the primary artifact in the NIST RMF that describes the security controls implemented in an information system?

System Security Plan (SSP) (Correct answer)
Security Assessment Report (SAR)
Plan of Action and Milestones (POA&M)
Authorization to Operate (ATO)

Correct answer: System Security Plan (SSP)

The System Security Plan (SSP) is the primary security documentation artifact that describes how an information system implements required security controls.

Question 5: Which of the following BEST describes a 'compensating control' in the RMF context?

A backup control activated only during an incident
An alternative control that provides equivalent protection when the required control cannot be implemented (Correct answer)
An automated control substituted for a manual one
A control that compensates for the cost of security investments

Correct answer: An alternative control that provides equivalent protection when the required control cannot be implemented

A compensating control provides equivalent or comparable protection to the required control when the latter is technically or operationally infeasible to implement.

Question 6: In the CAP authorization framework, which NIST document provides guidance on cryptographic key management?

NIST SP 800-37
NIST SP 800-53
NIST SP 800-30
NIST SP 800-57 (Correct answer)

Correct answer: NIST SP 800-57

NIST SP 800-57 (Recommendation for Key Management) provides comprehensive guidance on key generation, distribution, storage, and destruction.

Question 7: What is the typical validity period for an Authorization to Operate (ATO) issued under FISMA?

5 years
2 years
1 year
3 years (Correct answer)

Correct answer: 3 years

Under FISMA, an ATO is typically valid for three years, after which the system must undergo reauthorization unless continuous monitoring replaces periodic reauthorization.

Question 8: In Certified Authorization Professional, what is a risk matrix used for?

Evaluating risks based on likelihood and impact (Correct answer)
Tracking employee performance
Calculating project budgets
Scheduling team meetings

Correct answer: Evaluating risks based on likelihood and impact

A risk matrix plots risks on a grid of likelihood versus impact, helping prioritize which risks need the most attention.

Question 9: In a multi-tenant cloud environment, which threat involves one tenant accessing another tenant's data or resources?

Insider threat
Tenant isolation breach (Correct answer)
Side-channel attack
Data remanence

Correct answer: Tenant isolation breach

A tenant isolation breach occurs when logical or physical boundaries between tenants fail, allowing unauthorized cross-tenant data access.

Question 10: What does accountability mean in Certified Authorization Professional team management?

Avoiding difficult conversations
Taking ownership of responsibilities and outcomes (Correct answer)
Blaming others for mistakes
Only reporting successes

Correct answer: Taking ownership of responsibilities and outcomes

Accountability means taking ownership of assigned responsibilities and being answerable for the outcomes, whether positive or negative.

Question 11: What is the purpose of an access control list (ACL)?

To allow unrestricted access to all resources
To define and enforce access permissions (Correct answer)
To disable user authentication
To provide anonymous access

Correct answer: To define and enforce access permissions

An Access Control List (ACL) is a list of permissions attached to an object, such as a file or directory, that specifies which users or system processes are granted access and what operations they are allowed to perform. ACLs are crucial for defining and enforcing granular access control, ensuring that only authorized entities can interact with specific resources. They act as a gatekeeper, dictating who can read, write, or execute data.

Question 12: What is the purpose of 'supplementation' during security control tailoring?

To document which controls were inherited from a common control provider.
To replace all baseline controls with organizational-specific alternatives.
To remove inapplicable controls from the baseline.
To add controls beyond the baseline to address residual risks or organizational policies. (Correct answer)

Correct answer: To add controls beyond the baseline to address residual risks or organizational policies.

Supplementation is the tailoring action of adding controls (or control enhancements) to the baseline to address risks not adequately covered by baseline controls, or to meet specific organizational or mission requirements. It is the opposite of scoping, which removes controls.

Question 13: Under the RMF, what is the minimum frequency for conducting vulnerability assessments on high-impact federal information systems per NIST SP 800-137?

Annually
Quarterly
Biannually (every 6 months)
Continuously or near-continuously (Correct answer)

Correct answer: Continuously or near-continuously

NIST SP 800-137 recommends continuous monitoring strategies for high-impact systems, moving beyond periodic snapshots to ongoing vulnerability detection.

Question 14: What is the primary purpose of a Plan of Action and Milestones (POA&M) in the RMF process?

To record user access permissions
To track and remediate identified security weaknesses and deficiencies (Correct answer)
To document system hardware inventory
To authorize a system for operation

Correct answer: To track and remediate identified security weaknesses and deficiencies

A POA&M documents identified security weaknesses, the resources required to fix them, scheduled completion dates, and responsible parties for remediation.

Question 15: What is the primary risk management benefit of implementing a 'zero trust architecture' in a federal environment?

It eliminates implicit trust based on network location, requiring continuous verification of all users and devices (Correct answer)
It grants users permanent access once identity is verified at login
It removes the need for perimeter firewalls, reducing infrastructure costs
It replaces the RMF authorization process for cloud-hosted systems

Correct answer: It eliminates implicit trust based on network location, requiring continuous verification of all users and devices

Zero trust eliminates the assumption that anything inside the network perimeter is trusted, requiring explicit verification of identity and context for every access request.

Question 16: When a significant change is made to an authorized system, what process must the ISSO initiate before implementing the change?

Security Impact Analysis (SIA) (Correct answer)
Privacy Threshold Analysis (PTA)
Full reauthorization
Emergency Change Request filed with OMB

Correct answer: Security Impact Analysis (SIA)

A Security Impact Analysis (SIA) evaluates the potential security effects of a proposed change before implementation to determine if reauthorization is required.

Question 17: During a penetration test, a tester discovers a system running an unpatched version of Apache with a known remote code execution vulnerability. What is the FIRST step before attempting exploitation?

Verify the finding is within the authorized scope of the Rules of Engagement (Correct answer)
Report the finding to the system owner and stop testing
Immediately exploit the vulnerability to demonstrate impact
Document and skip to the next vulnerability

Correct answer: Verify the finding is within the authorized scope of the Rules of Engagement

Before exploiting any vulnerability, testers must confirm the target system is within the authorized scope defined in the Rules of Engagement to avoid unauthorized access.

Question 18: Which of the following BEST describes the role of the Security Operations Center (SOC) in the incident response lifecycle?

The SOC is responsible for patching all vulnerabilities before incidents occur
The SOC manages business continuity and disaster recovery plans
The SOC provides continuous monitoring and serves as the initial detection and triage capability for incidents (Correct answer)
The SOC is responsible for authorizing systems and issuing ATOs

Correct answer: The SOC provides continuous monitoring and serves as the initial detection and triage capability for incidents

The SOC provides 24/7 monitoring, initial detection, and triage of security events, serving as the front line of the incident response process.

Question 19: Which type of authentication token generates a one-time password synchronized to a time-based algorithm, satisfying the AAL2 requirement under NIST SP 800-63B?

Knowledge-based authentication (KBA)
TOTP hardware token (Correct answer)
Email magic link
SMS-based OTP

Correct answer: TOTP hardware token

TOTP hardware tokens are phishing-resistant single-factor cryptographic devices that meet NIST 800-63B AAL2 requirements.

Question 20: When should risk assessments be updated in Certified Authorization Professional?

Regularly and whenever significant changes occur (Correct answer)
Only at the beginning of a project
Only after an incident happens
Once per year at annual review

Correct answer: Regularly and whenever significant changes occur

Risk assessments should be living documents, updated regularly and whenever there are significant changes in conditions, processes, or scope.

Question 21: During a physical penetration test, a tester gains unauthorized access to a server room by tailgating an authorized employee. What type of attack does this represent?

Eavesdropping
Shoulder Surfing
Social Engineering - Tailgating/Piggybacking (Correct answer)
Dumpster Diving

Correct answer: Social Engineering - Tailgating/Piggybacking

Tailgating (or piggybacking) is a physical social engineering technique where an unauthorized person follows an authorized individual through a secured entry point.

Question 22: A security control is found to be 'not applicable' during an assessment. What is the CORRECT action?

Automatically mark the control as failed
Document the rationale for non-applicability and seek AO approval if required (Correct answer)
Remove the control from the SSP entirely
Treat it as a high-risk finding in the POA&M

Correct answer: Document the rationale for non-applicability and seek AO approval if required

Controls that are not applicable must have documented rationale, and the AO may need to formally accept the non-applicability determination.

Question 23: What is a risk register in Certified Authorization Professional practice?

An employee directory
A financial ledger
A sign-in sheet for safety meetings
A documented list of identified risks with their analysis and response plans (Correct answer)

Correct answer: A documented list of identified risks with their analysis and response plans

A risk register is a document that records all identified risks, their assessment, and planned responses for tracking and management.

Question 24: An organization must report a breach of unsecured PHI to HHS. If the breach affects 500 or more individuals, what is the notification deadline?

30 days
45 days
60 days
Within 60 days of discovery (Correct answer)

Correct answer: Within 60 days of discovery

HIPAA Breach Notification Rule requires covered entities to notify HHS of breaches affecting 500+ individuals within 60 calendar days of discovering the breach.

Question 25: A penetration tester successfully performs DNS spoofing to redirect users to a malicious site. Which security principle is primarily violated in this attack scenario?

Integrity (Correct answer)
Availability
Non-repudiation
Confidentiality

Correct answer: Integrity

DNS spoofing violates integrity by corrupting the authentic mapping between domain names and IP addresses, directing users to unauthorized destinations.

Question 26: What is the purpose of a 'threat intelligence feed' in security monitoring operations?

Generate compliance reports for auditors
Automatically patch known vulnerabilities
Provide current information on attacker tactics, indicators of compromise, and emerging threats (Correct answer)
Monitor user behavior analytics across the enterprise

Correct answer: Provide current information on attacker tactics, indicators of compromise, and emerging threats

Threat intelligence feeds provide timely information about adversary tactics, techniques, procedures (TTPs), and indicators that help detect and respond to threats.

Question 27: Which federal regulation requires agencies to conduct periodic security assessments of information systems, including vulnerability assessments?

FISMA (Federal Information Security Modernization Act) (Correct answer)
PCI DSS Requirement 11
HIPAA Security Rule
SOX Section 404

Correct answer: FISMA (Federal Information Security Modernization Act)

FISMA mandates that federal agencies implement security programs including periodic assessments of controls for all federal information systems.

Question 28: What is the primary risk of using a federated identity system to authenticate users to cloud services?

Compromise of the identity provider affects all federated services (Correct answer)
Increased latency for authentication requests
Inability to use MFA with federated accounts
Loss of audit logs for authentication events

Correct answer: Compromise of the identity provider affects all federated services

If the identity provider (IdP) is compromised, attackers can gain access to all services that trust it, making the IdP a critical single point of failure.

Question 29: Which of the following best describes a 'security control overlay' in NIST SP 800-53?

The process of mapping controls from one framework (e.g., ISO 27001) to NIST SP 800-53.
A custom baseline created by an individual organization for its own internal use.
An additional layer of encryption applied on top of existing security controls.
A community-wide tailoring of the security control catalog for a specific technology type, environment, or mission. (Correct answer)

Correct answer: A community-wide tailoring of the security control catalog for a specific technology type, environment, or mission.

Overlays are tailored baselines developed for specific communities of interest (e.g., cloud systems, healthcare, Industrial Control Systems). They adjust the baseline controls to reflect the unique requirements of that environment and are approved for community-wide use.

Question 30: Which regulation requires federal agencies to conduct Privacy Impact Assessments (PIAs) before developing or procuring IT systems that collect personally identifiable information?

E-Government Act of 2002 (Correct answer)
FISMA 2014
OMB Memorandum M-03-22
Privacy Act of 1974

Correct answer: E-Government Act of 2002

Section 208 of the E-Government Act of 2002 requires federal agencies to conduct and publish Privacy Impact Assessments for systems that collect, maintain, or disseminate PII.

Question 31: In the context of CAP and the RMF, what does the principle of 'least privilege' require?

Users receive only the minimum access rights necessary to perform their job functions (Correct answer)
Only privileged administrators can access classified information
Systems are designed with the fewest possible security controls
Security policies must be kept as simple as possible

Correct answer: Users receive only the minimum access rights necessary to perform their job functions

Least privilege requires that users, processes, and systems are granted only the minimum permissions necessary to accomplish their authorized tasks, reducing the attack surface.

Question 32: Which document formally defines the boundary of an information system for authorization purposes?

System Security Plan (SSP) authorization boundary section (Correct answer)
Security Assessment Plan (SAP)
Plan of Action and Milestones (POA&M)
Risk Assessment Report (RAR)

Correct answer: System Security Plan (SSP) authorization boundary section

The SSP's authorization boundary section explicitly defines what hardware, software, interfaces, and data are included within the system subject to the ATO.

Question 33: Which authentication assurance level under NIST SP 800-63B permits the use of memorized secrets (passwords) alone as an acceptable authenticator for low-risk applications?

AAL1 (Correct answer)
AAL0
AAL2
AAL3

Correct answer: AAL1

AAL1 requires at minimum single-factor authentication and permits the use of a memorized secret (password) as the sole authenticator.

Question 34: What is the primary purpose of a Rules of Engagement (ROE) document in the context of federal penetration testing?

To outline remediation steps for discovered vulnerabilities
To define the scope, constraints, and authorized actions for the assessment (Correct answer)
To establish the reporting format for test results
To document all vulnerabilities found during testing

Correct answer: To define the scope, constraints, and authorized actions for the assessment

Rules of Engagement define what is in scope, what actions are permitted, and the boundaries testers must operate within during the assessment.

Question 35: Which section of a System Security Plan (SSP) describes how a system processes, stores, and transmits information?

Security Controls
Information System Description (Correct answer)
System Identification
System Environment

Correct answer: Information System Description

The Information System Description section of an SSP provides an overview of the system's purpose, architecture, and how it handles information throughout its lifecycle.

Question 36: A security assessor is evaluating a system's resistance to brute-force attacks and finds no account lockout policy. Which NIST SP 800-53 control family is most directly relevant to this finding?

IA - Identification and Authentication (Correct answer)
AU - Audit and Accountability
SC - System and Communications Protection
AC - Access Control

Correct answer: IA - Identification and Authentication

The IA (Identification and Authentication) control family includes controls like IA-5 that address authenticator management, including account lockout policies.

Question 37: A federal system processes both FOUO (For Official Use Only) and publicly releasable information. What is the most appropriate data handling control?

Separate the data with access controls and label all FOUO information appropriately (Correct answer)
Encrypt all data regardless of sensitivity to avoid categorization
Classify all data at the highest sensitivity level present
Make all data publicly available since some is already public

Correct answer: Separate the data with access controls and label all FOUO information appropriately

Mixed-sensitivity systems must segregate data, apply appropriate labels, and enforce access controls so that FOUO data is only accessible to authorized users.

Question 38: How does compliance impact risk management in cybersecurity?

It allows organizations to bypass security policies
It increases security risks
It eliminates the need for risk management
It helps reduce risk and meet regulations (Correct answer)

Correct answer: It helps reduce risk and meet regulations

Compliance significantly impacts risk management by providing a structured framework of mandatory security requirements and best practices. Adhering to these regulations often necessitates implementing robust security controls, which inherently reduces an organization's overall risk exposure. It also ensures legal and ethical obligations are met, avoiding penalties and reputational damage.

Question 39: Which NIST RMF step involves granting an Authority to Operate (ATO) after reviewing residual risk?

Select
Authorize (Correct answer)
Categorize
Assess

Correct answer: Authorize

The Authorize step is where the Authorizing Official (AO) reviews the security assessment package and decides whether to grant, deny, or conditionally grant an ATO.

Question 40: What is the purpose of a risk assessment in cybersecurity?

To ignore security threats
To avoid implementing security measures
To replace incident response procedures
To evaluate threats and vulnerabilities (Correct answer)

Correct answer: To evaluate threats and vulnerabilities

The purpose of a risk assessment in cybersecurity is to systematically identify and analyze potential threats, such as malware or insider threats, and existing vulnerabilities, like unpatched software or weak configurations. By evaluating these factors, organizations can understand the potential impact and likelihood of security incidents. This understanding informs decisions on how to prioritize and implement security controls.

Question 41: NIST SP 800-53A defines three assessment methods. Which set correctly identifies all three?

Observe, Document, Verify
Review, Audit, Penetrate
Scan, Analyze, Report
Examine, Interview, Test (Correct answer)

Correct answer: Examine, Interview, Test

NIST SP 800-53A defines three assessment methods: Examine (reviewing documentation and artifacts), Interview (discussing controls with personnel), and Test (exercising the control through technical or operational means). These three methods together provide comprehensive coverage of control effectiveness.

Question 42: What type of authorization boundary defines the scope of an information system for RMF documentation purposes?

Physical perimeter
Network perimeter
Authorization boundary (Correct answer)
Trust boundary

Correct answer: Authorization boundary

The authorization boundary defines all components (hardware, software, data, and users) that are included within the scope of the security authorization package.

Question 43: Which type of security assessment methodology involves testing without prior knowledge of the system's internal architecture?

White-box testing
Gray-box testing
Black-box testing (Correct answer)
Red-team testing

Correct answer: Black-box testing

Black-box testing simulates an external attacker who has no prior knowledge of the system's internal structure or configurations.

Question 44: In a shared responsibility model, who is responsible for patching the hypervisor in an IaaS environment?

The cloud service provider (Correct answer)
A third-party auditor
The data owner
The tenant/customer

Correct answer: The cloud service provider

In IaaS, the cloud service provider owns and patches the hypervisor layer; the customer manages OS and above.

Question 45: An agency's AO reviews an authorization package and determines the residual risk is too high to accept. What authorization decision should the AO issue?

Common Control Authorization
Denial of Authorization to Operate (DATO) (Correct answer)
Authorization to Operate with Conditions
Interim Authority to Test (IATT)

Correct answer: Denial of Authorization to Operate (DATO)

A DATO is issued when the AO determines that residual risk exceeds acceptable thresholds and the system cannot be authorized to operate.

Question 46: An organization receives an alert that a critical server is communicating with a known malicious IP address. What is the MOST appropriate immediate containment action?

Change all user passwords on the system
Reimage the server immediately
Update antivirus signatures on the server
Isolate the server from the network while preserving forensic evidence (Correct answer)

Correct answer: Isolate the server from the network while preserving forensic evidence

Network isolation stops ongoing communication with the attacker while preserving evidence needed for forensic investigation.

Question 47: A federal system is categorized as MODERATE impact. Which NIST SP 800-53 security control baseline should be applied as the starting point?

The MODERATE baseline. (Correct answer)
The LOW baseline, then augmented as needed.
No baseline — controls are selected individually for each system.
The HIGH baseline, then scoped down.

Correct answer: The MODERATE baseline.

NIST SP 800-53 defines three control baselines (LOW, MODERATE, HIGH) aligned to FIPS 199 impact levels. A MODERATE-categorized system uses the MODERATE baseline as its starting point before any tailoring.

Question 48: Under FISMA, which role is responsible for ensuring that information systems under their authority are covered by an approved authorization?

Information System Security Officer (ISSO)
System Owner
Chief Information Officer (CIO)
Authorizing Official (AO) (Correct answer)

Correct answer: Authorizing Official (AO)

The Authorizing Official is the senior federal official who bears ultimate accountability for accepting risk and ensuring systems have an approved ATO.

Question 49: A cloud service provider maintains shared infrastructure used by multiple federal agencies. Which NIST document specifically guides security for such multi-tenant environments under the federal authorization process?

NIST SP 800-145
NIST SP 800-171
NIST SP 800-37
FedRAMP Authorization Framework (Correct answer)

Correct answer: FedRAMP Authorization Framework

FedRAMP provides a standardized approach to security assessment and authorization for cloud services used by federal agencies.

Question 50: Which DNS security extension helps prevent DNS cache poisoning by digitally signing DNS records?

DNS sinkholes
DNS over HTTPS (DoH)
DNSSEC (Correct answer)
Split-horizon DNS

Correct answer: DNSSEC

DNSSEC uses cryptographic signatures to verify the authenticity and integrity of DNS responses, preventing cache poisoning attacks.

Question 51: What is the role of documentation in Incident Response & Recovery for Certified Authorization Professional?

It should only be done monthly
It is only for management review
It provides an accurate record for accountability and reference (Correct answer)
It is unnecessary paperwork

Correct answer: It provides an accurate record for accountability and reference

Proper documentation in Incident Response & Recovery ensures accountability, traceability, and serves as a reference for future decisions.

Question 52: Which NIST publication specifically addresses the implementation of an Information Security Continuous Monitoring (ISCM) program?

NIST SP 800-53
NIST SP 800-30
NIST SP 800-137 (Correct answer)
NIST SP 800-61

Correct answer: NIST SP 800-137

NIST SP 800-137 provides guidance for building and maintaining an Information Security Continuous Monitoring (ISCM) program.

Question 53: Which NIST publication provides guidance specifically on security and privacy controls for federal information systems and organizations?

NIST SP 800-30
NIST SP 800-137
NIST SP 800-37
NIST SP 800-53 (Correct answer)

Correct answer: NIST SP 800-53

NIST SP 800-53 is the primary catalog of security and privacy controls for federal information systems, organized into families and with multiple control baselines.

Question 54: Which data protection control prevents a malicious insider from exfiltrating sensitive data via email or removable media?

Mandatory access control (MAC) labels on all files
Data Loss Prevention (DLP) tools and media access controls (Correct answer)
Full disk encryption on all workstations
Network intrusion detection systems (IDS)

Correct answer: Data Loss Prevention (DLP) tools and media access controls

DLP tools inspect content leaving the organization via email, web, or removable media, and media access controls restrict USB and other removable storage usage.

Question 55: A penetration test reveals that a web application stores session tokens in plaintext cookies. Which security principle is most directly violated?

Integrity of audit logs
Non-repudiation of user transactions
System availability and redundancy
Confidentiality of session data and least privilege for session management (Correct answer)

Correct answer: Confidentiality of session data and least privilege for session management

Plaintext session tokens expose confidential authentication data and violate least privilege by allowing any interceptor to assume a user's session privileges.

Question 56: The Children's Online Privacy Protection Act (COPPA) applies to websites collecting personal information from children under what age?

13 (Correct answer)
16
21
18

Correct answer: 13

COPPA applies to operators of commercial websites and online services directed to children under 13, requiring parental consent before collecting personal information.

Question 57: During a penetration test on a federal system, a tester successfully extracts password hashes from a domain controller. Which post-exploitation technique involves using these hashes without cracking them?

Privilege Escalation
Credential Stuffing
Pass-the-Hash (Correct answer)
Rainbow Table Attack

Correct answer: Pass-the-Hash

Pass-the-Hash allows attackers to authenticate using captured NTLM hashes directly without needing the plaintext password.

Question 58: A web application verifies that an authenticated user can only access their own account records and not those of other users. This check enforces:

Horizontal access control (Correct answer)
Mandatory access control
Discretionary access control
Vertical access control

Correct answer: Horizontal access control

Horizontal access control restricts users at the same privilege level from accessing each other's data — failure causes insecure direct object reference (IDOR) vulnerabilities.

Question 59: What is the primary goal of data protection in information systems?

To secure data from unauthorized access (Correct answer)
To prevent data backups
To delete data frequently
To allow unrestricted data access

Correct answer: To secure data from unauthorized access

The primary goal of data protection in information systems is to secure data from unauthorized access, disclosure, alteration, or destruction. This involves implementing various security measures to ensure data confidentiality, integrity, and availability. Protecting data is crucial for maintaining privacy, complying with regulations, and preserving trust in an organization's systems and services.

Question 60: What is the primary risk of relying exclusively on open-source intelligence (OSINT) for threat analysis?

OSINT requires classified access to obtain
OSINT is too expensive for most organizations
OSINT may lack specificity and contain outdated or inaccurate information (Correct answer)
OSINT lacks timeliness because it is only updated annually

Correct answer: OSINT may lack specificity and contain outdated or inaccurate information

OSINT is publicly available and may lack specificity, timeliness, or accuracy compared to intelligence gathered through classified or proprietary means.

Question 61: A company wants to ensure its SaaS vendor meets baseline security requirements. Which document formalizes these security expectations?

Memorandum of Understanding (MOU)
Business Impact Analysis (BIA)
Security requirements annex or cloud security addendum (Correct answer)
Service Level Agreement (SLA)

Correct answer: Security requirements annex or cloud security addendum

A security requirements annex or cloud security addendum formally documents and enforces the specific security controls expected from a SaaS vendor.

Question 62: A federal agency's Incident Response Plan requires testing. Which test type provides the MOST realistic assessment of the plan's effectiveness?

Tabletop exercise
Checklist review
Full-scale simulation exercise (Correct answer)
Parallel test

Correct answer: Full-scale simulation exercise

A full-scale simulation exercise activates actual response procedures and personnel, providing the most realistic test of both the plan and the team's execution capability.

Question 63: Which approach best supports quality outcomes in Security Operations & Monitoring for Certified Authorization Professional?

Avoiding quality checks
Relying solely on intuition
Systematic application of evidence-based methods (Correct answer)
Rushing through tasks

Correct answer: Systematic application of evidence-based methods

Evidence-based methods provide a reliable foundation for achieving consistent, high-quality outcomes.

Question 64: Which of the following BEST describes the concept of 'defense in depth' as applied to access control?

Layering multiple independent access control mechanisms so that failure of one does not compromise the system (Correct answer)
Requiring users to change passwords every 30 days
Using a single, highly configured firewall as the sole access control mechanism
Encrypting all data at rest and in transit to prevent unauthorized access

Correct answer: Layering multiple independent access control mechanisms so that failure of one does not compromise the system

Defense in depth applies multiple overlapping access control layers so that bypassing or failing one control does not grant full access to a resource.

Question 65: What does risk mitigation mean in Certified Authorization Professional practice?

Taking steps to reduce the likelihood or impact of identified risks (Correct answer)
Accepting all risks without action
Eliminating all risks completely
Ignoring low-level risks

Correct answer: Taking steps to reduce the likelihood or impact of identified risks

Risk mitigation involves implementing strategies to reduce either the probability of a risk occurring or its potential impact.

Question 66: What is the purpose of a 'warm site' in disaster recovery planning compared to a cold site?

A warm site has pre-installed hardware and software but requires data restoration, unlike a cold site which has only space and power (Correct answer)
A warm site is geographically closer to the primary site than a cold site
A warm site provides full redundancy with live data replication
A warm site is only used for classified systems

Correct answer: A warm site has pre-installed hardware and software but requires data restoration, unlike a cold site which has only space and power

A warm site has necessary hardware and software infrastructure pre-configured, reducing activation time compared to a cold site, but still requires restoring data from backups before operations resume.

Question 67: A security assessment reveals that accounts for contractors are not disabled within 24 hours of contract expiration. Under NIST SP 800-53, which control is not being met?

IA-4 – Identifier Management
AU-9 – Protection of Audit Information
AC-2 – Account Management (Correct answer)
PS-4 – Personnel Termination

Correct answer: AC-2 – Account Management

AC-2 requires organizations to manage accounts throughout their lifecycle, including timely deactivation upon contract completion or personnel departure.

Question 68: Which NIST SP 800-137 concept refers to the ongoing process of monitoring security controls to maintain awareness of the system's security posture over time?

Ongoing Authorization
Control Effectiveness Testing
Security Impact Analysis (SIA)
Information Security Continuous Monitoring (ISCM) (Correct answer)

Correct answer: Information Security Continuous Monitoring (ISCM)

ISCM, defined in NIST SP 800-137, is the ongoing process of maintaining situational awareness of information security to support risk management decisions.

Question 69: What is the primary objective of risk management in cybersecurity?

To ignore minor security threats
To avoid compliance requirements
To eliminate all risks completely
To identify, assess, and mitigate risks (Correct answer)

Correct answer: To identify, assess, and mitigate risks

The primary objective of risk management in cybersecurity is not to eliminate all risks, which is often impossible, but rather to systematically identify potential threats and vulnerabilities. Once identified, these risks are assessed for their likelihood and impact, and then appropriate measures are implemented to mitigate them to an acceptable level. This proactive approach protects information assets effectively.

Question 70: Which federal agency is responsible for developing mandatory standards (FIPS) and voluntary guidelines (SP 800-series) for federal information systems under FISMA?

The Department of Homeland Security (DHS)
The National Institute of Standards and Technology (NIST) (Correct answer)
The Office of Management and Budget (OMB)
The Government Accountability Office (GAO)

Correct answer: The National Institute of Standards and Technology (NIST)

FISMA explicitly tasks NIST with developing FIPS (Federal Information Processing Standards, which are mandatory) and Special Publications in the 800-series (which are guidelines). DHS handles operational oversight; OMB handles policy; GAO audits compliance — but only NIST creates the technical standards.

Question 71: What is the primary difference between quantitative and qualitative risk analysis methods?

Quantitative is required by FISMA; qualitative is optional
Quantitative is faster to perform; qualitative requires specialized tools
Quantitative assigns numeric values to risk; qualitative uses descriptive categories like High/Medium/Low (Correct answer)
Quantitative analyzes threats; qualitative analyzes vulnerabilities

Correct answer: Quantitative assigns numeric values to risk; qualitative uses descriptive categories like High/Medium/Low

Quantitative risk analysis uses numerical values (e.g., dollar amounts, probabilities) while qualitative analysis uses descriptive scales to rank risk levels.

Question 72: Which of the following is the PRIMARY purpose of an access control list (ACL) on a file system?

Encrypting file contents to prevent unauthorized reading
Specifying which users or groups can perform specific operations on a resource (Correct answer)
Authenticating users before granting system entry
Logging all access attempts for audit purposes

Correct answer: Specifying which users or groups can perform specific operations on a resource

An ACL is a list of permissions attached to a resource that specifies which subjects can perform which operations (read, write, execute) on it.

Question 73: Which authorization concept is violated when a developer has both write access to production code AND the ability to deploy it to production without review?

Least privilege
Separation of duties (Correct answer)
Non-repudiation
Need to know

Correct answer: Separation of duties

Allowing one person to both write and deploy code removes the check-and-balance that separation of duties is designed to provide.

Question 74: A risk response strategy where the organization implements controls to reduce the likelihood or impact of a threat is called:

Risk mitigation (risk reduction) (Correct answer)
Risk avoidance
Risk acceptance
Risk transfer

Correct answer: Risk mitigation (risk reduction)

Risk mitigation involves implementing security controls or countermeasures to reduce either the probability of a threat occurring or its potential impact.

Question 75: What is the purpose of the 'Deny by Default' principle in the context of least privilege and access control risk management?

Network traffic is denied at perimeter firewalls unless whitelisted by the ISSO
All users are denied access after business hours by default
All access is denied unless explicitly granted, reducing the attack surface (Correct answer)
Administrative access is denied unless dual authorization is obtained

Correct answer: All access is denied unless explicitly granted, reducing the attack surface

Deny by default means no access is permitted unless explicitly authorized, ensuring that only necessary permissions are granted and reducing exposure to unauthorized access.

Question 76: Which NIST publication provides guidance for mapping information types to security impact levels during the categorization step of the RMF?

NIST SP 800-37
NIST SP 800-137
NIST SP 800-60 (Correct answer)
NIST SP 800-53

Correct answer: NIST SP 800-60

NIST SP 800-60 ('Guide for Mapping Types of Information and Information Systems to Security Categories') is the companion to FIPS 199 and provides the taxonomy of information types with recommended impact levels for each.

Question 77: During system categorization, a hospital's patient-monitoring system that, if unavailable, could result in patient death would most likely have which availability impact rating?

LOW
CRITICAL — a fourth tier used for life-safety systems
MODERATE
HIGH (Correct answer)

Correct answer: HIGH

A system whose unavailability could directly cause loss of human life meets the FIPS 199 definition of HIGH impact (severe or catastrophic adverse effect on individuals). There is no fourth 'CRITICAL' tier in FIPS 199.

Question 78: How does collaboration enhance Security Operations & Monitoring in Certified Authorization Professional?

It slows down the process
It brings diverse perspectives and improves outcomes (Correct answer)
It reduces individual accountability
It creates unnecessary meetings

Correct answer: It brings diverse perspectives and improves outcomes

Collaboration brings together different viewpoints and expertise, leading to better decision-making and outcomes.

Question 79: What is a fundamental principle of Security Operations & Monitoring in Certified Authorization Professional practice?

Working in isolation without guidance
Ignoring industry guidelines
Following established standards and best practices (Correct answer)
Using outdated methods

Correct answer: Following established standards and best practices

Following established standards and best practices ensures quality and consistency in Security Operations & Monitoring.

Question 80: Which control baseline under NIST SP 800-53 is appropriate for a system categorized as MODERATE impact?

Moderate baseline controls with tailoring as needed (Correct answer)
No baseline — all controls are selected ad hoc
High baseline controls without tailoring
Low baseline controls only

Correct answer: Moderate baseline controls with tailoring as needed

NIST SP 800-53 provides low, moderate, and high baselines; MODERATE impact systems use the moderate baseline, which can be tailored to organizational needs.

Question 81: Which document type defines the specific test procedures used to assess whether security controls are implemented correctly?

Interconnection Security Agreement (ISA)
Security Assessment Plan (SAP) (Correct answer)
Privacy Impact Assessment (PIA)
System Security Plan (SSP)

Correct answer: Security Assessment Plan (SAP)

The Security Assessment Plan (SAP) defines the scope, schedule, assessment methods, and test procedures the assessor will use to evaluate security controls.

Question 82: Which tailoring action allows an organization to remove a security control from the baseline because it is not applicable to the system's operating environment?

Compensating control substitution
Overlay application
Supplementation
Scoping (Correct answer)

Correct answer: Scoping

Scoping involves applying specific guidance to adjust the baseline — including eliminating controls that are not applicable (e.g., removing mobile device controls from a system that has no mobile interfaces). Supplementation adds controls; overlays are community-wide tailoring guidance; compensating controls substitute when a baseline control cannot be implemented.

Question 83: What term describes the minimum set of security controls required for a given impact level (Low, Moderate, High) under NIST SP 800-53?

Security Overlay
Security Control Baseline (Correct answer)
Control Tailoring Guidance
Compensating Control

Correct answer: Security Control Baseline

A security control baseline is the predefined starting set of controls recommended by NIST for Low, Moderate, or High impact systems before tailoring.

Question 84: Which of the following is an example of a DETECTIVE security control in an operational environment?

Multi-factor authentication
Role-based access control
Intrusion Detection System (IDS) (Correct answer)
Encryption of data at rest

Correct answer: Intrusion Detection System (IDS)

An IDS is a detective control because it identifies and alerts on potential malicious activity rather than preventing or correcting it.

Question 85: What is the significance of 'continuous monitoring' documentation in the context of maintaining an ATO?

It provides ongoing evidence that security controls remain effective and risks stay within accepted levels (Correct answer)
It replaces the need for an SSP after initial authorization
It documents physical security inspections only
It satisfies FISMA annual training requirements

Correct answer: It provides ongoing evidence that security controls remain effective and risks stay within accepted levels

Continuous monitoring documentation demonstrates that security controls remain effective over time, supporting ongoing authorization and keeping the ATO valid.

Question 86: Maximum Tolerable Downtime (MTD) is the metric that defines which boundary in continuity planning?

The time required to activate an alternate processing site
The absolute longest period a mission-essential function can be disrupted before causing catastrophic impact (Correct answer)
The number of hours between scheduled system maintenance windows
The point at which data loss becomes unrecoverable

Correct answer: The absolute longest period a mission-essential function can be disrupted before causing catastrophic impact

MTD (also called Maximum Tolerable Period of Disruption) represents the threshold beyond which operational disruption would result in unacceptable mission, business, or legal consequences.

Question 87: An assessor discovers a control is 'not applicable' for a cloud-hosted system. What is the appropriate next step?

Automatically rate the control as 'not satisfied' in the SAR
Apply the control anyway to avoid compliance issues
Document the rationale for non-applicability and obtain approval through the tailoring process (Correct answer)
Remove the control from the SSP without documentation

Correct answer: Document the rationale for non-applicability and obtain approval through the tailoring process

Tailoring allows removal of controls that are not applicable, but the rationale must be documented in the SSP and approved by the AO.

Question 88: An agency is moving a HIGH impact system to a FedRAMP-authorized cloud. Which statement is correct regarding inherited controls?

The agency inherits controls provided by the CSP but retains responsibility for customer-responsible controls (Correct answer)
The agency must re-assess all inherited controls independently every 90 days
FedRAMP authorization eliminates the need for an agency ATO
All security controls transfer fully to the cloud provider upon migration

Correct answer: The agency inherits controls provided by the CSP but retains responsibility for customer-responsible controls

FedRAMP uses a shared responsibility model where CSP-provided controls are inherited by the agency, but customer-responsible controls remain the agency's obligation.

Question 89: How does biometric authentication improve access control?

It reduces identity verification accuracy
It makes access control less secure
It eliminates the need for access control policies
It verifies identity using unique physical traits (Correct answer)

Correct answer: It verifies identity using unique physical traits

Biometric authentication improves access control by verifying identity using unique physical or behavioral traits, such as fingerprints, facial patterns, or iris scans. This method is highly secure because biometric traits are difficult to forge, steal, or forget, unlike passwords. It offers a convenient and robust way to confirm a user's identity, significantly strengthening the authentication process and reducing the risk of unauthorized access.

Question 90: An Interconnection Security Agreement (ISA) is required when two federal information systems need to share data. What does the ISA primarily document?

Security requirements and responsibilities for the connection between systems (Correct answer)
Encryption algorithms used for data at rest
User account provisioning procedures
Audit log retention schedules

Correct answer: Security requirements and responsibilities for the connection between systems

An ISA documents the technical and security requirements, roles, and responsibilities governing a specific connection between two interconnected information systems.

Question 91: An assessor discovers that a web application is vulnerable to SQL injection. Which CWE identifier is most directly associated with this vulnerability class?

CWE-79
CWE-119
CWE-89 (Correct answer)
CWE-200

Correct answer: CWE-89

CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the Common Weakness Enumeration entry for SQL injection vulnerabilities.

Question 92: Which of the following items is NOT typically included in an authorization package submitted to the Authorizing Official?

Penetration Test Scope Agreement (Correct answer)
System Security Plan (SSP)
Plan of Action and Milestones (POA&M)
Security Assessment Report (SAR)

Correct answer: Penetration Test Scope Agreement

The standard authorization package per NIST SP 800-37 consists of three core documents: the SSP, the SAR, and the POA&M. A penetration test scope agreement is a pre-engagement document used in contracting, not a formal component of the authorization package.

Question 93: What does 'mean time to respond' (MTTR) measure in a security operations context?

Average time for users to report security incidents
Average time from incident detection to containment or resolution (Correct answer)
Average time for a system to recover from a hardware failure
Average time to deploy a security patch enterprise-wide

Correct answer: Average time from incident detection to containment or resolution

MTTR measures the average elapsed time from when a security incident is detected to when it is contained or resolved.

Question 94: Recovery Point Objective (RPO) determines which aspect of disaster recovery planning?

The priority order of system restoration
The geographic distance between primary and backup data centers
The maximum acceptable amount of data loss measured in time (Correct answer)
The number of backup copies required for compliance

Correct answer: The maximum acceptable amount of data loss measured in time

RPO defines the maximum tolerable period of data loss, which directly drives backup frequency — if the RPO is 4 hours, backups must occur at least every 4 hours.

Question 95: An organization's systems are partially restored after a ransomware attack, but a decision must be made about declaring the incident closed. Who has the authority to make this declaration?

The system administrator who performed the restoration
The CISO alone
Any member of the incident response team
The designated Authorizing Official or senior management, not the technical team (Correct answer)

Correct answer: The designated Authorizing Official or senior management, not the technical team

Declaring an incident closed is a management decision, typically made by senior leadership or the AO, not solely by technical staff.

Question 96: A tester exploits a buffer overflow vulnerability to gain root access on a Linux server. What phase of the penetration testing lifecycle comes immediately after achieving this initial access?

Report Writing
Scanning and Enumeration
Post-Exploitation and Lateral Movement (Correct answer)
Reconnaissance

Correct answer: Post-Exploitation and Lateral Movement

After gaining initial access, testers move to post-exploitation to maintain persistence, escalate privileges, and move laterally through the network.

Question 97: Which framework is commonly used for risk management in information security?

HIPAA
NIST Risk Management Framework (RMF) (Correct answer)
PCI DSS
ISO 27001

Correct answer: NIST Risk Management Framework (RMF)

The NIST Risk Management Framework (RMF) is a widely recognized and comprehensive framework developed by the National Institute of Standards and Technology. It provides a structured, seven-step process for managing cybersecurity risks in information systems. The RMF is particularly prevalent in U.S. federal agencies and is often adopted by private sector organizations.

Question 98: Which of the following is a common access control model?

Random User Access
Role-Based Access Control (RBAC) (Correct answer)
Open Access Control
Public Access Model

Correct answer: Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) is a widely adopted access control model that assigns permissions to users based on their job functions or roles within an organization. This simplifies access management by granting rights to roles rather than individual users, ensuring that individuals only have the necessary access for their responsibilities. RBAC enhances security by centralizing control and reducing the risk of excessive or unauthorized privileges.

Question 99: Which federation protocol uses JSON Web Tokens (JWTs) to convey identity claims between an authorization server and a resource server?

SAML 2.0
Kerberos
OAuth 2.0 with OpenID Connect (Correct answer)
RADIUS

Correct answer: OAuth 2.0 with OpenID Connect

OpenID Connect layered on OAuth 2.0 uses JWTs (ID tokens) to communicate authenticated user identity claims.

Question 100: A federal contractor operating an information system that processes, stores, or transmits federal data on behalf of a federal agency is subject to FISMA requirements under which mechanism?

The federal agency includes FISMA and NIST control requirements in the contract, making the contractor's system subject to the same security requirements. (Correct answer)
Contractors must self-certify FISMA compliance annually to the Department of Commerce.
Only contractors with SECRET clearances are subject to FISMA.
Contractors are never subject to FISMA — it applies only to federal employees.

Correct answer: The federal agency includes FISMA and NIST control requirements in the contract, making the contractor's system subject to the same security requirements.

FISMA applies to federal agencies and extends to contractors through contractual requirements. Federal agencies must include information security requirements (aligned to NIST standards) in contracts with third-party providers who handle federal information, making those systems subject to the same RMF-based requirements as agency-owned systems.

Question 101: Which key component is essential in a security risk management plan?

Ignoring new threats
Continuous monitoring of security controls (Correct answer)
Relying only on annual assessments
Removing all access controls

Correct answer: Continuous monitoring of security controls

Continuous monitoring is an essential component of a robust security risk management plan because threats and vulnerabilities constantly evolve. It ensures that security controls remain effective over time and that any new risks or changes in the threat landscape are promptly detected and addressed. This ongoing vigilance is critical for maintaining an acceptable security posture.

Question 102: An organization uses a hot site for disaster recovery. What is the PRIMARY advantage of a hot site over a warm site?

Hot sites store only the most recent data backups
Hot sites cost significantly less than warm sites
Hot sites have fully operational systems that allow near-immediate failover (Correct answer)
Hot sites require no testing to validate readiness

Correct answer: Hot sites have fully operational systems that allow near-immediate failover

A hot site is a fully operational duplicate facility with current data that enables near-immediate failover, minimizing downtime compared to a warm site that requires setup time.

Question 103: What does 'defense in depth' mean as a security architecture strategy?

Implementing a single comprehensive security perimeter around the network
Using deep packet inspection at all network ingress and egress points
Building underground, hardened data centers resistant to physical attack
Deploying multiple layers of security controls throughout an information system so that failure of one does not compromise overall security (Correct answer)

Correct answer: Deploying multiple layers of security controls throughout an information system so that failure of one does not compromise overall security

Defense in depth applies multiple, overlapping security controls so that if one layer fails or is bypassed, additional layers continue to provide protection.

Question 104: Under NIST SP 800-53, which control requires that information systems protect the authenticity of communications sessions?

SC-23 (Session Authenticity) (Correct answer)
AC-17 (Remote Access)
IA-2 (Identification and Authentication)
SI-10 (Information Input Validation)

Correct answer: SC-23 (Session Authenticity)

SC-23 requires systems to protect session authenticity to prevent session hijacking and man-in-the-middle attacks on active communications.

Question 105: In the context of CAP assessments, what document formally captures the results of a security assessment including vulnerability findings and their risk levels?

Plan of Action and Milestones (POA&M)
System Security Plan (SSP)
Security Assessment Report (SAR) (Correct answer)
Authorization to Operate (ATO)

Correct answer: Security Assessment Report (SAR)

The Security Assessment Report documents all findings from the security assessment, including identified vulnerabilities, their severity, and recommendations.

Question 106: What is 'data remanence' in the context of cloud decommissioning?

Automatic data backup to secondary regions
Latency caused by geographic data distribution
Residual data remaining on storage media after deletion (Correct answer)
Encryption key expiration after workload termination

Correct answer: Residual data remaining on storage media after deletion

Data remanence refers to residual data that persists on storage media after deletion, posing a risk when cloud storage is reallocated to other tenants.

Question 107: Why is a security assessment critical in risk management?

To identify vulnerabilities before exploitation (Correct answer)
To delay compliance audits
To reduce the need for security policies
To eliminate all cybersecurity risks

Correct answer: To identify vulnerabilities before exploitation

A security assessment is a critical component of risk management because it systematically examines an organization's systems, networks, and applications for weaknesses. By proactively identifying vulnerabilities, organizations can address them before malicious actors can exploit them. This significantly reduces the likelihood of security breaches and data loss.

Question 108: Under FISMA and OMB policy, which type of federal system requires a Privacy Impact Assessment (PIA)?

Systems that collect, maintain, or disseminate personally identifiable information (PII) (Correct answer)
Systems operated by contractors on behalf of federal agencies
Systems with a FIPS 199 HIGH confidentiality impact
All federal systems regardless of data type

Correct answer: Systems that collect, maintain, or disseminate personally identifiable information (PII)

OMB Memorandum M-03-22 requires PIAs for federal systems that collect, maintain, or disseminate PII to evaluate privacy risks and protections.

Question 109: Which data protection technique renders data unusable to unauthorized parties if storage media is stolen, but retains full utility for authorized users?

Encryption at rest with proper key management (Correct answer)
Tokenization for all stored records
Data masking with static substitution
Hashing with SHA-256

Correct answer: Encryption at rest with proper key management

Encryption at rest with proper key management ensures that stolen media yields only ciphertext, while authorized users with valid keys can access plaintext data normally.

Question 110: Which authorization decision type allows a system to operate temporarily while known weaknesses are remediated, typically with strict conditions and a deadline?

Interim Authority to Test (IATT)
Common Control Authorization
Authorization to Operate with Conditions (ATOC) (Correct answer)
Denial of Authorization to Operate (DATO)

Correct answer: Authorization to Operate with Conditions (ATOC)

An ATOC (or conditional ATO) permits operation despite identified weaknesses, provided the system owner meets specified conditions and remediation timelines.

Question 111: Under the NIST Risk Management Framework, threat intelligence MOST directly supports which step?

Step 2: Select
Step 1: Categorize
Step 3: Implement
Step 4: Assess (Correct answer)

Correct answer: Step 4: Assess

Threat intelligence directly supports the Assess step by providing current threat data to evaluate whether implemented controls effectively address real-world risks.

Question 112: Which NIST publication provides guidance on conducting risk assessments and is used to support the RMF Categorize and Assess steps?

NIST SP 800-30 (Correct answer)
NIST SP 800-53A
NIST SP 800-137
NIST SP 800-60

Correct answer: NIST SP 800-30

NIST SP 800-30 ('Guide for Conducting Risk Assessments') provides the methodology for identifying, analyzing, and communicating risk to organizational operations.

Question 113: In the CVSS scoring system, which metric group assesses the characteristics of a vulnerability that cannot be changed over time?

Environmental Metrics
Base Metrics (Correct answer)
Temporal Metrics
Supplemental Metrics

Correct answer: Base Metrics

CVSS Base Metrics represent the intrinsic characteristics of a vulnerability that are constant across all deployments and time.

Question 114: Which NIST Special Publication provides the catalog of security and privacy controls for federal information systems and organizations?

NIST SP 800-37
NIST SP 800-137
NIST SP 800-30
NIST SP 800-53 (Correct answer)

Correct answer: NIST SP 800-53

NIST SP 800-53 provides a comprehensive catalog of security and privacy controls that federal agencies select and implement to protect their information systems.

Question 115: An organization cannot implement a required NIST SP 800-53 control due to a documented technical constraint. What is the correct approach?

Accept the risk without any alternative measure.
Remove the control from the Security Plan without documentation.
Implement a compensating control that provides equivalent protection, and document it. (Correct answer)
Escalate to NIST for a waiver of the control requirement.

Correct answer: Implement a compensating control that provides equivalent protection, and document it.

When a required control cannot be implemented, organizations should identify and implement a compensating control that provides equivalent or comparable protection. This must be documented in the Security Plan and approved by the Authorizing Official.

Question 116: A system owner wants to minimize data loss in the event of a ransomware attack. Which contingency planning element directly addresses this goal?

Backup and restoration strategy aligned with a low RPO (Correct answer)
System interconnection agreements
Business Impact Analysis (BIA)
Incident Response Team staffing plan

Correct answer: Backup and restoration strategy aligned with a low RPO

A backup and restoration strategy designed to meet a low Recovery Point Objective (RPO) directly limits how much data can be lost in the event of an attack.

Question 117: A system that stores Social Security Numbers and health records is being categorized. Which NIST publication maps information types to impact levels to support FIPS 199 categorization?

NIST SP 800-37
NIST SP 800-60 (Correct answer)
NIST SP 800-30
NIST SP 800-53

Correct answer: NIST SP 800-60

NIST SP 800-60 maps federal information and information system types to security impact levels for use in FIPS 199 categorization.

Question 118: Which cloud security architecture pattern places a security inspection layer between internet traffic and cloud-hosted applications?

Site-to-site VPN to the application subnet
Outbound NAT gateway
Direct peering with the cloud provider
Cloud-native WAF and reverse proxy (Correct answer)

Correct answer: Cloud-native WAF and reverse proxy

A cloud-native WAF (Web Application Firewall) and reverse proxy inspect and filter inbound HTTP/S traffic before it reaches the application tier.

Question 119: What type of network attack floods a switch's MAC address table to cause it to behave like a hub, broadcasting all frames?

ARP Spoofing
MAC Flooding (Correct answer)
STP Manipulation
VLAN Hopping

Correct answer: MAC Flooding

MAC flooding overflows a switch's CAM table with fake MAC addresses, causing the switch to broadcast traffic to all ports, enabling sniffing.

Question 120: Under the RMF, which role is responsible for developing and maintaining the System Security Plan (SSP)?

Information System Owner (ISO) (Correct answer)
Authorizing Official (AO)
Security Control Assessor (SCA)
Common Control Provider (CCP)

Correct answer: Information System Owner (ISO)

The Information System Owner (ISO) is responsible for developing, maintaining, and updating the SSP as the primary steward of the system's security documentation.

Question 121: Which NIST publication provides the catalog of security and privacy controls used to populate an SSP for federal systems?

NIST SP 800-37
NIST SP 800-30
NIST SP 800-61
NIST SP 800-53 (Correct answer)

Correct answer: NIST SP 800-53

NIST SP 800-53 provides the comprehensive catalog of security and privacy controls that federal agencies use to protect information systems and populate SSP control documentation.

Question 122: A threat actor uses legitimate cloud services as command-and-control (C2) infrastructure. Which threat intelligence technique is BEST suited to detect this behavior?

Port scanning for known C2 ports
Signature-based antivirus scanning
Behavioral analysis and anomaly detection (Correct answer)
IP blacklisting

Correct answer: Behavioral analysis and anomaly detection

Behavioral analysis and anomaly detection can identify malicious use of legitimate services by focusing on unusual patterns rather than known-bad indicators that attackers deliberately avoid.

Question 123: A federal agency discovers that a contractor's system storing agency data lacks an interconnection security agreement (ISA). What is the most immediate concern?

Unauthorized data flows may exist without documented controls or approvals (Correct answer)
The agency CIO must personally authorize all data transfers
The contractor cannot bill the agency for services rendered
The system automatically loses its ATO status

Correct answer: Unauthorized data flows may exist without documented controls or approvals

Without an ISA, there is no documented agreement on security controls, data handling, and responsibilities governing the interconnection, creating unmanaged risk.

Question 124: A penetration tester finds a misconfigured S3 bucket containing sensitive federal data. Under FISMA and the RMF, what must occur before this vulnerability can be formally accepted as residual risk?

The ISSO must verbally approve the risk
The penetration tester must remediate the issue directly
The Authorizing Official must formally accept the risk in writing (Correct answer)
The system owner must submit a change request

Correct answer: The Authorizing Official must formally accept the risk in writing

Under FISMA, the Authorizing Official must formally and explicitly accept residual risk in writing as part of the authorization decision.

Question 125: What is a fundamental principle of Incident Response & Recovery in Certified Authorization Professional practice?

Ignoring industry guidelines
Following established standards and best practices (Correct answer)
Using outdated methods
Working in isolation without guidance

Correct answer: Following established standards and best practices

Following established standards and best practices ensures quality and consistency in Incident Response & Recovery.

Question 126: A security assessor uses penetration testing during a control assessment. Under NIST SP 800-53A, this technique is classified as which assessment method?

Review
Examine
Test (Correct answer)
Interview

Correct answer: Test

NIST SP 800-53A defines three assessment methods — examine, interview, and test — with penetration testing classified under the 'test' method.

Certified Authorization Professional (CAP)

The ISC2 CAP (now rebranded as CGRC – Certified in Governance, Risk and Compliance) validates professionals' expertise in authorizing and maintaining information systems using risk management frameworks, security controls, and continuous monitoring within government and enterprise environments.

125

Questions

180 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

isc2.org — Score validity, score release, test delivery, eligibility, exam format, passing score, time limit · verified Oct 2026