Certified Authorization Professional (CAP) — Questions and Answers

Question 1: Under the Privacy Act of 1974, what is a 'system of records'?

A group of records under agency control from which information is retrieved by personal identifier (Correct answer)
A backup system that stores encrypted copies of production data
An inventory of all IT assets maintained by a federal agency
Any database containing classified national security information

Correct answer: A group of records under agency control from which information is retrieved by personal identifier

A Privacy Act system of records is a group of records under an agency's control from which information is retrieved by name, SSN, or other personal identifier.

Question 2: What is the primary output document produced at the conclusion of a security control assessment?

Plan of Action and Milestones (POA&M)
Security Assessment Report (SAR) (Correct answer)
Authorization to Operate (ATO) letter
System Security Plan (SSP)

Correct answer: Security Assessment Report (SAR)

The Security Assessment Report (SAR) documents the assessor's findings, including which controls are effective (satisfied), which are partially effective (other than satisfied), and which are ineffective (not satisfied). The SAR is a key input to the authorization decision.

Question 3: Which NIST publication provides the methodology for assessing the effectiveness of security controls in federal information systems?

NIST SP 800-137
NIST SP 800-60
NIST SP 800-37
NIST SP 800-53A (Correct answer)

Correct answer: NIST SP 800-53A

NIST SP 800-53A ('Assessing Security and Privacy Controls in Information Systems and Organizations') provides the procedures for assessing each control in NIST SP 800-53. It defines assessment methods (examine, interview, test) and procedures aligned to each control.

Question 4: Which skill is most important for success in Incident Response & Recovery within Certified Authorization Professional?

Working without any training
Continuous learning and adaptation (Correct answer)
Avoiding feedback
Resisting change

Correct answer: Continuous learning and adaptation

Continuous learning ensures professionals stay current with evolving practices in Incident Response & Recovery.

Question 5: When a user authenticates to a web application and receives a session token, which attack exploits the failure to invalidate that token after the user logs out?

Cross-site request forgery (CSRF)
Session hijacking via token reuse (Correct answer)
Clickjacking
Session fixation

Correct answer: Session hijacking via token reuse

If session tokens remain valid after logout, an attacker who captured the token can reuse it to impersonate the user.

Question 6: A security assessor is evaluating a system's resistance to brute-force attacks and finds no account lockout policy. Which NIST SP 800-53 control family is most directly relevant to this finding?

SC - System and Communications Protection
IA - Identification and Authentication (Correct answer)
AC - Access Control
AU - Audit and Accountability

Correct answer: IA - Identification and Authentication

The IA (Identification and Authentication) control family includes controls like IA-5 that address authenticator management, including account lockout policies.

Question 7: An organization cannot implement a required NIST SP 800-53 control due to a documented technical constraint. What is the correct approach?

Implement a compensating control that provides equivalent protection, and document it. (Correct answer)
Escalate to NIST for a waiver of the control requirement.
Remove the control from the Security Plan without documentation.
Accept the risk without any alternative measure.

Correct answer: Implement a compensating control that provides equivalent protection, and document it.

When a required control cannot be implemented, organizations should identify and implement a compensating control that provides equivalent or comparable protection. This must be documented in the Security Plan and approved by the Authorizing Official.

Question 8: Which regulation requires federal agencies to conduct Privacy Impact Assessments (PIAs) before developing or procuring IT systems that collect personally identifiable information?

Privacy Act of 1974
FISMA 2014
E-Government Act of 2002 (Correct answer)
OMB Memorandum M-03-22

Correct answer: E-Government Act of 2002

Section 208 of the E-Government Act of 2002 requires federal agencies to conduct and publish Privacy Impact Assessments for systems that collect, maintain, or disseminate PII.

Question 9: What is the term for a vulnerability assessment approach that examines only externally visible attack surfaces without any internal system knowledge?

Black-box assessment (Correct answer)
Crystal-box assessment
Gray-box assessment
White-box assessment

Correct answer: Black-box assessment

Black-box assessments simulate an external attacker with no prior knowledge, testing only what is visible from outside the organization's perimeter.

Question 10: Which type of cloud storage is most vulnerable to data leakage due to misconfigured access permissions?

Object storage buckets (Correct answer)
Network-attached storage
Block storage volumes
Ephemeral instance storage

Correct answer: Object storage buckets

Object storage buckets (e.g., S3) are frequently misconfigured with public access, making them a leading cause of cloud data breaches.

Question 11: Under the RMF, which role is responsible for developing and maintaining the System Security Plan (SSP)?

Security Control Assessor (SCA)
Authorizing Official (AO)
Common Control Provider (CCP)
Information System Owner (ISO) (Correct answer)

Correct answer: Information System Owner (ISO)

The Information System Owner (ISO) is responsible for developing, maintaining, and updating the SSP as the primary steward of the system's security documentation.

Question 12: What is the importance of staying current with trends in Security Operations & Monitoring for Certified Authorization Professional?

It ensures practices remain effective and relevant (Correct answer)
It is not necessary once certified
Trends do not affect professional practice
It is only required for new professionals

Correct answer: It ensures practices remain effective and relevant

Staying current with industry trends ensures that professional practices remain effective, relevant, and aligned with evolving standards.

Question 13: Under NIST SP 800-61, what is the recommended first action when an incident is confirmed during the Detection and Analysis phase?

Immediately notify law enforcement
Shut down all affected systems
Document all findings and prioritize the incident based on impact (Correct answer)
Notify all system users of the compromise

Correct answer: Document all findings and prioritize the incident based on impact

Upon confirming an incident, the handler should document findings and prioritize response efforts based on the incident's functional impact and information impact.

Question 14: In a multi-tenant cloud environment, which threat involves one tenant accessing another tenant's data or resources?

Insider threat
Tenant isolation breach (Correct answer)
Side-channel attack
Data remanence

Correct answer: Tenant isolation breach

A tenant isolation breach occurs when logical or physical boundaries between tenants fail, allowing unauthorized cross-tenant data access.

Question 15: Which tailoring action allows an organization to remove a security control from the baseline because it is not applicable to the system's operating environment?

Supplementation
Compensating control substitution
Scoping (Correct answer)
Overlay application

Correct answer: Scoping

Scoping involves applying specific guidance to adjust the baseline — including eliminating controls that are not applicable (e.g., removing mobile device controls from a system that has no mobile interfaces). Supplementation adds controls; overlays are community-wide tailoring guidance; compensating controls substitute when a baseline control cannot be implemented.

Question 16: A database containing Social Security Numbers, medical records, and financial data is being categorized. Which security objective drives the overall system categorization to HIGH?

The impact level of the most recently added data element
The highest impact level across all security objectives (Correct answer)
The average impact level across all data types
The lowest impact level to ensure usability

Correct answer: The highest impact level across all security objectives

Per FIPS 199, the overall information system security category is determined by the high-water mark — the highest impact level across all security objectives (confidentiality, integrity, availability).

Question 17: Which indicator type, according to NIST SP 800-61, is considered the MOST reliable for confirming a security incident?

Indicators of Compromise (IoCs) (Correct answer)
Threats
Precursors
Vulnerabilities

Correct answer: Indicators of Compromise (IoCs)

Indicators of Compromise (IoCs) are direct evidence that an incident has occurred or is in progress, making them the most reliable confirmation of an actual incident.

Question 18: What is the purpose of a risk assessment in cybersecurity?

To avoid implementing security measures
To replace incident response procedures
To evaluate threats and vulnerabilities (Correct answer)
To ignore security threats

Correct answer: To evaluate threats and vulnerabilities

The purpose of a risk assessment in cybersecurity is to systematically identify and analyze potential threats, such as malware or insider threats, and existing vulnerabilities, like unpatched software or weak configurations. By evaluating these factors, organizations can understand the potential impact and likelihood of security incidents. This understanding informs decisions on how to prioritize and implement security controls.

Question 19: What is the importance of staying current with trends in Network Security Fundamentals for Certified Authorization Professional?

It ensures practices remain effective and relevant (Correct answer)
It is only required for new professionals
It is not necessary once certified
Trends do not affect professional practice

Correct answer: It ensures practices remain effective and relevant

Staying current with industry trends ensures that professional practices remain effective, relevant, and aligned with evolving standards.

Question 20: What is the primary difference between quantitative and qualitative risk analysis methods?

Quantitative assigns numeric values to risk; qualitative uses descriptive categories like High/Medium/Low (Correct answer)
Quantitative is faster to perform; qualitative requires specialized tools
Quantitative analyzes threats; qualitative analyzes vulnerabilities
Quantitative is required by FISMA; qualitative is optional

Correct answer: Quantitative assigns numeric values to risk; qualitative uses descriptive categories like High/Medium/Low

Quantitative risk analysis uses numerical values (e.g., dollar amounts, probabilities) while qualitative analysis uses descriptive scales to rank risk levels.

Question 21: A federal system is categorized as MODERATE impact. Which NIST SP 800-53 security control baseline should be applied as the starting point?

The HIGH baseline, then scoped down.
The MODERATE baseline. (Correct answer)
No baseline — controls are selected individually for each system.
The LOW baseline, then augmented as needed.

Correct answer: The MODERATE baseline.

NIST SP 800-53 defines three control baselines (LOW, MODERATE, HIGH) aligned to FIPS 199 impact levels. A MODERATE-categorized system uses the MODERATE baseline as its starting point before any tailoring.

Question 22: Under Executive Order 14028 (Improving the Nation's Cybersecurity, 2021), federal agencies must adopt which security architecture approach?

Zero Trust Architecture (Correct answer)
Network segmentation only
Cloud-first security model
Defense-in-depth perimeter security

Correct answer: Zero Trust Architecture

EO 14028 directed federal agencies to advance toward Zero Trust Architecture, requiring CISA and NIST to develop guidance for this transition.

Question 23: What leadership style is most effective for building team autonomy in Certified Authorization Professional?

Autocratic leadership
Avoidant leadership
Delegative (laissez-faire) leadership for experienced teams (Correct answer)
Micromanagement

Correct answer: Delegative (laissez-faire) leadership for experienced teams

Delegative leadership empowers experienced team members to make decisions, fostering autonomy and professional growth.

Question 24: Why is multifactor authentication (MFA) important for access control?

It reduces user accountability
It adds an extra layer of authentication (Correct answer)
It weakens password security
It eliminates the need for passwords

Correct answer: It adds an extra layer of authentication

Multifactor authentication (MFA) is crucial for access control because it significantly enhances security by requiring users to provide two or more distinct verification factors. This means that even if one factor, such as a password, is compromised, an attacker would still need the second factor (e.g., a code from a phone or a fingerprint) to gain access. This additional layer makes it much harder for unauthorized individuals to breach accounts, thereby protecting sensitive information.

Question 25: Which NIST publication provides guidance on conducting risk assessments and is used to support the RMF Categorize and Assess steps?

NIST SP 800-30 (Correct answer)
NIST SP 800-60
NIST SP 800-137
NIST SP 800-53A

Correct answer: NIST SP 800-30

NIST SP 800-30 ('Guide for Conducting Risk Assessments') provides the methodology for identifying, analyzing, and communicating risk to organizational operations.

Question 26: What is the primary goal of data integrity controls in federal information systems?

Ensuring that data has not been altered or destroyed in an unauthorized or undetected manner (Correct answer)
Preventing unauthorized users from viewing sensitive information
Ensuring that authorized users can access data when needed
Limiting data retention to the minimum legally required period

Correct answer: Ensuring that data has not been altered or destroyed in an unauthorized or undetected manner

Integrity controls protect against unauthorized modification or destruction of data, ensuring its accuracy and completeness throughout its lifecycle.

Question 27: The NIST Cybersecurity Framework (CSF) core consists of five functions. Which function focuses on detecting cybersecurity events?

Respond
Identify
Protect
Detect (Correct answer)

Correct answer: Detect

The 'Detect' function of the NIST CSF defines activities to identify the occurrence of a cybersecurity event in a timely manner.

Question 28: Which element must be included in a POA&M entry to satisfy FISMA reporting requirements?

AO signature and date of discovery only
Vendor patch release schedules only
System architecture diagrams and data flow charts
Source of the weakness, scheduled completion date, and responsible point of contact (Correct answer)

Correct answer: Source of the weakness, scheduled completion date, and responsible point of contact

FISMA-compliant POA&M entries must document the weakness source (e.g., assessment, audit), scheduled remediation date, and the responsible individual or office accountable for closure.

Question 29: Which document serves as the primary artifact in the NIST RMF that describes the security controls implemented in an information system?

Security Assessment Report (SAR)
Authorization to Operate (ATO)
Plan of Action and Milestones (POA&M)
System Security Plan (SSP) (Correct answer)

Correct answer: System Security Plan (SSP)

The System Security Plan (SSP) is the primary security documentation artifact that describes how an information system implements required security controls.

Question 30: Which of the following best describes a 'security control overlay' in NIST SP 800-53?

A community-wide tailoring of the security control catalog for a specific technology type, environment, or mission. (Correct answer)
An additional layer of encryption applied on top of existing security controls.
A custom baseline created by an individual organization for its own internal use.
The process of mapping controls from one framework (e.g., ISO 27001) to NIST SP 800-53.

Correct answer: A community-wide tailoring of the security control catalog for a specific technology type, environment, or mission.

Overlays are tailored baselines developed for specific communities of interest (e.g., cloud systems, healthcare, Industrial Control Systems). They adjust the baseline controls to reflect the unique requirements of that environment and are approved for community-wide use.

Certified Authorization Professional (CAP)

The ISC2 CAP (now rebranded as CGRC – Certified in Governance, Risk and Compliance) validates professionals' expertise in authorizing and maintaining information systems using risk management frameworks, security controls, and continuous monitoring within government and enterprise environments.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

isc2.org — Score validity, score release, test delivery, eligibility, exam format, passing score, time limit · verified Oct 2026