Mixed Deck — All CAP Topics Flashcards

Under the Privacy Act of 1974, what is a 'system of records'?

Answer: A group of records under agency control from which information is retrieved by personal identifier

A Privacy Act system of records is a group of records under an agency's control from which information is retrieved by name, SSN, or other personal identifier.

Why is multifactor authentication (MFA) important for access control?

Answer: It adds an extra layer of authentication

Multifactor authentication (MFA) is crucial for access control because it significantly enhances security by requiring users to provide two or more distinct verification factors. This means that even if one factor, such as a password, is compromised, an attacker would still need the second factor (e.g., a code from a phone or a fingerprint) to gain access. This additional layer makes it much harder for unauthorized individuals to breach accounts, thereby protecting sensitive information.

Which vulnerability scoring system is MOST commonly referenced in threat intelligence to prioritize remediation efforts?

Answer: CVSS (Common Vulnerability Scoring System)

CVSS provides standardized numerical scores (0-10) for vulnerability severity, widely used across the industry to prioritize patching and risk treatment.

What is the primary difference between quantitative and qualitative risk analysis methods?

Answer: Quantitative assigns numeric values to risk; qualitative uses descriptive categories like High/Medium/Low

Quantitative risk analysis uses numerical values (e.g., dollar amounts, probabilities) while qualitative analysis uses descriptive scales to rank risk levels.

How does collaboration enhance Cryptography & Encryption in Certified Authorization Professional?

Answer: It brings diverse perspectives and improves outcomes

Collaboration brings together different viewpoints and expertise, leading to better decision-making and outcomes.

What is the importance of staying current with trends in Incident Response & Recovery for Certified Authorization Professional?

Answer: It ensures practices remain effective and relevant

Staying current with industry trends ensures that professional practices remain effective, relevant, and aligned with evolving standards.

In a zero trust architecture, what is the default access posture for any user or device attempting to connect to a resource?

Answer: Denied until explicitly verified and authorized

Zero trust assumes no implicit trust — every access request must be explicitly verified and authorized regardless of network location.

Which process reviews and validates that user access rights remain appropriate and aligned with job responsibilities?

Answer: Access recertification (access review)

Access recertification (also called periodic access review) ensures that user permissions are still necessary and appropriate, and removes stale or excess access.

A system security plan (SSP) is required under which regulatory mandate for federal agencies?

Answer: FISMA

FISMA requires federal agencies to develop and maintain an SSP that describes the security requirements of the system and the controls in place to meet those requirements.

Which element must be included in a POA&M entry to satisfy FISMA reporting requirements?

Answer: Source of the weakness, scheduled completion date, and responsible point of contact

FISMA-compliant POA&M entries must document the weakness source (e.g., assessment, audit), scheduled remediation date, and the responsible individual or office accountable for closure.

What is a fundamental principle of Security Operations & Monitoring in Certified Authorization Professional practice?

Answer: Following established standards and best practices

Following established standards and best practices ensures quality and consistency in Security Operations & Monitoring.

A risk response strategy where the organization implements controls to reduce the likelihood or impact of a threat is called:

Answer: Risk mitigation (risk reduction)

Risk mitigation involves implementing security controls or countermeasures to reduce either the probability of a threat occurring or its potential impact.

An organization implements Just-in-Time (JIT) privileged access, where elevated rights are granted only for the duration of an approved task. This practice primarily supports which security principle?

Answer: Least privilege

JIT access directly implements least privilege by ensuring elevated rights exist only as long as operationally necessary.

A federal system is categorized as MODERATE impact. Which NIST SP 800-53 security control baseline should be applied as the starting point?

Answer: The MODERATE baseline.

NIST SP 800-53 defines three control baselines (LOW, MODERATE, HIGH) aligned to FIPS 199 impact levels. A MODERATE-categorized system uses the MODERATE baseline as its starting point before any tailoring.

A CAP candidate is reviewing a continuous monitoring plan. Which metric best indicates the health of the identity and access management program over time?

Answer: Percentage of accounts reviewed and recertified within defined timeframes

Tracking recertification completion rates directly measures how well the organization maintains appropriate access controls over time.

Which U.S. federal law established the requirement for federal agencies to develop, document, and implement an information security program, and made NIST responsible for developing security standards and guidelines?

Answer: The Federal Information Security Management Act (FISMA) of 2002

FISMA 2002 (part of the E-Government Act) is the foundational federal law requiring agencies to implement agency-wide information security programs. It mandated NIST to develop standards (FIPS) and guidelines (SP 800-series) for federal information security.

What does 'mean time to respond' (MTTR) measure in a security operations context?

Answer: Average time from incident detection to containment or resolution

MTTR measures the average elapsed time from when a security incident is detected to when it is contained or resolved.

Which federal agency is responsible for developing mandatory standards (FIPS) and voluntary guidelines (SP 800-series) for federal information systems under FISMA?

Answer: The National Institute of Standards and Technology (NIST)

FISMA explicitly tasks NIST with developing FIPS (Federal Information Processing Standards, which are mandatory) and Special Publications in the 800-series (which are guidelines). DHS handles operational oversight; OMB handles policy; GAO audits compliance — but only NIST creates the technical standards.

Which NIST publication provides guidance specifically on network security for federal information systems?

Answer: NIST SP 800-41

NIST SP 800-41 provides guidelines on firewalls and firewall policy, covering network security for federal information systems.

In XACML (eXtensible Access Control Markup Language), which component evaluates the policy and returns a decision?

Answer: Policy Decision Point (PDP)

The PDP evaluates access requests against applicable policies and returns Permit, Deny, NotApplicable, or Indeterminate decisions.