CAP Study Guide 2026
Everything you need to pass the CAP exam in one place: the exam format, every topic to study, real practice questions with explanations, flashcards, and full-length practice tests. Free, no sign-up needed.
📋 CAP Exam Format at a Glance
📚 CAP Topics to Study (80)
✍️ Sample CAP Questions & Answers
1. Under the Privacy Act of 1974, what is a 'system of records'?
A Privacy Act system of records is a group of records under an agency's control from which information is retrieved by name, SSN, or other personal identifier.
2. Why is multifactor authentication (MFA) important for access control?
Multifactor authentication (MFA) is crucial for access control because it significantly enhances security by requiring users to provide two or more distinct verification factors. This means that even if one factor, such as a password, is compromised, an attacker would still need the second factor (e.g., a code from a phone or a fingerprint) to gain access. This additional layer makes it much harder for unauthorized individuals to breach accounts, thereby protecting sensitive information.
3. During incident response, what is the primary purpose of a chain of custody document?
Chain of custody documents track who handled evidence and when, ensuring its integrity and legal admissibility.
4. A system architect needs to protect data that remains sensitive even after the system is decommissioned. Which control addresses this long-term concern?
Media sanitization (e.g., per NIST SP 800-88) ensures data cannot be recovered after system decommissioning.
5. In the context of the CAP framework, what does 'defense-in-depth' mean for network security?
Defense-in-depth means implementing multiple overlapping security layers so that a failure in one control does not leave systems unprotected.
6. Which vulnerability scoring system is MOST commonly referenced in threat intelligence to prioritize remediation efforts?
CVSS provides standardized numerical scores (0-10) for vulnerability severity, widely used across the industry to prioritize patching and risk treatment.