CAP Continuous Monitoring and System Lifecycle 2

Question 1

The System Development Life Cycle (SDLC) is important in security because integrating security early follows which principle?

Accepted Answer

Shift left / security by design

Answer

Integrating security requirements and controls from the earliest SDLC phases (shifting left) is more effective and less costly than retrofitting security later.

Question 2

During which SDLC phase is the System Security Plan typically first developed?

Accepted Answer

Initiation

Answer

The SSP is initiated during the Initiation phase when system boundaries, requirements, and preliminary security controls are first identified.

Question 3

What security activity must be performed before a system is decommissioned during the SDLC Disposal phase?

Accepted Answer

Media sanitization and data destruction per NIST SP 800-88

Answer

NIST SP 800-88 provides guidelines for media sanitization to ensure sensitive information cannot be recovered after system disposal.

Question 4

Which continuous monitoring activity involves testing a subset of controls each year rather than all controls simultaneously?

Accepted Answer

Rolling assessments

Answer

Rolling assessments divide the full control set into groups assessed on a rotating schedule, providing continuous coverage without full annual assessments.

Question 5

What is the purpose of a hardware and software inventory in continuous monitoring?

Accepted Answer

To maintain an accurate record of system components to detect unauthorized assets

Answer

Maintaining an accurate inventory is fundamental to continuous monitoring, enabling detection of unauthorized or unknown assets that pose security risks.

CAP - Certified Accreditation Professional Practice Test

CAP - Certified Accreditation Professional Practice Test

CAP Continuous Monitoring and System Lifecycle 2