CAP Documentation and Authorization Artifacts

Question 1

Which document in the authorization package describes known vulnerabilities and the schedule to fix them?

Accepted Answer

Plan of Action and Milestones

Answer

The Plan of Action and Milestones (POA&M) tracks identified weaknesses, responsible parties, resources needed, and target completion dates.

Question 2

What is the minimum set of documents typically included in an authorization package?

Accepted Answer

SSP, SAR, and POA&M

Answer

The standard authorization package contains the System Security Plan, Security Assessment Report, and Plan of Action and Milestones.

Question 3

What information is typically included in the authorization boundary diagram?

Accepted Answer

All hardware, software, and data flows within the system boundary

Answer

The authorization boundary diagram visually represents all system components, interfaces, data flows, and interconnections within scope.

Question 4

A Privacy Impact Assessment (PIA) is required under which federal law before collecting or using personally identifiable information?

Accepted Answer

E-Government Act of 2002

Answer

The E-Government Act of 2002 requires federal agencies to conduct PIAs before developing or procuring IT systems that collect PII.

Question 5

What is the purpose of a System of Records Notice (SORN)?

Accepted Answer

To publicly notify citizens about federal systems that collect and use their personal data

Answer

A SORN is published in the Federal Register to inform the public about systems that maintain personally identifiable information about individuals.

CAP - Certified Accreditation Professional Practice Test