CAP Incident Response & Recovery 4

Question 1

Which NIST publication provides guidance specifically on Contingency Planning for Federal Information Systems?

Accepted Answer

NIST SP 800-34

Answer

NIST SP 800-34 (Contingency Planning Guide for Federal Information Systems) provides guidance on developing contingency plans for IT systems.

Question 2

An organization's systems are partially restored after a ransomware attack, but a decision must be made about declaring the incident closed. Who has the authority to make this declaration?

Accepted Answer

The designated Authorizing Official or senior management, not the technical team

Answer

Declaring an incident closed is a management decision, typically made by senior leadership or the AO, not solely by technical staff.

Question 3

What is the primary risk of using a compromised system's live memory (RAM) image as forensic evidence without proper precautions?

Accepted Answer

Volatile memory is overwritten when the system is powered off or processes change

Answer

RAM is volatile — its contents change constantly and are lost at power-off, so forensic capture must be performed quickly with tools that minimize system disruption.

Question 4

During incident eradication, a technician reimages a compromised server. What critical step must occur BEFORE reimaging to support potential legal action?

Accepted Answer

Obtain a forensic image of the original disk

Answer

A forensic image of the original disk must be taken before reimaging to preserve evidence that may be needed for legal proceedings or deeper analysis.

Question 5

In the context of CAP and ATO management, how does a security incident directly affect an existing Authorization to Operate?

Accepted Answer

A significant incident may trigger a requirement to reassess or revoke the ATO

Answer

A significant security incident that changes the risk posture of a system may require the Authorizing Official to reassess, modify conditions of, or revoke the existing ATO.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Incident Response & Recovery 4