CAP Information Systems & Data Protection 3

Question 1

In the context of federal information systems, what does 'data in use' refer to?

Accepted Answer

Data actively being processed in memory or by an application

Answer

Data in use refers to data actively being accessed, modified, or processed by an application or user, making it vulnerable to memory-based attacks.

Question 2

Which control baseline under NIST SP 800-53 is appropriate for a system categorized as MODERATE impact?

Accepted Answer

Moderate baseline controls with tailoring as needed

Answer

NIST SP 800-53 provides low, moderate, and high baselines; MODERATE impact systems use the moderate baseline, which can be tailored to organizational needs.

Question 3

A penetration test reveals that a web application stores session tokens in plaintext cookies. Which security principle is most directly violated?

Accepted Answer

Confidentiality of session data and least privilege for session management

Answer

Plaintext session tokens expose confidential authentication data and violate least privilege by allowing any interceptor to assume a user's session privileges.

Question 4

Under the Privacy Act of 1974, what is a 'system of records'?

Accepted Answer

A group of records under agency control from which information is retrieved by personal identifier

Answer

A Privacy Act system of records is a group of records under an agency's control from which information is retrieved by name, SSN, or other personal identifier.

Question 5

What is the key distinction between a Security Assessment Report (SAR) and a Plan of Action and Milestones (POA&M)?

Accepted Answer

The SAR documents assessment findings while the POA&M tracks remediation of weaknesses

Answer

The SAR captures what the assessor found during testing; the POA&M is the system owner's plan for correcting identified weaknesses with scheduled milestones.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Information Systems & Data Protection 3