CAP Information Systems & Data Protection 5

Question 1

A system owner wants to share a risk assessment report with a third-party cloud provider. Which concern should be addressed first?

Accepted Answer

Whether the report contains sensitive vulnerability details that could aid attackers if disclosed

Answer

Risk assessment reports often contain sensitive details about system weaknesses; sharing without reviewing for sensitive content could expose exploitable vulnerabilities.

Question 2

Which approach best supports continuous monitoring of a federal information system's security posture?

Accepted Answer

Automating security control assessments and feeding results into a dashboard with defined metrics and thresholds

Answer

NIST SP 800-137 defines continuous monitoring as an ongoing process using automated tools to maintain situational awareness of control effectiveness in near real time.

Question 3

Under NIST SP 800-53, which control requires that information systems protect the authenticity of communications sessions?

Accepted Answer

SC-23 (Session Authenticity)

Answer

SC-23 requires systems to protect session authenticity to prevent session hijacking and man-in-the-middle attacks on active communications.

Question 4

An agency is moving a HIGH impact system to a FedRAMP-authorized cloud. Which statement is correct regarding inherited controls?

Accepted Answer

The agency inherits controls provided by the CSP but retains responsibility for customer-responsible controls

Answer

FedRAMP uses a shared responsibility model where CSP-provided controls are inherited by the agency, but customer-responsible controls remain the agency's obligation.

Question 5

What is the primary goal of data integrity controls in federal information systems?

Accepted Answer

Ensuring that data has not been altered or destroyed in an unauthorized or undetected manner

Answer

Integrity controls protect against unauthorized modification or destruction of data, ensuring its accuracy and completeness throughout its lifecycle.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Information Systems & Data Protection 5