CAP Risk Management & Security Evaluation 3

Question 1

Which step of the NIST RMF involves defining the system boundary, identifying stakeholders, and establishing the authorization strategy?

Accepted Answer

Prepare

Answer

The Prepare step, added in NIST SP 800-37 Rev. 2, establishes organizational and system-level context before the remaining RMF steps begin.

Question 2

What is the key distinction between a vulnerability and a threat in the context of CAP risk management?

Accepted Answer

A vulnerability is a weakness; a threat is a potential cause of harm that exploits it

Answer

A vulnerability is a flaw or weakness in a system, while a threat is any circumstance or event with the potential to exploit that vulnerability.

Question 3

Under CNSSI 1253, which factor primarily drives the selection of security control overlays for national security systems?

Accepted Answer

System type, classification level, and operational environment

Answer

CNSSI 1253 overlays are driven by system type (e.g., space, weapons), classification level, and specific operational environments requiring tailored controls.

Question 4

An organization conducts ongoing security monitoring and discovers a new critical vulnerability in a production system. What is the FIRST action the ISSO should take?

Accepted Answer

Assess the vulnerability's impact and report it to the AO

Answer

The ISSO must first assess impact and report to the AO so that an informed risk decision can be made before any remediation action.

Question 5

What term describes the process of tailoring a security control baseline by adding controls beyond the baseline to address specific threats or operational requirements?

Accepted Answer

Scoping (supplementation)

Answer

Supplementation (a form of scoping) adds controls above the baseline when the selected baseline is insufficient for specific threat environments or requirements.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Risk Management & Security Evaluation 3