CAP Security Operations & Monitoring 2

Question 1

Which NIST document provides guidance on security and privacy controls for federal information systems and organizations?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 provides a catalog of security and privacy controls for federal information systems and organizations.

Question 2

A security analyst notices repeated failed login attempts followed by a successful login from an unusual geographic location. This pattern most likely indicates:

Accepted Answer

A credential stuffing or brute-force attack succeeded

Answer

Repeated failed attempts followed by success from an unusual location is a hallmark indicator of a credential-based attack that succeeded.

Question 3

Under the RMF, which step involves assessing whether the security controls selected are implemented correctly and operating as intended?

Accepted Answer

Assess

Answer

The Assess step involves evaluating whether controls are implemented correctly, operating as intended, and producing the desired outcome.

Question 4

What is the primary purpose of a Plan of Action and Milestones (POA&M)?

Accepted Answer

Track remediation of identified security weaknesses

Answer

A POA&M documents identified security weaknesses and tracks the planned remediation actions and target completion dates.

Question 5

Which log source would be MOST useful when investigating potential insider threat activity involving unauthorized data exfiltration?

Accepted Answer

Data Loss Prevention (DLP) alerts

Answer

DLP systems monitor and alert on data movements that violate policy, making them the most direct source for identifying data exfiltration.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Security Operations & Monitoring 2