CAP Security Operations & Monitoring 3

Question 1

What is the role of an Information System Security Officer (ISSO) in ongoing security monitoring?

Accepted Answer

Implementing and maintaining day-to-day security controls

Answer

The ISSO is responsible for the day-to-day implementation and maintenance of security controls within the information system.

Question 2

A SIEM system correlates events from multiple sources and generates an alert for an attack pattern. What should the analyst do FIRST?

Accepted Answer

Validate the alert to determine if it is a true positive

Answer

Alert validation to confirm it is a true positive (not a false positive) is the first step before taking any remediation action.

Question 3

Which of the following BEST describes a 'security baseline' in the context of federal information systems?

Accepted Answer

A pre-defined set of security controls for a given impact level

Answer

A security baseline is a pre-defined set of security controls tailored to a system's FIPS 199 impact level (Low, Moderate, High).

Question 4

Which type of vulnerability scan provides the MOST comprehensive view of security weaknesses on a system?

Accepted Answer

Credentialed internal scan

Answer

Credentialed scans authenticate to the target system and can identify configuration issues, missing patches, and local vulnerabilities that unauthenticated scans miss.

Question 5

Under FISMA, how frequently must federal agencies report security status to OMB?

Accepted Answer

Annually

Answer

FISMA requires federal agencies to report their information security status to OMB on an annual basis.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Security Operations & Monitoring 3