Updated Oct-2025 Test Engine to Practice CAP Test Questions
CAP Real Exam Questions Test Engine Dumps Training With 60 Questions
Authorization of Information Systems (10%):
- Security Authorization Decision-Making – Here, you should have the skills in determining the terms of authorization.
- Develop POAM (Plan of Action & Milestones) – It measures your skills in analyzing established deficiencies or weaknesses, prioritizing responses according to risk level, and formulating the remediation plans. You should also possess the ability to establish the resources needed to remediate weaknesses and develop the schedule for remediation events;
- Gather the Security Authorization Package – This includes compiling needed security documentations for AO (Authorizing Official);
- Establishing IS Risk – This focuses on measuring IS risk and determining the risk response alternatives;
NEW QUESTION # 25
Risks with low ratings of probability and impact are included on a ____ for future monitoring.
- A. Risk register
- B. Watchlist
- C. Observation list
- D. Risk alarm
Answer: B
Explanation:
Section: Volume A
NEW QUESTION # 26
In which of the following testing methodologies do assessors use all available documentation and work under no constraints, and attempt to circumvent the security features of an information system?
- A. Walk-through test
- B. Full operational test
- C. Penetration test
- D. Paper test
Answer: C
Explanation:
Section: Volume B
Explanation
NEW QUESTION # 27
In what portion of a project are risk and opportunities greatest and require intense planning and anticipation of risk events?
- A. Executing
- B. Planning
- C. Initiating
- D. Closing
Answer: C
NEW QUESTION # 28
Which of the following processes is described in the statement below?
"This is the process of numerically analyzing the effect of identified risks on overall project objectives."
- A. Identify Risks
- B. Perform Qualitative Risk Analysis
- C. Perform Quantitative Risk Analysis
- D. Monitor and Control Risks
Answer: C
Explanation:
Section: Volume C
NEW QUESTION # 29
Which of the following individuals is responsible for the final accreditation decision?
- A. Information System Owner
- B. Risk Executive
- C. Certification Agent
- D. User Representative
Answer: A
Explanation:
Section: Volume D
Explanation/Reference:
NEW QUESTION # 30
You work as a project manager for BlueWell Inc. Management has asked you to work with the key project stakeholder to analyze the risk events you have identified in the project. They would like you to analyze the project risks with a goal of improving the project's performance as a whole.
What approach can you use to achieve the goal of improving the project's performance through risk analysis with your project stakeholders?
- A. Focus on the high-priority risks through qualitative risk analysis
- B. Involve the stakeholders for risk identification only in the phases where the project directlyaffects them
- C. Involve subject matter experts in the risk analysis activities
- D. Use qualitative risk analysis to quickly assess the probability and impact of risk events
Answer: A
NEW QUESTION # 31
Which of the following acts is used to recognize the importance of information security to the economic and national security interests of the United States?
- A. Computer Fraud and Abuse Act
- B. FISMA
- C. Computer Misuse Act
- D. Lanham Act
Answer: B
NEW QUESTION # 32
You are the project manager of the CUL project in your organization. You and the project team are assessing the risk events and creating a probability and impact matrix for the identified risks.
Which one of the following statements best describes the requirements for the data type used in qualitative risk analysis?
- A. A qualitative risk analysis encourages biased data to reveal risk tolerances.
- B. A qualitative risk analysis requires accurate and unbiased data if it is to be credible.
- C. A qualitative risk analysis requires fast and simple data to complete the analysis.
- D. A qualitative risk analysis required unbiased stakeholders with biased risk tolerances.
Answer: B
NEW QUESTION # 33
The phase 0 of Risk Management Framework (RMF) is known as strategic risk assessment planning.
Which of the following processes take place in phase 0?
Each correct answer represents a complete solution. Choose all that apply.
- A. Apply classification criteria to rank data assets and related IT resources.
- B. Identify threats, vulnerabilities, and controls that will be evaluated.
- C. Establish criteria that will be used to evaluate threats, vulnerabilities, and controls.
- D. Review documentation and technical data.
- E. Establish criteria that will be used to classify and rank data assets.
Answer: A,B,C,E
NEW QUESTION # 34
Which of the following assessment methods is used to review, inspect, and analyze assessment objects?
- A. Interview
- B. Testing
- C. Examination
- D. Debugging
Answer: C
NEW QUESTION # 35
The Project Risk Management knowledge area focuses on which of the following processes?
Each correct answer represents a complete solution. Choose all that apply.
- A. Quantitative Risk Analysis
- B. Risk Monitoring and Control
- C. Risk Management Planning
- D. Potential Risk Monitoring
Answer: A,B,C
NEW QUESTION # 36
You are the project manager of the NNH Project. In this project you have created a contingency response that the schedule performance index should be less than 0.93. The NHH Project has a budget at completion of
$945,000 and is 45 percent complete though the project should be 49 percent complete. The project has spent
$455,897 to reach the 45 percent complete milestone.
What is the project's schedule performance index?
- A. -$37,800
- B. 0.92
- C. 1.06
- D. 0.93
Answer: B
Explanation:
Section: Volume B
NEW QUESTION # 37
Which of the following statements best describes the difference between the role of a data owner and the role of a data custodian?
- A. The data owner implements the information classification scheme after the initial assignment by the custodian.
- B. The data custodian implements the information classification scheme after the initial assignment by the data owner.
- C. The custodian makes the initial information classification assignments, and the operations manager implements the scheme.
- D. The custodian implements the information classification scheme after the initial assignment by the operations manager.
Answer: B
Explanation:
Section: Volume D
NEW QUESTION # 38
GraphQL is an open-source data query and manipulation language for APIs, and a query runtime engine. In this context, what is GraphQL Introspection?
- A. A technique for discovering the structure of the GraphQL API
- B. A technique for testing the security of the GraphQL API
- C. A technique for testing the compatibility of the GraphQL API with other systems
- D. A technique for testing the performance of the GraphQL API
Answer: A
Explanation:
GraphQL Introspection is a built-in feature of GraphQL that allows clients to query the schema of a GraphQL API at runtime. This process involves sending introspection queries (e.g., __schema or __type) to retrieve information about the API's structure, including available types, fields, queries, mutations, and their relationships. This capability is powerful for developers to explore and document APIs but poses a security risk if left enabled in production, as attackers can use it to map out the entire API structure and identify potential attack vectors.
* Option A ("A technique for testing the compatibility of the GraphQL API with other systems"):
Incorrect, as introspection is about schema discovery, not compatibility testing.
* Option B ("A technique for testing the performance of the GraphQL API"): Incorrect, as performance testing involves load or stress testing, not schema exploration.
* Option C ("A technique for discovering the structure of the GraphQL API"): Correct, as introspection is specifically designed to expose the API's schema and structure.
* Option D ("A technique for testing the security of the GraphQL API"): Incorrect, as security testing is a separate process; introspection itself is a feature, not a security test.
The correct answer is C, aligning with the CAP syllabus under "GraphQL Security" and "API Introspection." References: SecOps Group CAP Documents - "GraphQL Fundamentals," "Introspection Risks," and
"OWASP API Security Top 10" sections.
NEW QUESTION # 39
Diana is the project manager of the QPS project for her company. In this project Diana and the project team have identified a pure risk. Diana and the project team decided, along with the key stakeholders, to remove the pure risk from the project by changing the project plan altogether.
What is a pure risk?
- A. It is a risk event that is created by a risk response.
- B. It is a risk event that is generated due to errors or omission in the project work.
- C. It is a risk event that cannot be avoided because of the order of the work.
- D. It is a risk event that only has a negative side, such as loss of life or limb.
Answer: D
NEW QUESTION # 40
Which of the following persons is responsible for testing and verifying whether the security policy is properly implemented, and the derived security solutions are adequate or not?
- A. Data owner
- B. Auditor
- C. User
- D. Data custodian
Answer: B
NEW QUESTION # 41
Who is responsible for the stakeholder expectations management in a high-profile, high-risk project?
- A. Project management office
- B. Project sponsor
- C. Project risk assessment officer
- D. Project manager
Answer: D
NEW QUESTION # 42
In which of the following Risk Management Framework (RMF) phases is a risk profile created for threats?
- A. Phase 0
- B. Phase 3
- C. Phase 1
- D. Phase 2
Answer: D
NEW QUESTION # 43
......
CAP Actual Questions Answers PDF 100% Cover Real Exam Questions: https://exams4sure.actualcollection.com/CAP-exam-questions.html