Get instant access to CAP Practice Tests 2026 Free Updated Today!
Welcome to download the newest PassLeader CAP PDF dumps ( 60 Q&As)
ISC2 CAP Exam Syllabus Topics:
| Topic | Details |
|---|---|
Information Security Risk Management Program (15%) | |
| Understand the Foundation of an Organization-Wide Information Security Risk Management Program | -Principles of information security -National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) -RMF and System Development Life Cycle (SDLC) integration -Information System (IS) boundary requirements -Approaches to security control allocation -Roles and responsibilities in the authorization process |
| Understand Risk Management Program Processes | -Enterprise program management controls -Privacy requirements -Third-party hosted Information Systems (IS) |
| Understand Regulatory and Legal Requirements | -Federal information security requirements -Relevant privacy legislation -Other applicable security-related mandates |
Categorization of Information Systems (IS) (13%) | |
| Define the Information System (IS) | -Identify the boundary of the Information System (IS) -Describe the architecture -Describe Information System (IS) purpose and functionality |
| Determine Categorization of the Information System (IS) | -Identify the information types processed, stored, or transmitted by the Information System (IS) -Determine the impact level on confidentiality, integrity, and availability for each information type -Determine Information System (IS) categorization and document results |
Selection of Security Controls (13%) | |
| Identify and Document Baseline and Inherited Controls | |
| Select and Tailor Security Controls | -Determine applicability of recommended baseline -Determine appropriate use of overlays -Document applicability of security controls |
| Develop Security Control Monitoring Strategy | |
| Review and Approve Security Plan (SP) | |
Implementation of Security Controls (15%) | |
| Implement Selected Security Controls | -Confirm that security controls are consistent with enterprise architecture -Coordinate inherited controls implementation with common control providers -Determine mandatory configuration settings and verify implementation (e.g., United States Government Configuration Baseline (USGCB), National Institute of Standards and Technology (NIST) checklists, Defense Information Systems Agency (DISA), Security Technical Implementation Guides (STIGs), Center for Internet Security (CIS) benchmarks) -Determine compensating security controls |
| Document Security Control Implementation | -Capture planned inputs, expected behavior, and expected outputs of security controls -Verify documented details are in line with the purpose, scope, and impact of the Information System (IS) -Obtain implementation information from appropriate organization entities (e.g., physical security, personnel security |
Assessment of Security Controls (14%) | |
| Prepare for Security Control Assessment (SCA) | -Determine Security Control Assessor (SCA) requirements -Establish objectives and scope -Determine methods and level of effort -Determine necessary resources and logistics -Collect and review artifacts (e.g., previous assessments, system documentation, policies) -Finalize Security Control Assessment (SCA) plan |
| Conduct Security Control Assessment (SCA) | -Assess security control using standard assessment methods -Collect and inventory assessment evidence |
| Prepare Initial Security Assessment Report (SAR) | -Analyze assessment results and identify weaknesses -Propose remediation actions |
| Review Interim Security Assessment Report (SAR) and Perform Initial Remediation Actions | -Determine initial risk responses -Apply initial remediations -Reassess and validate the remediated controls |
| Develop Final Security Assessment Report (SAR) and Optional Addendum | |
Authorization of Information Systems (IS) (14%) | |
| Develop Plan of Action and Milestones (POAM) | -Analyze identified weaknesses or deficiencies -Prioritize responses based on risk level -Formulate remediation plans -Identify resources required to remediate deficiencies -Develop schedule for remediation activities |
| Assemble Security Authorization Package | -Compile required security documentation for Authorizing Official (AO) |
| Determine Information System (IS) Risk | -Evaluate Information System (IS) risk -Determine risk response options (i.e., accept, avoid, transfer, mitigate, share) |
| Make Security Authorization Decision | -Determine terms of authorization |
Continuous Monitoring (16%) | |
| Determine Security Impact of Changes to Information Systems (IS) and Environment | -Understand configuration management processes -Analyze risk due to proposed changes -Validate that changes have been correctly implemented |
| Perform Ongoing Security Control Assessments (SCA) | -Determine specific monitoring tasks and frequency based on the agency’s strategy -Perform security control assessments based on monitoring strategy -Evaluate security status of common and hybrid controls and interconnections |
ISC CAP Practice Test Questions, ISC CAP Exam Practice Test Questions
The (ISC)2 Certified Authorized Professional certification is aimed at information security practitioners. These are the individuals who support the management of security risk in the pursuit of information system authorization. They do this to support the operations and mission of an organization according to the regulatory and legal requirements. The certificate covers a broad range of topics, which are included in the (ISC)2 CAP CBK (Body of Knowledge). The candidates must pass one qualifying exam to obtain this certification.
NEW QUESTION # 11
Which of the following governance bodies directs and coordinates implementations of the information security program?
- A. Senior Management
- B. Chief Information Security Officer
- C. Information Security Steering Committee
- D. Business Unit Manager
Answer: B
NEW QUESTION # 12
Billy is the project manager of the HAR Project and is in month six of the project. The project is scheduled to last for 18 months. Management asks Billy how often the project team is participating in risk reassessment in this project. What should Billy tell management if he's following the best practices for risk management?
- A. Project risk management has been concluded with the project planning.
- B. At every status meeting the project team project risk management is an agenda item.
- C. Project risk management happens at every milestone.
- D. Project risk management is scheduled for every month in the 18-month project.
Answer: B
Explanation:
Section: Volume B
NEW QUESTION # 13
Which of the following individuals is responsible for ensuring the security posture of the organization's information system?
- A. Chief Information Officer
- B. Security Control Assessor
- C. Authorizing Official
- D. Common Control Provider
Answer: C
NEW QUESTION # 14
Mark works as a Network Administrator for NetTech Inc. He wants users to access only those resources that are required for them. Which of the following access control models will he use?
- A. Discretionary Access Control
- B. Role-Based Access Control
- C. Mandatory Access Control
- D. Policy Access Control
Answer: B
NEW QUESTION # 15
Which of the following is a 1996 United States federal law, designed to improve the way the federal government acquires, uses, and disposes information technology?
- A. Lanham Act
- B. Clinger-Cohen Act
- C. Computer Misuse Act
- D. Paperwork Reduction Act
Answer: B
NEW QUESTION # 16
You work as the project manager for Bluewell Inc. There has been a delay in your project work that is adversely affecting the project schedule. You decide, with your stakeholders' approval, to fast track the project work to get the project done faster. When you fast track the project, what is likely to increase?
- A. Quality control concerns
- B. Human resource needs
- C. Risks
- D. Costs
Answer: C
Explanation:
Section: Volume B
NEW QUESTION # 17
Mary is the project manager of the HGH Project for her company. She and her project team have agreed that if the vendor is late by more than ten days they will cancel the order and hire the NBG Company to fulfill the order. The NBG Company can guarantee orders within three days, but the costs of their products are significantly more expensive than the current vendor. What type of a response strategy is this?
- A. Internal risk management strategy
- B. Expert judgment
- C. Contingent response strategy
- D. External risk response
Answer: C
Explanation:
Section: Volume B
Explanation/Reference:
NEW QUESTION # 18
Shoulder surfing is a type of in-person attack in which the attacker gathers information about the premises of an organization. This attack is often performed by looking surreptitiously at the keyboard of an employee's computer while he is typing in his password at any access point such as a terminal/Web site.
Which of the following is violated in a shoulder surfing attack?
- A. Integrity
- B. Confidentiality
- C. Authenticity
- D. Availability
Answer: B
NEW QUESTION # 19
Which of the following professionals is responsible for starting the Certification & Accreditation
(C&A) process?
- A. Chief Risk Officer (CRO)
- B. Chief Information Officer (CIO)
- C. Authorizing Official
- D. Information system owner
Answer: D
NEW QUESTION # 20
You work as the project manager for Bluewell Inc. You are working on NGQQ Projectyou're your company. You have completed the risk analysis processes for the risk events. You and the project team have created risk responses for most of the identified project risks. Which of the following risk response planning techniques will you use to shift the impact of a threat to a third party, together with the responses?
- A. Risk mitigation
- B. Risk acceptance
- C. Risk avoidance
- D. Risk transference
Answer: D
NEW QUESTION # 21
In which of the following testing methodologies do assessors use all available documentation and work under no constraints, and attempt to circumvent the security features of an information system?
- A. Full operational test
- B. Walk-through test
- C. Penetration test
- D. Paper test
Answer: C
NEW QUESTION # 22
In which of the following elements of security does the object retain its veracity and is intentionally modified by the authorized subjects?
- A. Confidentiality
- B. Integrity
- C. Nonrepudiation
- D. Availability
Answer: B
NEW QUESTION # 23
James work as an IT systems personnel in SoftTech Inc. He performs the following tasks:
Runs regular backups and routine tests of the validity of the backup data.
Performs data restoration from the backups whenever required.
Maintains the retained records in accordance with the established information classification policy.
What is the role played by James in the organization?
- A. User
- B. Custodian
- C. Owner
- D. Manager
Answer: B
Explanation:
Section: Volume A
NEW QUESTION # 24
Which of the following acts promote a risk-based policy for cost effective security?
Each correct answer represents a part of the solution. Choose all that apply.
- A. Lanham Act
- B. Paperwork Reduction Act (PRA)
- C. Clinger-Cohen Act
- D. Computer Misuse Act
Answer: B,C
Explanation:
Section: Volume D
NEW QUESTION # 25
Tom is the project manager for his organization. In his project he has recently finished the risk response planning. He tells his manager that he will now need to update the cost and schedule baselines. Why would the risk response planning cause Tom the need to update the cost and schedule baselines?
- A. Baselines should not be updated, but refined through versions.
- B. Risk responses may take time and money to implement.
- C. New or omitted work as part of a risk response can cause changes to the cost and/or schedule baseline.
- D. Risk responses protect the time and investment of the project.
Answer: C
NEW QUESTION # 26
Information risk management (IRM) is the process of identifying and assessing risk, reducing it to an acceptable level, and implementing the right mechanisms to maintain that level. What are the different categories of risk?
Each correct answer represents a complete solution. Choose all that apply.
- A. Human interaction
- B. Inside and outside attacks
- C. System interaction
- D. Physical damage
- E. Social status
- F. Equipment malfunction
Answer: A,B,D,E,F
Explanation:
Section: Volume A
NEW QUESTION # 27
Which of the following statements about the authentication concept of information security management is true?
- A. It establishes the users' identity and ensures that the users are who they say they are.
- B. It ensures the reliable and timely access to resources.
- C. It determines the actions and behaviors of a single individual within a system, and identifies that particular individual.
- D. It ensures that modifications are not made to data by unauthorized personnel or processes .
Answer: A
Explanation:
Section: Volume D
NEW QUESTION # 28
To help review or design security controls, they can be classified by several criteria. One of these criteria is based on nature. According to this criteria, which of the following controls consists of incident response processes, management oversight, security awareness, and training?
- A. Physical control
- B. Technical control
- C. Compliance control
- D. Procedural control
Answer: D
NEW QUESTION # 29
Beth is the project manager of the BFG Project for her company. In this project Beth has decided to create a contingency response based on the performance of the project schedule. If the project schedule variance is greater than $10,000 the contingency plan will be implemented. What is the formula for the schedule variance?
- A. SV=EV/AC
- B. SV=EV-PV
- C. SV=PV-EV
- D. SV=EV/PV
Answer: B
Explanation:
Section: Volume B
NEW QUESTION # 30
Kelly is the project manager of the BHH project for her organization. She is completing the risk identification process for this portion of her project. Which one of the following is the only thing that the risk identification process will create for Kelly?
- A. Change requests
- B. Risk register
- C. Project document updates
- D. Risk register updates
Answer: B
NEW QUESTION # 31
Which of the following acts is used to recognize the importance of information security to the economic and national security interests of the United States?
- A. Lanham Act
- B. Computer Fraud and Abuse Act
- C. FISMA
- D. Computer Misuse Act
Answer: C
NEW QUESTION # 32
......
Feb-2026 Latest Actual4test CAP Exam Dumps with PDF and Exam Engine: https://pdftorrent.actual4test.com/CAP_examcollection.html