Latest Mar 11, 2026 CAP Brain Dump A Study Guide with Tips & Tricks for passing Exam [Q36-Q52]

5/5 - (1 vote)

Latest Mar 11, 2026 CAP Brain Dump: A Study Guide with Tips & Tricks for passing Exam

CAP Question Bank: Free PDF Download Recently Updated Questions

Benefit in Obtaining the Exam Certification

Certified Authorization Professional (CAP) report high job satisfaction report high job satisfaction
Company decision makers see value in certification

Test Outline

The (ISC)2 CAP exam has 125 questions in a multiple-choice format which you need to finish within 3 hours. The passing score of the test is 700 out of 1000 points. Such an exam is currently available in English and you are expected to fulfill seven domains on authorizing the management of information systems as shown below:

Execution of Different Privacy & Security Controls;
Program for Security Risk Management;
Information Systems Authorization;
Choosing Various Privacy & Security Controls;
Everlasting Monitoring.

NEW QUESTION 36
Certification and Accreditation (C&A or CnA) is a process for implementing information security.
Which of the following is the correct order of C&A phases in a DITSCAP assessment?

Definition, Validation, Verification, and Post Accreditation

Verification, Definition, Validation, and Post Accreditation

Verification, Validation, Definition, and Post Accreditation

Definition, Verification, Validation, and Post Accreditation

Section: Volume A

NEW QUESTION 37
Which of the following parts of BS 7799 covers risk analysis and management?

Part 1

Part 3

Part 2

Part 4

NEW QUESTION 38
You are the project manager of the NNQ Project for your company and are working you’re your project team to define contingency plans for the risks within your project. Mary, one of your project team members, asks what a contingency plan is. Which of the following statements best defines what a contingency response is?

Some responses are designed for use only if certain events occur.

Some responses have a cost and a time factor to consider for each risk event.

Some responses must counteract pending risk events.

Quantified risks should always have contingency responses.

NEW QUESTION 39
You are preparing to start the qualitative risk analysis process for your project. You will be relying on some organizational process assets to influence the process. Which one of the following is NOT a probable reason for relying on organizational process assets as an input for qualitative risk analysis?

Information on prior, similar projects

Review of vendor contracts to examine risks in past projects

Risk databases that may be available from industry sources

Studies of similar projects by risk specialists

NEW QUESTION 40
Which of the following acts is used to recognize the importance of information security to the economic and national security interests of the United States?

Computer Fraud and Abuse Act

FISMA

Lanham Act

Computer Misuse Act

NEW QUESTION 41
You work as a project manager for BlueWell Inc. You with your team are using a method or a (technical) process that conceives the risks even if all theoretically possible safety measures would be applied. One of your team member wants to know that what is a residual risk. What will you reply to your team member?

It is a risk that remains because no risk response is taken.

It is a risk that remains after planned risk responses are taken.

It is a risk that can not be addressed by a risk response.

It is a risk that will remain no matter what type of risk response is offered.

NEW QUESTION 42
You are the project manager of the NNH Project. In this project you have created a contingency response that the schedule performance index should be less than 0.93. The NHH Project has a budget at completion of
$945,000 and is 45 percent complete though the project should be 49 percent complete. The project has spent
$455,897 to reach the 45 percent complete milestone.
What is the project’s schedule performance index?

1.06

0.93

-$37,800

0.92

Section: Volume B

NEW QUESTION 43
You are the project manager for a construction project. The project involves casting of a column in a very narrow space. Because of lack of space, casting it is highly dangerous. High technical skill will be required for casting that column. You decide to hire a local expert team for casting that column. Which of the following types of risk response are you following?

Mitigation

Avoidance

Transference

Acceptance

NEW QUESTION 44
There are seven risk responses for any project. Which one of the following is a valid risk response for a negative risk event?

Exploit

Enhance

Acceptance

NEW QUESTION 45
You work as a project manager for TechSoft Inc. You are working with the project stakeholders onthe qualitative risk analysis process in your project. You have used all the tools to the qualitative risk analysis process in your project. Which of the following techniques is NOT used as a tool in qualitative risk analysis process?

Risk Reassessment

Risk Categorization

Risk Urgency Assessment

Risk Data Quality Assessment

NEW QUESTION 46
The National Information Assurance Certification and Accreditation Process (NIACAP) is the minimum standard process for the certification and accreditation of computer and telecommunications systems that handle U.S. national security information. Which of the following participants are required in a NIACAP security assessment?
Each correct answer represents a part of the solution. Choose all that apply.

Information Assurance Manager

Designated Approving Authority

IS program manager

User representative

Certification agent

NEW QUESTION 47
Tracy is the project manager of the NLT Project for her company. The NLT Project is scheduled to last 14 months and has a budget at completion of $4,555,000. Tracy’s organization will receive a bonus of $80,000 per day that the project is completed early up to $800,000. Tracy realizes that there are several opportunities within the project to save on time by crashing the project work.
Crashing the project is what type of risk response?

Mitigation

Exploit

Enhance

Transference

Section: Volume C

NEW QUESTION 48
Null Byte Injection is an active exploitation technique used to bypass sanity-checking filters in web applications by adding a URL-encoded null byte character to the user-supplied data. Which of the following is a URL-encoded representation of a null byte?

%01

%10

%25

%00

Null Byte Injection is a vulnerability where a null byte character (\0 or ASCII 0) is injected into user-supplied input to manipulate application behavior, often bypassing filters or terminating strings prematurely in languages like C or C++ that rely on null-terminated strings. In web applications, this is typically encoded in URLs using percent-encoding (e.g., %xx, where xx is the hexadecimal value). The ASCII value of a null byte is 0, which is represented as %00 in URL encoding.
* Option A (“%01”): Represents the ASCII character with value 1 (Start of Heading), not a null byte.
* Option B (“%10”): Represents the ASCII character with value 16 (Data Link Escape), not a null byte.
* Option C (“%25”): Represents the % character itself (ASCII 37), not a null byte.
* Option D (“%00”): Represents the null byte (ASCII 0), which is the correct URL-encoded form used in Null Byte Injection attacks.
The correct answer is D, aligning with the CAP syllabus under “Injection Attacks” and “Input Validation Bypasses.”References: SecOps Group CAP Documents – “Null Byte Injection,” “URL Encoding,” and
“OWASP Injection Prevention” sections.

NEW QUESTION 49
Sammy is the project manager for her organization. She would like to rate each risk based on its probability and affect on time, cost, and scope. Harry, a project team member, has never done this before and thinks Sammy is wrong to attempt this approach. Harry says that an accumulative risk score should be created, not three separate risk scores. Who is correct in this scenario?

Harry is correct, because the risk probability and impact considers all objectives of the proj ect.

Harry is correct, the risk probability and impact matrix is the only approach to risk assessm ent.

Sammy is correct, because she is the project manager.

Sammy is correct, because organizations can create risk scores for each objective of the pr oject.

Section: Volume C

NEW QUESTION 50
Which of the following NIST C&A documents is the guideline for identifying an information system as a National Security System?

NIST SP 800-53

NIST SP 800-59

NIST SP 800-37

NIST SP 800-53A

Section: Volume D

NEW QUESTION 51
What are the subordinate tasks of the Implement and Validate Assigned IA Control phase in the DIACAP process?
Each correct answer represents a complete solution. Choose all that apply.

Conduct activities related to the disposition of the system data and objects.

Execute and update IA implementation plan.

Conduct validation activities.

Combine validation results in DIACAP scorecard.

Section: Volume C
Explanation

NEW QUESTION 52
In which of the following DIACAP phases is residual risk analyzed?

Phase 2

Phase 4

Phase 5

Phase 3

Phase 1

Loading …