New BraindumpsPrep CAP Exam Questions| Real CAP Dumps Updated on Oct 29, 2025
CAP Braindumps – CAP Questions to Get Better Grades
NEW QUESTION # 28
Which of the following is a security policy implemented by an organization due to compliance, regulation, or other legal requirements?
- A. Regulatory policy
- B. Informative policy
- C. Advisory policy
- D. System Security policy
Answer: A
Explanation:
Section: Volume B
NEW QUESTION # 29
You are the project manager of the NHH project for your company. You have completed the first round of risk management planning and have created four outputs of the risk response planning process. Which one of the following is NOT an output of the risk response planning?
- A. Risk register updates
- B. Project document updates
- C. Risk-related contract decisions
- D. Organizational process assets updates
Answer: D
NEW QUESTION # 30
Which of the following C&A professionals plays the role of an advisor?
- A. Chief Information Officer (CIO)
- B. Information System Security Engineer (ISSE)
- C. Information Owner
- D. Authorizing Official
Answer: B
NEW QUESTION # 31
In which of the following phases of the DITSCAP process does Security Test and Evaluation (ST&E) occur?
- A. Phase 1
- B. Phase 4
- C. Phase 2
- D. Phase 3
Answer: D
NEW QUESTION # 32
Which of the following approaches can be used to build a security program?
Each correct answer represents a complete solution. Choose all that apply.
- A. Top-Down Approach
- B. Bottom-Up Approach
- C. Right-Up Approach
- D. Left-Up Approach
Answer: A,B
NEW QUESTION # 33
Security Test and Evaluation (ST&E) is a component of risk assessment. It is useful in discovering system vulnerabilities. For what purposes is ST&E used?
Each correct answer represents a complete solution. Choose all that apply.
- A. To implement the design of system architecture
- B. To assess the degree of consistency between the system documentation and its implement ation
- C. To uncover design, implementation, and operational flaws that may allow the violation of security policy
- D. To determine the adequacy of security mechanisms, assurances, and other properties to enforce the security policy
Answer: B,C,D
NEW QUESTION # 34
A high-profile, high-priority project within your organization is being created. Management wants you to pay special attention to the project risks and do all that you can to ensure that all of the risks are identified early in the project. Management has to ensure that this project succeeds.
Management's risk aversion in this project is associated with what term?
- A. Risk mitigation
- B. Quantitativerisk analysis
- C. Utility function
- D. Risk conscience
Answer: C
NEW QUESTION # 35
Which of the following statements reflect the 'Code of Ethics Canons' in the '(ISC)2 Code of Ethics'?
Each correct answer represents a complete solution. Choose all that apply.
- A. Give guidance for resolving good versus good and bad versus bad dilemmas.
- B. Provide diligent and competent service to principals.
- C. Protect society, the commonwealth, and the infrastructure.
- D. Act honorably, honestly, justly, responsibly, and legally.
Answer: B,C,D
NEW QUESTION # 36
Walter is the project manager of a large construction project. He'll be working with several vendors on the project. Vendors will be providing materials and labor for several parts of the project. Some of the works in the project are very dangerous so Walter has implemented safety requirements for all of the vendors and his own project team. Stakeholders for the project have added new requirements, which have caused new risks in the project. A vendor has identified a new risk that could affect the project if it comes into fruition.
Walter agrees with the vendor and has updated the risk register and created potential risk responses to mitigate the risk. What should Walter also update in this scenario considering the risk event?
- A. Project contractual relationship with the vendor
- B. Project management plan
- C. Project communications plan
- D. Project scope statement
Answer: B
NEW QUESTION # 37
Which of the following statements is true about the continuous monitoring process?
- A. It takes place before and after system security accreditation.
- B. It takes place in the middle of system security accreditation.
- C. It takes place after the initial system security accreditation.
- D. It takes place before the initial system security accreditation.
Answer: C
NEW QUESTION # 38
After purchasing an item on an e-commerce website, a user can view his order details by visiting the URL:
https://example.com/order_id=53870
A security researcher pointed out that by manipulating the order_id value in the URL, a user can view arbitrary orders and sensitive information associated with that order_id.
Which of the following is correct?
- A. The root cause of the problem is a weak authorization (Session Management) and by validating a user's privileges, the issue can be fixed
- B. None of the above
- C. The root cause of the problem is a lack of input validation and by implementing a strong whitelisting, the problem can be solved
- D. The problem can be solved by implementing a Web Application Firewall (WAF)
Answer: A
Explanation:
The scenario describes an e-commerce website where a user can view order details by manipulating the order_id parameter in the URL (e.g., https://example.com/order_id=53870). A security researcher found that changing the order_id allows access to arbitrary orders and sensitive data, indicating an authorization issue.
This is not a simple input validation problem (e.g., SQL injection or path traversal), as the input (order_id) is processed, but the system fails to enforce proper access controls. This is a classic case ofInsecure Direct Object References (IDOR), where an attacker can access resources by guessing or manipulating identifiers without proper authorization checks. The root cause is a weak authorization mechanism, likely tied to poor session management orprivilege validation, allowing unauthorized users to view others' data.
* Option A ("The root cause of the problem is a lack of input validation..."): Incorrect, as the issue is not about invalid input (e.g., malicious code) but about unauthorized access to valid data. Whitelisting might help sanitize input, but it doesn't address authorization.
* Option B ("The root cause of the problem is a weak authorization (Session Management)..."):
Correct, as the problem stems from inadequate authorization checks. Validating user privileges (e.g., ensuring the user can only access their own orders) or improving session management (e.g., tying orders to user sessions) can fix this IDOR vulnerability.
* Option C ("The problem can be solved by implementing a Web Application Firewall (WAF)"):
Incorrect as a standalone solution, as WAFs mitigate certain attacks (e.g., SQLi, XSS) but are not a substitute for fixing authorization logic. A WAF might detect patterns but won't enforce proper access control.
* Option D ("None of the above"): Incorrect, as Option B accurately identifies the root cause and solution.
The correct answer is B, aligning with the CAP syllabus under "Authorization and Access Control" and
"OWASP Top 10 (A04:2021 - Insecure Design)."References: SecOps Group CAP Documents - "Session Management," "Insecure Direct Object References (IDOR)," and "OWASP Top 10" sections.
NEW QUESTION # 39
Which of the following statements about System Access Control List (SACL) is true?
- A. It exists for each and every permission entry assigned to any object.
- B. It contains a list of any events that are set to audit for that particular object.
- C. It is a mechanism for reducing the need for globally unique IP addresses.
- D. It contains a list of both users and groups and whatever permissions they have.
Answer: B
Explanation:
Section: Volume C
NEW QUESTION # 40
Which of the following individuals informs all C&A participants about life cycle actions, security requirements, and documented user needs?
- A. IS program manager
- B. User representative
- C. Certification Agent
- D. DAA
Answer: A
NEW QUESTION # 41
You are the project manager of the CUL project in your organization. You and the project team are assessing the risk events and creating a probability and impact matrix for the identified risks.
Which one of the following statements best describes the requirements for the data type used in qualitative risk analysis?
- A. A qualitative risk analysis encourages biased data to reveal risk tolerances.
- B. A qualitative risk analysis requires fast and simple data to complete the analysis.
- C. A qualitative risk analysis required unbiased stakeholders with biased risk tolerances.
- D. A qualitative risk analysis requires accurate and unbiased data if it is to be credible.
Answer: D
Explanation:
Section: Volume C
NEW QUESTION # 42
Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. Which of the following are the international information security standards?
Each correct answer represents a complete solution. Choose all that apply.
- A. AU audit and accountability
- B. Organization of information security
- C. Risk assessment and treatment
- D. Human resources security
Answer: B,C,D
NEW QUESTION # 43
In 2003, NIST developed a new Certification & Accreditation (C&A) guideline known as FIPS 199.
What levels of potential impact are defined by FIPS 199?
Each correct answer represents a complete solution. Choose all that apply.
- A. Low
- B. Medium
- C. High
- D. Moderate
Answer: A,B,C
Explanation:
Section: Volume C
NEW QUESTION # 44
Under the same-origin policy (also SOP), a web browser permits scripts contained in a web page to access data in another web page, but only if both web pages have the same origin. Which of the following pages are in the same origin as that of the below URL?
http://www.example.com/dir/page2.html
* http://www.example.com/dir/other.html
* http://www.example.com:81/dir/other.html
* http://www.example.com/dir/other.html
* http://en.example.com/dir/other.html
- A. 1 Only
- B. None of the above
- C. 1 and 2
- D. 1, 3 and 4
Answer: A
Explanation:
The Same-Origin Policy (SOP) is a fundamental security mechanism in web browsers that restricts how a document or script loaded from one origin can interact with resources from another origin. An origin is defined by the combination ofprotocol,host, andport.
Two pages have the same origin if their protocol (e.g., http://), host (e.g., www.example.com), and port (default is 80 for HTTP) match exactly. The given URL is http://www.example.com/dir/page2.html, which uses HTTP, host www.example.com, and the default port 80.
* Option 1 ("http://www.example.com/dir/other.html"): Matches the protocol (http), host (www.
example.com), and port (default 80), so it is in the same origin.
* Option 2 ("http://www.example.com:81/dir/other.html"): Differs in port (81 vs. default 80), so it is a different origin.
* Option 3 ("http://www.example.com/dir/other.html"): Identical to Option 1, matching protocol, host, and port, so it is in the same origin. However, since it's a duplicate of Option 1 in the list, it doesn' t add a new page.
* Option 4 ("http://en.example.com/dir/other.html"): Differs in host (en.example.com vs.www.
example.com), so it is a different origin.
Since the question asks which pages are in the same origin, and only Option 1 (and its duplicate Option 3) matches, the correct answer is A ("1 Only"), considering unique pages. The CAP syllabus covers SOP under
"Client-Side Security" and "Cross-Origin Resource Sharing (CORS)."References: SecOps Group CAP Documents - "Same-Origin Policy," "Browser Security Models," and "OWASP Client-Side Security" sections.
NEW QUESTION # 45
Which of the following processes has the goal to ensure that any change does not lead to reduced or compromised security?
- A. Configuration management
- B. Security management
- C. Risk management
- D. Change control management
Answer: D
Explanation:
Section: Volume D
NEW QUESTION # 46
You are the project manager of the GGG project. You have completed the risk identification process for the initial phases of your project. As you begin to document the risk events in the risk register what additional information can you associate with the identified risk events?
- A. Risk cost
- B. Risk potential responses
- C. Risk schedule
- D. Risk owner
Answer: B
NEW QUESTION # 47
......
CAP Exam Dumps - Try Best CAP Exam Questions: https://passleader.briandumpsprep.com/CAP-prep-exam-braindumps.html
