I85PREP
⌘ K
CAP study materials
CAP study resources

CAP (ABRET) practice questions

One question at a time. Build your CAP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security and Privacy Governance, Risk Management, and Compliance Program

Under the NIST Cybersecurity Framework, which function is primarily concerned with establishing organizational understanding of cybersecurity risk to systems, people, assets, data, and capabilities?

  1. Protect
  2. Detect
  3. Identify Correct answer.
  4. Recover

Explanation

The Identify function develops organizational understanding of cybersecurity risk to systems, people, assets, data, and capabilities, providing the foundation for prioritized decisions. Protect, Detect, and Recover are separate functions that build on or respond to that understanding rather than establishing the asset and risk baseline.

Question 2Security and Privacy Governance, Risk Management, and Compliance Program

In a security governance program, which body typically holds ultimate accountability for accepting enterprise-level information security risk?

  1. The IT service desk supervisor
  2. The external penetration testing vendor
  3. The board of directors or an equivalent governing body Correct answer.
  4. The security operations center shift lead

Explanation

Ultimate accountability for enterprise risk acceptance sits with the board or equivalent governing body, which sets risk appetite and delegates execution to management. Operational roles and vendors execute controls and provide input but do not own enterprise-level risk acceptance.

Question 3Security and Privacy Governance, Risk Management, and Compliance Program

Which statement best describes the relationship between a policy, a standard, and a procedure in a security governance hierarchy?

  1. A policy, a standard, and a procedure are interchangeable terms for the same document type.
  2. A standard states management intent, a procedure sets mandatory requirements, and a policy lists step-by-step tasks.
  3. A policy states management intent, a standard specifies mandatory requirements, and a procedure describes step-by-step tasks. Correct answer.
  4. A procedure states management intent, a policy sets mandatory requirements, and a standard lists step-by-step tasks.

Explanation

Policies express management intent and high-level direction, standards translate that intent into specific mandatory requirements, and procedures give detailed step-by-step instructions for performing tasks. This descending hierarchy keeps intent stable while allowing implementation detail to change.

Question 4Security and Privacy Governance, Risk Management, and Compliance Program

A risk practitioner is calculating a risk score using likelihood and impact. Which term describes the resulting product before any controls are applied?

  1. Control deficiency
  2. Inherent risk Correct answer.
  3. Risk appetite
  4. Residual risk

Explanation

Inherent risk is the exposure that exists before controls are applied, computed from likelihood and impact. Residual risk is what remains after controls, while risk appetite is a tolerance threshold and a deficiency is a control gap.

Question 5Security and Privacy Governance, Risk Management, and Compliance Program

Which classification label is most appropriate for information whose unauthorized disclosure could cause severe damage to an organization and is restricted to a named group of employees?

  1. Declassified
  2. Internal use only
  3. Public
  4. Confidential or restricted Correct answer.

Explanation

A confidential or restricted label is used for information whose disclosure causes severe damage and whose access is limited to named individuals or groups. Public and internal labels permit broader distribution, and declassified refers to formally released government information.

Question 6Security and Privacy Governance, Risk Management, and Compliance Program

Which activity is the primary purpose of a periodic access recertification campaign in a compliance program?

  1. Confirming that users still require the access they hold Correct answer.
  2. Testing the failover of backup power systems
  3. Encrypting data at rest on production servers
  4. Measuring network throughput against capacity baselines

Explanation

Access recertification requires managers or asset owners to confirm that each user still needs the entitlements they hold, supporting least privilege and audit evidence. Encryption, failover testing, and capacity measurement are technical control activities unrelated to entitlement review.

Question 7Security and Privacy Governance, Risk Management, and Compliance Program

In privacy program terms, what does a data protection impact assessment (DPIA) primarily evaluate?

  1. The accuracy of the general ledger reconciliation
  2. The uptime of the payroll application
  3. The risks to individuals arising from a processing activity Correct answer.
  4. The financial return of a marketing campaign

Explanation

A DPIA assesses risks to individuals' rights and freedoms arising from a processing activity, especially where processing is high risk, and identifies mitigations. It is a privacy risk instrument, not a financial, availability, or accounting control.

Question 8Security and Privacy Governance, Risk Management, and Compliance Program

Which document formally authorizes a system to operate after its security controls have been assessed and residual risk has been accepted?

  1. System security plan
  2. Authorization to operate Correct answer.
  3. Business continuity plan
  4. Incident response plan

Explanation

An authorization to operate is the formal decision, made by an authorizing official, that permits a system to operate based on assessed controls and accepted residual risk. The system security plan documents controls, while the incident and continuity plans address response and resilience.

Question 9Security and Privacy Governance, Risk Management, and Compliance Program

An organization wants to express its tolerance for risk in a way that guides project decisions. Which concept defines the amount and type of risk an entity is willing to accept in pursuit of its objectives?

  1. Risk appetite Correct answer.
  2. Risk register
  3. Risk aggregation
  4. Risk transfer

Explanation

Risk appetite articulates the amount and type of risk an organization is willing to accept to pursue its objectives, guiding decisions such as whether to proceed with a project. A register records risks, transfer shifts risk to another party, and aggregation combines exposures.

Question 10Security and Privacy Governance, Risk Management, and Compliance Program

A team identifies a risk, applies a compensating control, and then recalculates the exposure. What is the recalculated value called?

  1. Risk capacity
  2. Risk universe
  3. Residual risk Correct answer.
  4. Inherent risk

Explanation

Residual risk is the exposure remaining after controls or compensating measures are applied and recalculated. Inherent risk is the pre-control exposure, capacity is the maximum risk an entity can bear, and the risk universe is the full set of risks considered.

Question 11Security and Privacy Governance, Risk Management, and Compliance Program

An organization must demonstrate to an auditor that a control operated throughout the year, not just at a point in time. Which evidence type best supports this assertion?

  1. A verbal confirmation from the control owner
  2. A design document created before the audit period
  3. A single screenshot taken on the last day of the year
  4. A sample of control execution records across the audit period Correct answer.

Explanation

Operating effectiveness over a period is demonstrated by a sample of execution records distributed across the period, showing the control ran consistently. A point-in-time screenshot, a verbal statement, or a design document alone does not evidence continuous operation.

Question 12Security and Privacy Governance, Risk Management, and Compliance Program

A vendor will process regulated personal data on the organization's behalf. Which instrument most directly establishes the vendor's contractual privacy and security obligations?

  1. A master service level agreement covering uptime only
  2. A nondisclosure agreement limited to negotiations
  3. An internal acceptable use policy
  4. A data processing agreement Correct answer.

Explanation

A data processing agreement sets out the processor's obligations for handling personal data, including security measures, subprocessors, breach notification, and data return or deletion. An SLA on uptime, an NDA, and an internal policy do not impose the required processor obligations.

Question 13Security and Privacy Governance, Risk Management, and Compliance Program

During risk assessment, a team scores a risk as high likelihood and high impact but notes that existing detective controls would only reveal the event after damage occurs. Which response strategy involves sharing the financial consequence with an insurer?

  1. Risk avoidance
  2. Risk mitigation
  3. Risk transfer Correct answer.
  4. Risk acceptance

Explanation

Risk transfer shifts the financial consequence of a risk to a third party such as an insurer, while the underlying event may still occur. Mitigation reduces likelihood or impact, avoidance eliminates the activity, and acceptance retains the exposure.

Question 14Security and Privacy Governance, Risk Management, and Compliance Program

Which metric best indicates whether a vulnerability management program is keeping pace with newly disclosed issues?

  1. The frequency of password rotations
  2. The median time from vulnerability disclosure to remediation Correct answer.
  3. The number of firewalls deployed
  4. The count of employees who completed phishing training

Explanation

Median time from disclosure to remediation measures how quickly the program closes newly disclosed vulnerabilities, reflecting pace and effectiveness. Firewall counts, training completion, and password rotation frequency measure other controls and do not indicate remediation timeliness.

Question 15Security and Privacy Governance, Risk Management, and Compliance Program

A privacy principle requires collecting only the personal data that is adequate, relevant, and limited to what is necessary for the stated purpose. Which term names this principle?

  1. Data portability
  2. Data minimization Correct answer.
  3. Storage limitation
  4. Purpose limitation

Explanation

Data minimization requires that personal data be adequate, relevant, and limited to what is necessary for the purpose. Purpose limitation restricts use to stated purposes, storage limitation caps retention, and portability concerns transferring data.

Question 16Security and Privacy Governance, Risk Management, and Compliance Program

An organization is defining recovery objectives for a critical service. Which pair of metrics specifies the maximum tolerable data loss and the maximum tolerable downtime, respectively?

  1. RPO and RTO Correct answer.
  2. RTO and RPO
  3. SLA and OLA
  4. MTBF and MTTR

Explanation

Recovery point objective defines the maximum tolerable data loss measured in time, while recovery time objective defines the maximum tolerable downtime for restoring the service. The order matters, so RPO precedes RTO for loss then downtime.

Question 17Security and Privacy Governance, Risk Management, and Compliance Program

A compliance analyst maps an internal control to a regulatory requirement and records the evidence source. What is the primary benefit of maintaining this mapping?

  1. It guarantees that no regulatory change will affect the program
  2. It replaces the need for a risk register
  3. It eliminates the need for independent audits
  4. It demonstrates traceability between obligations and controls and supports reuse across frameworks Correct answer.

Explanation

Control-to-requirement mapping provides traceability showing how each obligation is met and allows evidence and controls to be reused across multiple frameworks. It does not remove the need for audits, immunize against regulatory change, or substitute for a risk register.

Question 18Security and Privacy Governance, Risk Management, and Compliance Program

A security manager must decide whether to fund a control that reduces a high-impact risk. Which input most directly informs whether the control is justified?

  1. The seniority of the engineer who proposed the control
  2. The color scheme of the risk dashboard
  3. The number of pages in the vendor's product brochure
  4. The control's cost compared with the expected reduction in risk exposure Correct answer.

Explanation

Justifying a control requires comparing its cost against the expected reduction in risk exposure, often through a cost-benefit or return-on-security-investment analysis. Brochure length, proposer seniority, and dashboard design do not quantify risk reduction relative to cost.

Question 19Security and Privacy Governance, Risk Management, and Compliance Program

Which statement correctly distinguishes an internal audit function from a security operations function within governance?

  1. Internal audit runs the firewalls, while security operations provides independent assurance.
  2. Both functions report to the same manager to preserve independence.
  3. Internal audit independently assesses controls, while security operations implements and runs them. Correct answer.
  4. Internal audit and security operations perform identical duties under different names.

Explanation

Independence requires that internal audit assess controls without operational responsibility, while security operations implements and operates controls. Combining the roles or placing both under one manager undermines the objectivity of assurance.

Question 20Security and Privacy Governance, Risk Management, and Compliance Program

An organization adopts a control framework to satisfy several regulations at once. Which approach most efficiently reduces duplicate evidence collection?

  1. Harmonizing common controls and mapping each regulation to the unified control set Correct answer.
  2. Outsourcing all compliance evidence to a single regulator
  3. Building a separate control set for each regulation with unique evidence
  4. Eliminating controls that appear in more than one regulation

Explanation

Harmonizing common controls and mapping each regulation to a unified set lets one control and its evidence satisfy multiple obligations, reducing duplication. Separate control sets multiply effort, regulators do not collect internal evidence, and removing shared controls creates gaps.

Question 21Security and Privacy Governance, Risk Management, and Compliance Program

A risk register shows a risk with high inherent exposure but low residual exposure after controls. An executive argues the risk should be removed from the register. Which reasoning is most sound?

  1. Retain it only if the control has never been tested.
  2. Retain it, because controls can fail and the inherent exposure and control performance still require monitoring. Correct answer.
  3. Remove it, because inherent risk is irrelevant once controls are implemented.
  4. Remove it, because residual exposure below appetite means the risk no longer exists.

Explanation

A low residual score depends on controls continuing to operate, so the risk stays in the register with monitoring of control performance and inherent exposure. Removing it ignores control failure and drift, and inherent risk remains relevant context for prioritization.

Question 22Security and Privacy Governance, Risk Management, and Compliance Program

A regulator introduces a new requirement mid-year. Which governance response best preserves both compliance and operational stability?

  1. Delegate interpretation of the requirement entirely to the IT service desk
  2. Immediately halt all processing until a full program rewrite is complete
  3. Wait until the next annual audit to determine whether the requirement applies
  4. Perform an impact assessment, map the requirement to existing controls, and remediate gaps on a risk-prioritized schedule Correct answer.

Explanation

Assessing impact, mapping the new requirement to existing controls, and remediating gaps by risk priority addresses the obligation while limiting disruption. Halting all processing is disproportionate, and delegating interpretation or deferring to the next audit risks noncompliance.

Question 23Security and Privacy Governance, Risk Management, and Compliance Program

An organization wants assurance that a critical third party's controls remain effective between annual reviews. Which mechanism provides the most timely ongoing signal?

  1. Relying solely on the contract signed at onboarding
  2. Reviewing the vendor's marketing materials each year
  3. Requiring periodic attestations and continuous monitoring data such as security ratings or shared telemetry Correct answer.
  4. Assuming the vendor's certifications never expire

Explanation

Periodic attestations combined with continuous monitoring data give ongoing, timely signals of a third party's control effectiveness between full reviews. A one-time contract, marketing materials, and expired certifications provide stale or unreliable assurance.

Question 24Security and Privacy Governance, Risk Management, and Compliance Program

A board asks how the security program's risk posture compares with its stated tolerance. Which reporting approach best answers the question?

  1. A dashboard showing aggregated risk against appetite thresholds with trends and exceptions Correct answer.
  2. A narrative describing the history of the security department
  3. A count of security staff by tenure
  4. A list of every open vulnerability ticket sorted by creation date

Explanation

Aggregating risk against appetite thresholds with trends and highlighted exceptions lets the board judge posture relative to tolerance. Raw ticket lists, departmental history, and staffing counts do not express exposure against tolerance.

Question 25Security and Privacy Governance, Risk Management, and Compliance Program

Which element of a governance program establishes the authority and accountability for security decisions across business units?

  1. A technical standard listing approved encryption algorithms
  2. An incident response runbook for malware containment
  3. A vulnerability scan schedule for internet-facing hosts
  4. A documented security governance structure with defined roles, decision rights, and reporting lines Correct answer.

Explanation

Governance is about who decides, who is accountable, and how decisions escalate. A structure that assigns roles, decision rights, and reporting lines gives the program authority and traceability. Technical standards, scan schedules, and runbooks are operational artifacts executed inside that governance structure.

Question 26Security and Privacy Governance, Risk Management, and Compliance Program

A security team wants to show that its controls align with a recognized industry framework while also satisfying contractual obligations. Which artifact best documents this mapping?

  1. A control matrix that links each framework control to internal procedures and to the contract clauses it satisfies Correct answer.
  2. A network diagram of the production environment
  3. A purchase order showing the cost of the compliance tooling
  4. A list of past audit findings with remediation dates

Explanation

A control matrix provides traceability from framework requirements to implemented procedures and to external obligations such as contract clauses. This lets auditors and customers see coverage without duplicating assessments. The other artifacts contain useful data but do not establish the crosswalk between requirements and controls.

Question 27Security and Privacy Governance, Risk Management, and Compliance Program

An organization discovers that a business unit bypassed an approved change process to deploy a customer-facing service handling personal data. Which governance response best addresses the root cause rather than only the symptom?

  1. Disable the service immediately and issue a written warning to the responsible engineer
  2. Add a quarterly attestation that the change process was followed
  3. Review why the process was bypassed, then adjust controls and incentives so compliant delivery is the easier path Correct answer.
  4. Require the business unit to purchase additional monitoring tooling

Explanation

A bypass usually signals friction, unclear ownership, or misaligned incentives in the process itself. Examining the cause and redesigning controls so compliance is practical addresses the systemic driver. Punitive or additive measures may suppress reporting without removing the reason for the bypass.

Question 28Security and Privacy Governance, Risk Management, and Compliance Program

A compliance manager needs to demonstrate that privacy requirements are embedded in day-to-day engineering work rather than checked only before launch. Which practice most directly provides that evidence?

  1. A quarterly meeting between legal and engineering leadership
  2. A privacy notice published on the corporate website
  3. An annual privacy awareness course completed by all staff
  4. Privacy requirements defined as testable acceptance criteria in the team's backlog and verified in pull requests Correct answer.

Explanation

Embedding requirements as testable acceptance criteria and verifying them during code review shows privacy controls operating inside the delivery workflow. This produces continuous, auditable evidence tied to actual changes. Training, notices, and leadership meetings support awareness but do not demonstrate embedded engineering practice.

Question 29Security and Privacy Governance, Risk Management, and Compliance Program

An executive asks why the risk register shows a control as both mitigating a risk and introducing a new exposure. Which explanation reflects sound risk governance reasoning?

  1. New exposures are recorded only when they exceed the organization's risk appetite threshold
  2. A control that mitigates any risk cannot simultaneously create risk, so the register entry is an error
  3. Secondary risk is only relevant for insurance decisions and should be excluded from the register
  4. Controls alter the risk landscape, so each control should be assessed for the residual risk it reduces and the new exposure it creates Correct answer.

Explanation

Every control changes the risk picture: it reduces the targeted risk but can introduce secondary risks, such as added complexity or new dependencies. Mature governance captures both effects so decisions reflect net exposure. Excluding secondary risk, or recording it only above appetite, hides exposure that still requires ownership.

Question 30Scope of the System

In the CAP framework, the scope of the system defines which of the following?

  1. The set of vendors approved for procurement
  2. The boundary within which the system must be described and assessed Correct answer.
  3. The team that owns the risk register
  4. The network topology used for production traffic

Explanation

Scope of the system establishes the boundary of what is being described, assessed, and controlled. Everything inside that boundary is part of the system description, and everything outside it is treated as environment or external interface. Getting the boundary wrong invalidates later risk and control decisions.

Question 31Scope of the System

An assessor is documenting a system and must decide what counts as part of the system versus its environment. Which criterion best supports that decision?

  1. Whether the component is physically located in the same building
  2. Whether the component was purchased from the same supplier
  3. Whether the component is within the management control and authorization boundary being described Correct answer.
  4. Whether the component appears on the organization chart

Explanation

The system boundary is drawn around the components, people, processes, and data that fall under the stated management control and authorization boundary. Physical location, supplier, and org chart are not reliable determinants. This keeps the description coherent with the controls and risk decisions applied to it.

Question 32Scope of the System

Which statement best describes how interfaces should be treated when defining the scope of a system?

  1. Interfaces are documented as the points where the system exchanges data or control with its environment Correct answer.
  2. Interfaces are only relevant when a network firewall is involved
  3. Interfaces are documented only after an incident occurs
  4. Interfaces are excluded because they belong to other systems

Explanation

Interfaces sit on the boundary and are where trust relationships and data flows cross between the system and its environment. They must be identified and described so that the risks at those crossing points are visible. Omitting them leaves a gap in the system description.

Question 33Scope of the System

A system description lists a cloud provider's underlying hypervisor as an external dependency. What is the most defensible scoping rationale?

  1. The hypervisor is outside the organization's direct control and is therefore treated as part of the environment Correct answer.
  2. The hypervisor is licensed software and licensing is out of scope
  3. The hypervisor is a hardware component and hardware is always out of scope
  4. The hypervisor is invisible to users and can be ignored

Explanation

Components the organization does not directly control are typically described as external dependencies or environment, while their influence on the system is still captured. The rationale is about control and authorization, not about visibility or the hardware/software distinction. This preserves an accurate boundary.

Question 34Scope of the System

Which of the following is a primary purpose of clearly documenting the scope of the system?

  1. To satisfy a preference for longer documentation
  2. To reduce the number of controls that must be implemented
  3. To guarantee that no security incident can occur
  4. To establish a common understanding of what is being assessed and where responsibility lies Correct answer.

Explanation

A documented scope gives assessors, owners, and reviewers a shared reference for what is inside the boundary and who is accountable for it. It does not by itself reduce controls or guarantee outcomes. Its value is in alignment and traceability.

Question 35Scope of the System

A team is scoping a system that processes customer records. Which element is most clearly inside the system boundary?

  1. The application and database that store and process the records Correct answer.
  2. The regulator that issues privacy rules
  3. The public internet service provider used by customers
  4. The industry association that publishes best practices

Explanation

The application and its data store are components the organization operates and controls, so they belong inside the boundary. Regulators, ISPs, and industry bodies influence the system but are environment. Distinguishing operated components from influencing parties is central to scoping.

Question 36Scope of the System

When the scope of a system changes, what should happen to the associated system description and risk assessment?

  1. They should be discarded and rebuilt from scratch each time
  2. They should be reviewed and updated to reflect the new boundary Correct answer.
  3. They should remain frozen to preserve the original baseline
  4. They should be updated only at the next scheduled audit

Explanation

Scope changes alter which components, interfaces, and dependencies are in view, so the description and risk assessment must be revisited. Keeping a frozen baseline leaves the documentation inconsistent with reality. Rebuilding from scratch is unnecessary when a controlled update suffices.

Question 37Scope of the System

Which pair correctly distinguishes the system from its environment?

  1. System: all hardware; Environment: all software
  2. System: components under the organization's control; Environment: external parties and conditions that affect it Correct answer.
  3. System: internal staff; Environment: all contractors
  4. System: production data; Environment: backup data

Explanation

The system comprises the components the organization controls and authorizes, while the environment comprises external parties and conditions that influence it. The other pairings use arbitrary categories such as hardware/software or staff type. Control and authorization are the consistent dividing line.

Question 38Scope of the System

A system description omits a third-party API that the application calls at runtime. What is the main consequence for the assessment?

  1. The API automatically becomes out of scope permanently
  2. Nothing changes because APIs are always environment
  3. A trust and data-flow path is missing, so related risks may go unidentified Correct answer.
  4. The assessment becomes more conservative and therefore safer

Explanation

An unlisted runtime dependency means a data flow and trust relationship crossing the boundary is invisible to the assessment. Risks such as data exposure or availability loss through that API may then be missed. Completeness of interfaces and dependencies is essential to valid scoping.

Question 39Scope of the System

Which item is best classified as an organizational rather than technical element of the system scope?

  1. The database schema version
  2. The roles and responsibilities assigned to system operators Correct answer.
  3. The load balancer configuration
  4. The encryption algorithm used at rest

Explanation

Roles and responsibilities are organizational elements that belong in the system description alongside technical components. Algorithms, schemas, and load balancer settings are technical configuration. A complete scope covers people, process, and technology together.

Question 40Scope of the System

Two business units share a single identity provider. How should the identity provider be scoped for each unit's system description?

  1. Each unit should document it as an external dependency with the trust relationship described Correct answer.
  2. Each unit should ignore it because it is shared
  3. Only the unit that paid for it should document it
  4. It should be documented once and never referenced again

Explanation

A shared service sits outside each unit's direct control, so each description treats it as an external dependency and records the trust and authentication relationship. Shared ownership does not remove the need to document it. This keeps each system description accurate on its own terms.

Question 41Scope of the System

What is the role of an authorization boundary in defining the scope of a system?

  1. It sets the maximum number of servers allowed
  2. It marks the limit within which a single authority grants and enforces access decisions Correct answer.
  3. It defines the physical perimeter of a data center
  4. It lists every user who has ever logged in

Explanation

An authorization boundary marks where one authority's access decisions apply, which aligns closely with the system boundary. It is not a physical perimeter, a user list, or a capacity limit. Aligning scope with the authorization boundary keeps accountability coherent.

Question 42Scope of the System

A candidate assessor claims that anything not owned by the IT department is outside the system scope. Why is this reasoning flawed?

  1. Because IT departments never own anything relevant
  2. Because ownership is only relevant to finance
  3. Because scope is determined solely by the vendor contract
  4. Because scope depends on control and authorization over the system, not on departmental ownership of assets Correct answer.

Explanation

Scope follows control and authorization over the system as a whole, which can include assets managed by other departments or by service providers under agreement. Departmental ownership is an internal allocation that may not match the boundary. Using it as the criterion can wrongly exclude relevant components.

Question 43Scope of the System

Which of the following best describes a data flow that crosses the system boundary?

  1. A backup written to a disk inside the same server
  2. A transfer of information between an internal component and an external party Correct answer.
  3. A log entry generated within the application
  4. A configuration change applied by an internal administrator

Explanation

A boundary-crossing data flow moves information between the system and something in its environment. Internal backups, internal log generation, and internal configuration changes stay within the boundary. Identifying crossing flows is essential to scoping interfaces.

Question 44Scope of the System

A system is being re-scoped after migrating from on-premises hosting to a managed cloud service. Which change to the description is most important?

  1. Removing the application from scope because it is now hosted elsewhere
  2. Adding the provider's other customers to the system description
  3. Deleting all previous documentation to avoid confusion
  4. Recording the provider as an external dependency and updating the trust and responsibility split Correct answer.

Explanation

Migration shifts part of the infrastructure into a provider's control, so the provider becomes an external dependency with an explicit responsibility split. The application remains in scope because the organization still operates and authorizes it. Deleting history or adding unrelated tenants misstates the boundary.

Question 45Scope of the System

Which statement about the level of detail in a system description is most consistent with good scoping practice?

  1. Detail should match whatever a competitor publishes
  2. Detail should be minimized to a single sentence
  3. Detail should be sufficient to support the risk assessment and control decisions for the defined scope Correct answer.
  4. Detail should be maximized regardless of relevance

Explanation

The description should be detailed enough to support the decisions it informs, and no more. Excess detail that is irrelevant adds cost without benefit, while too little detail leaves risks unexamined. Proportionality to purpose is the guiding principle.

Question 46Scope of the System

An assessor finds that a system's documented scope excludes a legacy reporting tool that still reads production data. What is the most appropriate action?

  1. Accept the exclusion because it is already documented
  2. Evaluate whether the tool belongs inside the boundary and update the description accordingly Correct answer.
  3. Expand scope to include every application in the organization
  4. Remove the reporting tool from the network without analysis

Explanation

A component that reads production data interacts with the system and may belong inside the boundary or be documented as a dependency. The correct response is to evaluate and update, not to accept an unexamined exclusion. Over-expanding scope to everything is equally unjustified.

Question 47Scope of the System

Which of the following is the best example of a system's environment rather than the system itself?

  1. The authentication module built into the application
  2. The application server hosting the service
  3. The database storing customer orders
  4. The regulatory jurisdiction whose laws the service must obey Correct answer.

Explanation

The regulatory jurisdiction is an external condition that constrains the system but is not a component the organization operates. Servers, databases, and internal modules are components within the boundary. This distinction keeps external constraints visible without misclassifying them as system parts.

Question 48Scope of the System

A system description identifies several suppliers but does not state what each supplies to the system. Why does this weaken the scope description?

  1. Because the dependency's role and the resulting risk cannot be assessed without knowing what it provides Correct answer.
  2. Because supplier names are confidential and should be omitted
  3. Because suppliers must always be listed alphabetically
  4. Because suppliers are never part of a system description

Explanation

Naming a supplier without describing its contribution leaves the dependency's role and associated risk undefined. The description should state what each external party provides and how the system relies on it. This makes trust and continuity risks assessable.

Question 49Scope of the System

Which question is most useful for testing whether a component belongs inside the system boundary?

  1. Is this component managed by the most senior manager?
  2. Is this component the newest technology in the estate?
  3. Does this component have the largest budget?
  4. Does the organization authorize and control how this component operates within the system? Correct answer.

Explanation

Control and authorization are the criteria that determine whether a component is inside the boundary. Novelty, budget size, and managerial seniority are irrelevant to scoping. A consistent test prevents arbitrary inclusions and exclusions.

Question 50Scope of the System

What is the relationship between the scope of the system and the controls selected for it?

  1. Controls apply only to components outside the scope
  2. Controls and scope are unrelated activities
  3. Controls are selected first and scope is then adjusted to fit them
  4. Controls are selected to address the risks of the components and interfaces within the defined scope Correct answer.

Explanation

Scope determines what must be protected, and controls are then chosen to address the risks within that boundary. Reversing the order lets controls dictate an inaccurate scope. The two activities are linked, not independent.