I85PREP
⌘ K
CAP study materials
CAP study resources

CAP (The American College Credentials) practice questions

One question at a time. Build your CAP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk Management Framework (RMF)

In the NIST Risk Management Framework, which step is performed first?

  1. Assess security controls
  2. Categorize the system Correct answer.
  3. Select security controls
  4. Authorize system operation

Explanation

The RMF begins with categorizing the system based on the potential impact of compromise to confidentiality, integrity, and availability. The resulting categorization determines the control baseline that is selected in the following step.

Question 2Risk Management Framework (RMF)

Which role has the authority to formally accept risk and authorize a system to operate?

  1. Security control assessor
  2. Authorizing official Correct answer.
  3. Information system security officer
  4. System administrator

Explanation

The authorizing official is the senior official who weighs assessment results and residual risk and then makes the authorization decision. This authority cannot be delegated to the assessment team or to system operations staff.

Question 3Risk Management Framework (RMF)

Which document describes the system, its authorization boundary, and the security controls that are implemented or planned?

  1. System security plan Correct answer.
  2. Plan of action and milestones
  3. Security assessment report
  4. Authorization decision document

Explanation

The system security plan is the primary document that describes the system boundary, environment, and control implementation details. It serves as a key input to the assessor and the authorizing official.

Question 4Risk Management Framework (RMF)

Under FIPS 199, security categorization evaluates potential impact to which set of objectives?

  1. Availability, integrity, and privacy
  2. Authentication, authorization, and accounting
  3. Confidentiality, integrity, and nonrepudiation
  4. Confidentiality, integrity, and availability Correct answer.

Explanation

FIPS 199 defines security categories in terms of potential impact on confidentiality, integrity, and availability. Each objective is rated separately, and the overall system category reflects the highest rating.

Question 5Risk Management Framework (RMF)

What is the primary purpose of a plan of action and milestones?

  1. Track remediation of identified weaknesses and associated residual risk Correct answer.
  2. Record the authorizing official's decision
  3. Define the system authorization boundary
  4. Establish the system's impact categorization

Explanation

A plan of action and milestones documents weaknesses found during assessment, the planned corrective actions, resources, and completion dates. It supports risk management by tracking how residual risk will be reduced over time.

Question 6Risk Management Framework (RMF)

Which RMF step focuses on maintaining situational awareness and performing ongoing assessments after authorization?

  1. Assess
  2. Implement
  3. Monitor Correct answer.
  4. Select

Explanation

The monitor step sustains authorization by tracking control effectiveness, changes, and emerging risks over time. It relies on continuous monitoring activities rather than a one-time assessment.

Question 7Risk Management Framework (RMF)

Security control baselines used in the RMF are derived primarily from which sources?

  1. FIPS 199 only
  2. NIST SP 800-37 only
  3. NIST SP 800-30 only
  4. FIPS 200 and the NIST SP 800-53 control catalog Correct answer.

Explanation

FIPS 200 specifies minimum security requirements, and NIST SP 800-53 provides the control catalog from which baselines are built. Baselines are organized by impact level and then tailored for the specific system.

Question 8Risk Management Framework (RMF)

Which document contains the assessor's findings and the results of security control testing?

  1. Authorization decision
  2. Plan of action and milestones
  3. Security assessment report Correct answer.
  4. System security plan

Explanation

The security assessment report documents the assessor's methods, evidence, findings, and risk determinations for each control. The authorizing official uses it, along with the system security plan and POA&M, to make the authorization decision.

Question 9Risk Management Framework (RMF)

A system has moderate confidentiality impact, low integrity impact, and high availability impact. What is the overall security category?

  1. The category cannot be determined
  2. Low
  3. Moderate
  4. High Correct answer.

Explanation

The high-water mark principle assigns the system the highest impact rating among the three objectives. Because availability is rated high, the overall system category is high.

Question 10Risk Management Framework (RMF)

Why should a security control assessor be independent of the system development and operations team?

  1. To reduce the cost of the assessment
  2. To avoid producing documentation
  3. To shorten the authorization timeline
  4. To ensure impartial and objective findings Correct answer.

Explanation

Assessor independence protects the credibility of assessment results by preventing developers or operators from evaluating their own work. Independent assessors are more likely to report weaknesses objectively.

Question 11Risk Management Framework (RMF)

Adjusting control parameters and adding compensating safeguards to fit a system's specific environment is best described as what activity?

  1. Continuous monitoring
  2. Categorization
  3. Tailoring Correct answer.
  4. Inheritance

Explanation

Tailoring adapts a baseline to the system by adjusting parameters, applying compensating controls, and supplementing controls as needed. It ensures the baseline is appropriate for the system's mission and environment.

Question 12Risk Management Framework (RMF)

A system relies on physical access controls implemented by a shared data center. How should those controls be represented in the system security plan?

  1. They need not be documented
  2. As common controls with inheritance Correct answer.
  3. As hybrid controls only
  4. As system-specific controls

Explanation

Controls provided by another organizational entity and relied upon by the system are documented as common controls, with the system inheriting their protection. The system security plan should identify the provider and the inheritance relationship.

Question 13Risk Management Framework (RMF)

When an authorizing official grants an authorization to operate with conditions, what do those conditions typically require?

  1. Reassessment only after five years
  2. Removal of all items from the POA&M
  3. Specific actions to be completed within defined timeframes Correct answer.
  4. No further monitoring of the system

Explanation

A conditional authorization permits operation while requiring the system owner to complete specified risk-reduction actions by agreed dates. Progress is tracked through the POA&M and reviewed during continuous monitoring.

Question 14Risk Management Framework (RMF)

Ongoing authorization depends primarily on which activity?

  1. Complete reimplementation of all controls
  2. Continuous monitoring and near-real-time risk assessment Correct answer.
  3. A single annual full reassessment
  4. Quarterly re-categorization of the system

Explanation

Ongoing authorization uses continuous monitoring data to maintain an acceptable risk posture between formal reviews. Automated and manual assessments feed near-real-time risk decisions by the authorizing official.

Question 15Risk Management Framework (RMF)

Under the FedRAMP program, who performs the independent security assessment of a cloud service provider?

  1. The agency's contracting officer
  2. The Joint Authorization Board directly
  3. The cloud provider's internal audit team
  4. An accredited third-party assessment organization Correct answer.

Explanation

FedRAMP requires an independent assessment by an accredited third-party assessment organization to evaluate the cloud provider's controls. The resulting assessment package supports a JAB provisional authorization or an agency authorization.

Question 16Risk Management Framework (RMF)

Which set of methods is used to assess security controls?

  1. Examine, interview, and test Correct answer.
  2. Document review only
  3. Interviews only
  4. Automated scanning only

Explanation

Control assessment combines examining documents and artifacts, interviewing personnel, and testing mechanisms and behavior. Using multiple methods increases confidence that controls are implemented correctly and operating as intended.

Question 17Risk Management Framework (RMF)

What is the primary responsibility of the risk executive function in an organization?

  1. Approving individual user account requests
  2. Writing the system security plan
  3. Conducting daily vulnerability scans
  4. Establishing risk tolerance and integrating risk considerations across the organization Correct answer.

Explanation

The risk executive function sets the organization's risk appetite and ensures that risk management is coordinated across missions and systems. It provides context that authorizing officials use when making risk-based decisions.

Question 18Risk Management Framework (RMF)

What should the authorization boundary of a system include?

  1. Only the hardware assets
  2. All components and data flows that support the system's function Correct answer.
  3. Only the physical data center
  4. Only internet-facing components

Explanation

The authorization boundary encompasses the people, processes, technologies, and data flows that support the system's mission. Proper scoping ensures all relevant risks are assessed and authorized.

Question 19Risk Management Framework (RMF)

An interim authorization to test is typically used to do what?

  1. Allow limited operation for testing while risk is managed Correct answer.
  2. Grant a permanent authorization to operate
  3. Authorize full production operation
  4. Replace continuous monitoring

Explanation

An interim authorization to test permits limited system operation for evaluation purposes under specified safeguards. It is temporary and does not replace the final authorization decision.

Question 20Risk Management Framework (RMF)

In a plan of action and milestones, what do milestones represent?

  1. The selected control baseline
  2. Scheduled points for completing remediation actions Correct answer.
  3. The final authorization date
  4. The system's impact categorization

Explanation

Milestones are dated checkpoints for completing the corrective actions identified in the POA&M. They let oversight personnel track progress and verify that residual risk is being reduced as planned.

Question 21Risk Management Framework (RMF)

In the RMF context, what does reciprocity mean?

  1. An organization accepts another entity's assessment or authorization results to reduce duplicate effort Correct answer.
  2. An authorizing official may disregard all assessment findings
  3. Two organizations must always implement identical controls
  4. A system automatically receives an authorization to operate

Explanation

Reciprocity allows organizations to reuse credible assessment and authorization outputs from other entities, reducing redundant work. Acceptance still requires the receiving authorizing official to confirm the results apply to the system and its risk tolerance.

Question 22Risk Management Framework (RMF)

NIST SP 800-37 Revision 2 introduced which step at the beginning of the RMF?

  1. Prepare Correct answer.
  2. Monitor
  3. Authorize
  4. Assess

Explanation

Revision 2 added a prepare step to establish the context, priorities, and resources needed before categorization. It emphasizes organization-wide risk management and early planning for the rest of the lifecycle.

Question 23Risk Management Framework (RMF)

A continuous monitoring strategy should define which elements?

  1. Only annual control assessments
  2. Only the expiration date of the authorization
  3. Metrics, frequencies, and response actions for ongoing control effectiveness Correct answer.
  4. Only the frequency of vulnerability scanning

Explanation

An effective continuous monitoring strategy specifies what will be monitored, how often, which metrics indicate control health, and what actions follow when thresholds are breached. It ties monitoring data to ongoing risk decisions.

Question 24Risk Management Framework (RMF)

A cloud service provider holds a FedRAMP Joint Authorization Board provisional authorization. How can a federal agency use it?

  1. The agency can leverage it but still issues its own authorization to operate Correct answer.
  2. It permanently replaces the agency's own authorization process
  3. It is issued by the cloud service provider itself
  4. It is required for every federal system

Explanation

A JAB provisional authorization indicates that a cloud offering has met FedRAMP requirements, and agencies may leverage the package to reduce their own review effort. The agency's authorizing official still makes the final authorization decision for its own use of the service.

Question 25Risk Management Framework (RMF)

Which risk response option is chosen when an organization decides that the residual risk after applying controls is within its tolerance?

  1. Risk transfer
  2. Risk avoidance
  3. Risk acceptance Correct answer.
  4. Risk mitigation

Explanation

Risk acceptance means the organization acknowledges the remaining risk and chooses to proceed because it falls within the established tolerance. The decision should be documented and monitored as conditions change.

Question 26Risk Management Framework (RMF)

In the NIST Risk Management Framework, which step is performed immediately after the Select step?

  1. Assess
  2. Implement Correct answer.
  3. Authorize
  4. Categorize

Explanation

The RMF sequence is Categorize, Select, Implement, Assess, Authorize, and Monitor. The Implement step executes the selected controls and documents their implementation in the system security plan.

Question 27Risk Management Framework (RMF)

Which RMF document describes the system, its authorization boundary, and the security controls that are planned or already in place?

  1. Authorization decision document
  2. Security assessment report
  3. System security plan Correct answer.
  4. Plan of action and milestones

Explanation

The system security plan documents the system's boundary, environment of operation, and the controls that are planned or in place. It is the primary description used throughout assessment and authorization.

Question 28Risk Management Framework (RMF)

An organization wants to reuse a tailored set of controls for systems that share a common technology, such as a particular cloud deployment model, without re-tailoring the baseline each time. Which RMF construct best supports this?

  1. Plan of action and milestones
  2. Control overlay Correct answer.
  3. Continuous monitoring strategy
  4. Authorization boundary

Explanation

An overlay is a tailored set of controls and supplemental guidance built on a baseline for a specific community, technology, or environment. It is applied during the Select step and allows consistent reuse without rebuilding the baseline for each system.

Question 29Risk Management Framework (RMF)

Who is responsible for preparing the system security plan and assembling the authorization package for a system?

  1. Authorizing official
  2. System owner Correct answer.
  3. Security control assessor
  4. Risk executive

Explanation

The system owner is accountable for the system's day-to-day security and for developing the system security plan and authorization package. The authorizing official makes the authorization decision, the assessor tests controls, and the risk executive addresses organization-wide risk.

Question 30Risk Management Framework (RMF)

A system with a current authorization undergoes a modification that adds a new external network connection and changes its data flows. What is the most appropriate RMF action?

  1. Record the change in the POA&M and rely on the existing authorization.
  2. Terminate the authorization and restart the RMF at the Categorize step.
  3. Continue operating and address the change at the next scheduled annual review.
  4. Notify the AO and reassess affected controls before proceeding. Correct answer.

Explanation

A significant change, such as a new external connection or altered data flows, requires the organization to evaluate the change's security impact and update the authorization package. The authorizing official then determines whether additional assessment or reauthorization is needed before the change proceeds.

Question 31Categorization of Information Systems

Which standard establishes the security categorization framework for federal information and information systems?

  1. FIPS 199 Correct answer.
  2. NIST SP 800-37
  3. NIST SP 800-53
  4. FIPS 200

Explanation

FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, defines the three security objectives and the low, moderate, and high impact scale. The later standards consume that output rather than define it.

Question 32Categorization of Information Systems

A categorization recorded as SC{(confidentiality, high), (integrity, high), (availability, moderate)} expresses:

  1. A contingency priority
  2. A security category Correct answer.
  3. A control baseline
  4. An authorization boundary

Explanation

FIPS 199 expresses the security category of an information system as SC{confidentiality, integrity, availability}, with an impact value recorded for each objective. The notation is a categorization statement, not a statement about controls or scope.

Question 33Categorization of Information Systems

Under FIPS 199, a limited adverse effect on organizational operations, organizational assets, or individuals corresponds to which impact level?

  1. Low Correct answer.
  2. Critical
  3. Moderate
  4. High

Explanation

FIPS 199 maps limited adverse effect to low, serious adverse effect to moderate, and severe or catastrophic adverse effect to high. The assignment is made separately for each security objective.

Question 34Categorization of Information Systems

Which publication is the NIST guide for mapping types of information and information systems to security categories?

  1. NIST SP 800-137
  2. NIST SP 800-18
  3. NIST SP 800-60 Correct answer.
  4. NIST SP 800-30

Explanation

NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, supplies both the method and the catalog of information types. It is the companion guidance to FIPS 199.

Question 35Categorization of Information Systems

An information system processes three information types whose individual impact levels are low, moderate, and low. What is the security category of the information system?

  1. High
  2. Low
  3. The average of the three levels
  4. Moderate Correct answer.

Explanation

The system category is the high-water mark of the impact values of the information types it processes, stores, or transmits. One moderate information type therefore raises the whole system to moderate for that objective.

Question 36Categorization of Information Systems

FIPS 199 measures potential impact as the adverse effect on organizational operations, organizational assets, or which other entity?

  1. Individuals Correct answer.
  2. Regulators
  3. Contractors
  4. Suppliers

Explanation

The FIPS 199 impact definitions refer to adverse effects on organizational operations, organizational assets, or individuals, and the definition of each level describes the harm to each. Contractors, regulators, and suppliers are not the reference points used.

Question 37Categorization of Information Systems

Which security objective is concerned with ensuring timely and reliable access to and use of information?

  1. Confidentiality
  2. Integrity
  3. Authenticity
  4. Availability Correct answer.

Explanation

Availability means ensuring timely and reliable access to and use of information. Confidentiality and integrity address disclosure restrictions and improper modification, respectively.

Question 38Categorization of Information Systems

Which information type belongs to the management and support category of the NIST SP 800-60 catalog rather than to a mission-based category?

  1. Health care delivery
  2. Law enforcement and defense
  3. Homeland security
  4. Financial management Correct answer.

Explanation

SP 800-60 groups information types into mission-based categories and a management and support category. Financial management, human resources, and administrative management fall in the management and support group.

Question 39Categorization of Information Systems

Security categorization guidance for national security systems is provided primarily by which document?

  1. FIPS 200
  2. CNSSI 1253 Correct answer.
  3. NIST SP 800-60
  4. FIPS 199

Explanation

CNSSI 1253 provides Risk Management Framework guidance, including categorization and control selection, for national security systems. NIST publications such as SP 800-60 serve the broader federal civilian community.

Question 40Categorization of Information Systems

In the NIST Risk Management Framework, security categorization is performed in which step?

  1. Step 6 - Authorize the system
  2. Step 1 - Categorize Correct answer.
  3. Step 3 - Implement controls
  4. Step 2 - Select

Explanation

The Risk Management Framework begins with Step 1, Categorize, which establishes the impact levels that drive all later steps. Control selection, implementation, and authorization follow in sequence.

Question 41Categorization of Information Systems

Under NIST SP 800-37, who approves the security categorization of an information system?

  1. The information system owner
  2. The information system security officer
  3. The security control assessor
  4. The authorizing official Correct answer.

Explanation

The RMF requires the security categorization to be reviewed and approved before it is used to select controls, and this approval is an authorizing official responsibility. The system owner prepares and documents the categorization but does not approve it.

Question 42Categorization of Information Systems

The approved security categorization of an information system is documented in which document?

  1. The security assessment report
  2. The system security plan Correct answer.
  3. The plan of action and milestones
  4. The continuous monitoring strategy

Explanation

The security plan template in NIST SP 800-18 includes the system's security categorization as a required element, so the categorization is recorded in the system security plan. Other RMF artifacts capture assessment results, remediation, and monitoring.

Question 43Categorization of Information Systems

A system aggregates many information types that are each individually low impact, yet the system is categorized moderate. Which concept explains this?

  1. Control inheritance
  2. Least privilege
  3. Defense in depth
  4. Aggregation effects Correct answer.

Explanation

Aggregation recognizes that combining many individually low-impact information types can produce a collective impact greater than any single type. That collective impact can justify a higher system categorization.

Question 44Categorization of Information Systems

Unauthorized disclosure of a system's information would cause serious adverse effect on the organization's operations. Which confidentiality impact level applies?

  1. Low
  2. High
  3. Moderate Correct answer.
  4. Not determinable from the information given

Explanation

A serious adverse effect maps to moderate impact for the objective being assessed, here confidentiality. Impact is assigned per objective, so the confidentiality value is moderate regardless of the other objectives.

Question 45Categorization of Information Systems

Which impact level corresponds to a severe or catastrophic adverse effect?

  1. Severe
  2. Low
  3. Moderate
  4. High Correct answer.

Explanation

FIPS 199 reserves high for a severe or catastrophic adverse effect, such as major degradation of mission capability, significant harm to individuals, or loss of life. Low and moderate describe limited and serious effects.

Question 46Categorization of Information Systems

When determining which information types must be included in a system's categorization, the deciding factor is:

  1. The number of users with accounts on the system
  2. The system's authorization boundary Correct answer.
  3. The system's annual operating budget
  4. The physical location of the servers

Explanation

The authorization boundary defines what is inside the system, so only information types processed, stored, or transmitted within that boundary are included in the categorization. Personnel counts, location, and budget do not define scope.

Question 47Categorization of Information Systems

Which standard establishes minimum security requirements for federal information and information systems, driven by the FIPS 199 categorization?

  1. FIPS 200 Correct answer.
  2. FIPS 140-2
  3. FIPS 201
  4. FIPS 199

Explanation

FIPS 200 specifies minimum security requirements for federal information and information systems and scales them to the impact level assigned under FIPS 199. The other standards address categorization, cryptography, and identity verification.

Question 48Categorization of Information Systems

NIST SP 800-60 assigns provisional impact levels to information types. What does provisional mean in practice?

  1. They apply only to national security systems
  2. They are a starting point agencies may adjust Correct answer.
  3. NIST recalculates them automatically every year
  4. They are final and cannot be changed at all

Explanation

The impact levels in SP 800-60 are proposed values that an agency reviews against its own mission and risk tolerance and may adjust with justification. They are guidance inputs, not immutable mandates.

Question 49Categorization of Information Systems

A system owner adds a module that processes information with a high confidentiality impact. What is the most appropriate action?

  1. Apply compensating controls instead of re-categorizing
  2. Take no action until the next scheduled assessment
  3. Retire the module so the authorization does not change
  4. Re-categorize, reassess controls, and update the SSP Correct answer.

Explanation

A change that alters the impact level of information handled can change the system category, which in turn may change the required control baseline. The categorization, control selection, and security plan must be updated to reflect it.

Question 50Categorization of Information Systems

Which statement best describes how FIPS 199 and NIST SP 800-60 work together?

  1. FIPS 199 sets the standard; SP 800-60 gives application guidance Correct answer.
  2. SP 800-60 replaces FIPS 199 for civilian agencies
  3. FIPS 199 lists information types, SP 800-60 assigns certification levels
  4. SP 800-60 defines the impact levels used by FIPS 199

Explanation

FIPS 199 establishes the categorization standard and the impact scale, while SP 800-60 explains how to apply it and supplies a catalog of information types with provisional impact levels. The two documents are complementary, not substitutes.