ISSEP Free Practice Test

The Phase 4 of DITSCAP C&A is known as Post Accreditation. This phase starts after the system has been accredited in Phase 3. What are the process activities of this phase Each correct answer represents a complete solution. Choose all that apply.

1. A. Security operations
2. B. Continue to review and refine the SSAA
3. C. Change management
4. D. Compliance validation
5. E. System operations
6. F. Maintenance of the SSAA

Correct Answer: ACDEF

Which of the following DoD policies establishes IA controls for information systems according to the Mission Assurance Categories (MAC) and confidentiality levels

1. A. DoD 8500.1 Information Assurance (IA)
2. B. DoD 8500.2 Information Assurance Implementation
3. C. DoDI 5200.40
4. D. DoD 8510.1-M DITSCAP

Correct Answer: B

Diane is the project manager of the HGF Project. A risk that has been identified and analyzed in the project planning processes is now coming into fruition. What individual should respond to the risk with the preplanned risk response

1. A. Project sponsor
2. B. Risk owner
3. C. Diane
4. D. Subject matter expert

Correct Answer: B

The risk transference is referred to the transfer of risks to a third party, usually for a fee, it creates a contractual-relationship for the third party to manage the risk on behalf of the performing organization. Which one of the following is NOT an example of the transference risk response

1. A. Warranties
2. B. Performance bonds
3. C. Use of insurance
4. D. Life cycle costing

Correct Answer: D

Certification and Accreditation (C&A or CnA) is a process for implementing information
security. It is a systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation. Which of the following statements are true about Certification and Accreditation Each correct answer represents a complete solution. Choose two.

1. A. Accreditation is a comprehensive assessment of the management, operational, and technical security controls in an information system.
2. B. Accreditation is the official management decision given by a senior agency official to authorize operation of an information system.
3. C. Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system.
4. D. Certification is the official management decision given by a senior agency official to authorize operation of an information system.

Correct Answer: BC