Which of the following documents were developed by NIST for conducting Certification &
Accreditation (C&A)? Each correct answer represents a complete solution. Choose all that
apply.

John is the project manager of the NHQ Project for his company. His project has 75
stakeholders, some of which are external to the organization. John needs to make certain
that he communicates about risk in the most appropriate method for the external
stakeholders. Which project management plan will be the best guide for John to
communicate to the external stakeholders?

Which of the following individuals informs all C&A participants about life cycle actions,
security requirements, and documented user needs?

Gary is the project manager for his project. He and the project team have completed the
qualitative risk analysis process and are about to enter the quantitative risk analysis process
when Mary, the project sponsor, wants to know what quantitative risk analysis will review.

Which of the following statements best defines what quantitative risk analysis will review?

Which of the following is NOT an objective of the security program?

Which of the following is NOT a responsibility of a data owner?

Walter is the project manager of a large construction project. He’ll be working with several
vendors on the project. Vendors will be providing materials and labor for several parts of the
project. Some of the works in the project are very dangerous so Walter has implemented
safety requirements for all of the vendors and his own project team. Stakeholders for the
project have added new requirements, which have caused new risks in the project. A
vendor has identified a new risk that could affect the project if it comes into fruition. Walter
agrees with the vendor and has updated the risk register and created potential risk
responses to mitigate the risk. What should Walter also update in this scenario considering
the risk event?

Harry is the project manager of the MMQ Construction Project. In this project Harry has
identified a supplier who can create stained glass windows for 1,000 window units in the
construction project. The supplier is an artist who works by himself, but creates windows for
several companies throughout the United States. Management reviews the proposal to use
this supplier and while they agree that the supplier is talented, they do not think the artist
can fulfill the 1,000 window units in time for the project’s deadline. Management asked

Harry to find a supplier who will guarantee the completion of the windows by the needed
date in the schedule. What risk response has management asked Harry to implement?

Which of the following methods of authentication uses finger prints to identify users?

In which of the following Risk Management Framework (RMF) phases is strategic risk
assessment planning performed?