You are the project manager of the CUL project in your organization. You and the project
team are assessing the risk events and creating a probability and impact matrix for the
identified risks. Which one of the following statements best describes the requirements for
the data type used in qualitative risk analysis?

You are the project manager of a large construction project. Part of the project involves the
wiring of the electricity in the building your project is creating. You and the project team
determine the electrical work is too dangerous to perform yourself so you hire an electrician
to perform the work for the project. This is an example of what type of risk response?

You are the project manager of the GHY project for your organization. You are about to start
the qualitative risk analysis process for the project and you need to determine the roles and
responsibilities for conducting risk management. Where can you find this information?

The Phase 1 of DITSCAP C&A is known as Definition Phase. The goal of this phase is to
define the C&A level of effort, identify the main C&A roles and responsibilities, and create
an agreement on the method for implementing the security requirements. What are the
process activities of this phase? Each correct answer represents a complete solution.
Choose all that apply.

You are the project manager of the GGH Project in your company. Your company is
structured as a functional organization and you report to the functional manager that you are
ready to move onto the quantitative risk analysis process. What things will you need as
inputs for the quantitative risk analysis of the project in this scenario?

In which of the following DIACAP phases is residual risk analyzed?

You are responsible for network and information security at a metropolitan police station.
The most important concern is that unauthorized parties are not able to access data. What
is this called?

Mark is the project manager of the BFL project for his organization. He and the project team
are creating a probability and impact matrix using RAG rating. There is some confusion and
disagreement among the project team as to how a certain risk is important and priority for
attention should be managed. Where can Mark determine the priority of a risk given its
probability and impact?

Which of the following statements are true about security risks? Each correct answer
represents a complete solution. Choose three.

FITSAF stands for Federal Information Technology Security Assessment Framework. It is a
methodology for assessing the security of information systems. Which of the following
FITSAF levels shows that the procedures and controls are tested and reviewed?