Which of the following individuals is responsible for monitoring the information system
environment for factors that can negatively impact the security of the system and its
accreditation?

Which of the following is a temporary approval to operate based on an assessment of the
implementation status of the assigned IA Controls?

Fill in the blank with an appropriate word. ________ ensures that the information is not
disclosed to unauthorized persons or processes.

Nancy is the project manager of the NHH project. She and the project team have identified
a significant risk in the project during the qualitative risk analysis process. Bob is familiar
with the technology that the risk is affecting and proposes to Nancy a solution to the risk
event. Nancy tells Bob that she has noted his response, but the risk really needs to pass
through the quantitative risk analysis process before creating responses. Bob disagrees and
ensures Nancy that his response is most appropriate for the identified risk. Who is correct in
this scenario?

The Phase 4 of DITSCAP C&A is known as Post Accreditation. This phase starts after the
system has been accredited in Phase 3. What are the process activities of this phase? Each
correct answer represents a complete solution. Choose all that apply.

The only output of the perform qualitative risk analysis are risk register updates. When the
project manager updates the risk register he will need to include several pieces of
information including all of the following except for which one?

Billy is the project manager of the HAR Project and is in month six of the project. The project
is scheduled to last for 18 months. Management asks Billy how often the project team is

participating in risk reassessment in this project. What should Billy tell management if he’s
following the best practices for risk management?

Rob is the project manager of the IDLK Project for his company. This project has a budget
of $5,600,000 and is expected to last 18 months. Rob has learned that a new law may affect
how the project is allowed to proceed – even though the organization has already invested
over $750,000 in the project. What risk response is the most appropriate for this instance?

You are the project manager of the CUL project in your organization. You and the project
team are assessing the risk events and creating a probability and impact matrix for the
identified risks. Which one of the following statements best describes the requirements for
the data type used in qualitative risk analysis?

You are the project manager of a large construction project. Part of the project involves the
wiring of the electricity in the building your project is creating. You and the project team
determine the electrical work is too dangerous to perform yourself so you hire an electrician
to perform the work for the project. This is an example of what type of risk response?