Nancy is the project manager of the NHH project. She and the project team have identified a significant risk in the project during the qualitative risk analysis process. Bob is familiar with the technology that the risk is affecting and proposes to Nancy a solution to the risk event. Nancy tells Bob that she has noted his response, but the risk really needs to pass through the quantitative risk analysis process before creating responses. Bob disagrees and ensures Nancy that his response is most appropriate for the identified risk. Who is correct in this scenario?

A. Bob is correct. Bob is familiar with the technology and the risk event so his response should be implemented.

B. Nancy is correct. Because Nancy is the project manager she can determine the correct procedures for risk analysis and risk responses. In addition, she has noted the risk response that Bob recommends.

C. Nancy is correct. All risks of significant probability and impact should pass the quantitative risk analysis process before risk responses are created.

D. Bob is correct. Not all riskevents have to pass the quantitative risk analysis process to develop effective risk responses.

What are the subordinate tasks of the Implement and Validate Assigned IA Control phase in the DIACAP

process?

Each correct answer represents a complete solution. Choose all that apply.

A. Conduct activities related to the disposition of the system data and objects.

B. Execute and update IA implementation plan.

C. Conduct validation activities.

D. Combine validation results in DIACAP scorecard.

Which of the following requires all general support systems and major applications to be fully certified and accredited before these systems and applications are put into production? Each correct answer represents a part of the solution. Choose all that apply.

A. NIST

B. FIPS

C. Office of Management and Budget (OMB)

D. FISMA

You are the project manager for your organization. You are preparing for the quantitative risk analysis. Mark, a project team member, wants to know why you need to do quantitative risk analysis when you just completed qualitative risk analysis. Which one of the following statements best defines what quantitative risk analysis is?

A. Quantitative risk analysis is the planning and quantification of risk responses based on probability and impact of each risk event.

B. Quantitative risk analysis is the process of prioritizing risks for further analysis or action by assessing and combining their probability of occurrence and impact.

C. Quantitative risk analysis is the review of the risk events with the high probability and the highest impact on the project objectives.

D. Quantitative risk analysis is the process of numerically analyzing the effect of identified risks on overall project objectives.

An authentication method uses smart cards as well as usernames and passwords for authentication. Which of the following authentication methods is being referred to?

A. Anonymous

B. Multi-factor

C. Biometrics

D. Mutual