ISC2 CAP Exam - Topic 6 Question 32 Discussion

Actual exam question for ISC2's CAP exam

Question #: 32
Topic #: 6

[All CAP Questions]

Which of the following statements correctly describes DIACAP residual risk?

AIt is the remaining risk to the information system after risk palliation has occurred.

BIt is a process of security authorization.

CIt is the technical implementation of the security design.

DIt is used to validate the information system.

Show Suggested Answer

Suggested Answer: A

by Ettie at May 05, 2022, 12:54 PM

Limited Time Offer

25%

Off

Get Premium CAP Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Odette

4 months ago

B is more about the process, not residual risk.

upvoted 0 times

...

Dawne

4 months ago

Wait, is it really just A? Seems too simple.

upvoted 0 times

...

Teddy

4 months ago

Definitely A, that's the standard definition!

upvoted 0 times

...

Vicente

4 months ago

I don't think A is right, sounds too vague.

upvoted 0 times

...

Sabra

5 months ago

A is correct, it's the remaining risk after mitigation.

upvoted 0 times

...

Carlene

5 months ago

I thought residual risk was more about the validation process, so maybe D? But now I’m questioning if that’s right.

upvoted 0 times

...

Glennis

5 months ago

I practiced a question similar to this, and I feel like A makes the most sense, but I’m a bit confused about the definitions of the other options.

upvoted 0 times

...

Corinne

5 months ago

I’m not entirely sure, but I remember something about risk being a part of the authorization process. Could it be B?

upvoted 0 times

...

Vincent

5 months ago

I think residual risk is what’s left after we’ve done everything we can to mitigate it, so I’m leaning towards A.

upvoted 0 times

...

Kirk

5 months ago

This seems pretty straightforward - the question is asking about HIPAA requirements for claims submission, so I think the answer is likely related to standardized electronic formats.

upvoted 0 times

...

Blair

5 months ago

This question seems straightforward. I think the key is to focus on the difference between inductive and deductive logic, and how they can lead to different types of fallacies.

upvoted 0 times

...

Nguyet

5 months ago

I'm a bit unsure on this one. Is a business impact analysis the right approach here, or would a gap analysis be more appropriate to identify any issues with the IT infrastructure integration?

upvoted 0 times

...