topic Re: Passed the CAP Exam This Morning: My Thoughts in Exam Preparation

Passed the CAP Exam This Morning: My Thoughts

StevenJ6052 — Mon, 09 Oct 2023 08:43:01 GMT

To provide some background, I have been an IT program manager for the fast fourteen years. Having been certified as an MCSE (NT 4.0 and Win2K) and CCNA earlier in my career I let both certs lapse as they were no longer directly relevant for my career. I also picked up the PMP several years ago which I continue to maintain.

During the past couple of years I have developed a strong affinity for Risk Management especially with regards to the IT security program I manage. Having passed the CISSP in early 2017, I decided the the CAP with its focus on the NIST Risk Management Framework would be a good next step.

Unlike the CISSP (or any other exam I have taken) there is very little in the way of published study guides and virtually no practice tests banks that I found useful. I rented the "Official (ISC)2 Guide to the CAP CBK" 2nd edition and read it in its entirety, but honestly found the freely available NIST 800 series (800-39, 800-37, 800-30, 800-53 & 53A etc..) as well as the FIPS 199 & 200 to be the best source of information. In addition, I found a few very good lectures on the NIST RMF provided by NIST on YouTube.

As for the exam, it consists of 125 questions and you are permitted three hours to finish. A sage piece of advice that I was given for the CISSP, "you need to think your way through the test" is equally applicable to the CAP. All 125 questions for multiple choice with only one answer. That said many were of the "best our of four poor choices" variety. Like the CISSP this is very much a management level exam, albeit with a much narrower focus. Unlike the CISSP there were no false "technical" answers to tempt you.

The best advise I can give anybody looking to take on the CAP is be very familiar with the NIST Risk Management Framework and how it map to the System Development Lifecycle. Roles & Responsibilities as well as vocabulary are critically important as well. Always remember that "plans" happen before "reports" and it is "Reports" that contain information on your implementation. When given a choice between multiple more or less correct answers, choose the one that is the most "all encompassing". For example if you are having trouble deciding between "Threat Sources" and "Vulnerabilities", choose "Risk Factors" as threat sources and vulnerabilities are both risk factors. When in doubt about who the responsibility belongs to, it is probably the "System Owner"

This post probably adds another 25% to the total amount of direct feedback I was able to find online about this exam, but I must say of all the exams I have taken, this one has the most direct applicability to my daily on-the-job responsibilities.

Should you decide to tackle the CAP, Good Luck, hope this information is helpful!

Re: Passed the CAP Exam This Morning: My Thoughts

Stpn2me — Sun, 25 Mar 2018 14:37:51 GMT

Steve,

I would say your post is spot on. I passed the CAP late last year and my experience was about the same with yours. I was able to take the ISC2 bootcamp. The mappings with the SDLC cannot be over-emphasized. That simple piece was what took me over the top, I believe.

Good job on passing the exam and good luck..

Pat

Re: Passed the CAP Exam This Morning: My Thoughts

StevenJ6052 — Sun, 25 Mar 2018 21:13:51 GMT

Thanks for the kind words,

Re: Passed the CAP Exam This Morning: My Thoughts

Barb — Mon, 26 Mar 2018 13:23:28 GMT

Good morning, Steven - Did you find any practice exams?

Re: Passed the CAP Exam This Morning: My Thoughts

StevenJ6052 — Mon, 26 Mar 2018 14:30:16 GMT

Barb,

That is a great question and unfortunately I must confess that was unable to find any unable to find any practice tests that were of value. In fact many of the practice tests were soo bad, that I was afraid to continue using them for fear they would cloud my judgement on the actual exam.

The best I was able to find were of limited value because the subject matter had little to do with the CAP exam, lots of questions on the PMBOK (Project Management Body of Knowledge) and other topics which are not relevant to the CAP which in mu experience was purely on the NIST documents regarding the RMF and SDLC.

As uncomfortable as it is, this is a test that you need to think your way through. Making and reviewing my own flash cards from the NIST documentation was the biggest aid in my passing the exam.

Good Luck

Re: Passed the CAP Exam This Morning: My Thoughts

Barb — Mon, 26 Mar 2018 14:32:36 GMT

Thank you, Steven, and congratulations!

Re: Passed the CAP Exam This Morning: My Thoughts

bsilbiger — Wed, 28 Mar 2018 14:45:28 GMT

Steve,

First congratulations on passing the test. I am looking at doing a Risk certification and wondered why you chose the CAP over some of the other risk certs out there? I am CISSP and CCSP certified so I obviously believe in the ISC2 eco-system, but to be honest when you look at risk positions these days, CAP certification is not usually listed. Now I am not looking to change jobs but when ever I decide to under take a certification, I do consider how marketable the certification would be.

Barry

Re: Passed the CAP Exam This Morning: My Thoughts

Stpn2me — Wed, 28 Mar 2018 17:11:41 GMT

The CAP is a part of the IAM level III requirement of DOD. I believe in ISC2 as well. Both of these reasons is why I took the CAP.

Re: Passed the CAP Exam This Morning: My Thoughts

StevenJ6052 — Wed, 28 Mar 2018 23:39:06 GMT

Barry,

Thank for the kind words. The CAP is a highly targeted certification for those working with the NIST Risk Management Framework (RMF). The RMF is mandated for Federal information systems under the Federal Information Systems Management Act (FISMA). Unless you work with a Federal agency, or a contractor supporting the Federal government, the CAP may have limited appeal for you.

I have been looking into the CRISC from ISACA as well as the OpenFAIR certification. RiskLens has a discount available for training in the FAIR (Factor Analysis for Information Risk) including the exam fees. Although the CRSC is better known across the industry, the FAIR taxonomy is an excellent methodology for quantitative risk analysis.

I would be interested to know what other Risk certs you have been considering!

Good Luck

Re: Passed the CAP Exam This Morning: My Thoughts

bsilbiger — Thu, 29 Mar 2018 15:46:02 GMT

Steve,

I was specifically looking at the CRISC which is why I posed the question after I saw your post about the CAP certification. Since I am not a federal employee and don't work under the NIST RMF I will probably do the CRISC, but will decide when I get a chance to actually concentrate on it.

Re: Passed the CAP Exam This Morning: My Thoughts

doffejr — Mon, 07 May 2018 00:34:12 GMT

Extremely insightful and helpful! Congrats on passing, and thanks for sharing.

Re: Passed the CAP Exam This Morning: My Thoughts

sophia_cart — Sat, 23 Jun 2018 08:28:19 GMT

very helpful! congratulations on passing, and thanks for sharing.

Re: Passed the CAP Exam This Morning: My Thoughts

Valentino76 — Mon, 30 Jul 2018 02:11:49 GMT

Hey good day. As a beginner who want to take CAP exam with no familiarity, what additional information can you give. Thanks.

Re: Passed the CAP Exam This Morning: My Thoughts

Stpn2me — Mon, 30 Jul 2018 03:42:55 GMT

Make sure you mirror the SDLC with the 7 stages of the CAP. If you do that and you know which stage corresponds with the other, you will have no problem.

Re: Passed the CAP Exam This Morning: My Thoughts

StevenJ6052 — Mon, 30 Jul 2018 16:32:25 GMT

Valentino76,

Thank you for the kind words.

As with all (ISC)2 there are strict experience requirements in addition to passing the test to become certified. As stated earlier in this thread, a thorough knowledge of the NIST documents detailing the RMS and SDLC are essential. especially knowing the various roles and responsibilities and the ability to map the phased of the SDLC to the RMF.

Your statement that you have "no familiarity" would make any (ISC)2 exam more challenging, this is especially so with the CAP due to the low availability of study aids other than the NIST documents. Try and focus on the "process" of system authorization and try and understand not just the roles and responsibilities, but the relationships as well.

Good Luck and please post your experience to share with others!

Re: Passed the CAP Exam This Morning: My Thoughts

Valentino76 — Mon, 30 Jul 2018 16:53:13 GMT

Thank you sir.

Re: Passed the CAP Exam This Morning: My Thoughts

billclancy — Mon, 30 Jul 2018 17:33:44 GMT

@bsilbiger wrote:
Steve,
First congratulations on passing the test. I am looking at doing a Risk certification and wondered why you chose the CAP over some of the other risk certs out there? I am CISSP and CCSP certified so I obviously believe in the ISC2 eco-system, but to be honest when you look at risk positions these days, CAP certification is not usually listed. Now I am not looking to change jobs but when ever I decide to under take a certification, I do consider how marketable the certification would be.

Barry

Barry,

I chose the CRISC from ISACA over the CAP, as it seemed to have good acceptance in industry, and I like the way ISACA assists in exam preparation. ISACA has an online database of questions, that is a great way to prep for the exam.

https://www.isaca.org/bookstore/Pages/Product-Detail.aspx?Product_code=XMXCR14-12M

Granted I took the exam in 2014, and I'm sure it has changed a bit, but the database of questions is pretty slick. You rent it for 12 months. When you go in the first time, you put in a potential test date (I think I studied for 6 months), and take your first quiz. It grades you, and estimates how much time you need to spend daily to successfully prep for the exam. Mine told me 45 min. Each morning I'd read various books and documents, and each evening I'd use the test database for 45 min. It grades you, and tracks your progress, by domain, so you can see how you're doing from a high level, and a bit further in the weeds. Later on you can choose new questions or questions often gotten wrong to focus on soft spots.

If you're a member of ISACA it's only $185, a deal in my estimation.

A caution though...I dislike the ISACA books on their certifications, They are overly organized if there is such a thing, and just don't talk to me.

I wish ISC2 had a similar product for their tests.

Re: Passed the CAP Exam This Morning: My Thoughts

BrandonAnt — Thu, 16 Aug 2018 01:59:42 GMT

Hello, is DIACAP AND DITSCAP included on the exam? many practice exams include these old processes. Also, were there any questions that required you to choose multiple answers.

Congrats on passing

Re: Passed the CAP Exam This Morning: My Thoughts

CraginS — Thu, 16 Aug 2018 18:17:24 GMT

@BrandonAnt wrote:
Hello, is DIACAP AND DITSCAP included on the exam? many practice exams include these old processes. Also, were there any questions that required you to choose multiple answers.

Congrats on passing

If DITSCAP and DIACAP are on the exam, then the exam is woefully out of date. Both of those programs are defunct U.S. Department of Defense (DoD) processes for certification and accreditation (C&A) of DoD information systems. In fact, DIACAP replaced DITSCAP many years ago, and the Risk Management Framework (RMF) replaced DIACAP four years ago, doing away wit C&A and moving to assessment and authorization (A&A).

Re: Passed the CAP Exam This Morning: My Thoughts

BrandonAnt — Fri, 17 Aug 2018 00:19:56 GMT

Thank you for your answer, that's what I was thinking! Do you know if the CAP includes questions that require you to choose 2 or more answers?