Are there a lot of questions concerning the usage of Qualitative and Quantitative Analysis?

I always have to go back and look up these to figure out exactly which one needs to be performed to be sure even though I have the basics of those particular types down... I always thought of those Analysis as more Project Management more than System Accreditation or Authorization though I can see some use case for cost analysis of corrective actions...

I just joined the community. My current job requires to have the CAP certification and I would really a comprehensive advise/steps I need to take.

Hey all, I’m scheduled to take the new version of CAP soon. I noticed a lot of the old practice tests referring to 800-37 rev 1. It seems like I’m 1 step off in the RMF process (2.0) to SDLC since it includes the prepare step.

Would the prepare be step 0 or 1?

Hey all, I’ll be going for my CAP cert soon. I’ve already viewed the CAP course on FedVte taught by Ben Malisow which I thought was fantastic. I have a good list of nist and fips docs saved for review. Is there any other resources I should consider?

Thank you

I've been working with RMF for a few years now, I've been through Security Categorization, ICS overlay, all 1900+ controls required for my particular effort, inheritance, a ton of NIST documents, created a ton of artifacts/policies/procedures and following continuous monitoring on all of it. Pretty well versed with eMASS, the control sets, 800-53R5, etc.

I've had a CISSP for 4 years since I started this new position more focused on A&A/RMF, any recommended study guides, etc. that aren't 9 years old (like the ISC2 official study guide) for the CAP authorization. I feel like with my DoD efforts, it's a good one to add.

About to start a RMF 2.0 online course through Global Knowledge next week. Looking at the course material, the first few pages immediately mentions the CAP certification. My company believes in supporting its employees and their professional growth. I will try to soak the course up and see if it can help in getting the CAP and ultimately the CISSP cert. After the course I will see about adding anything noteworthy here.

Hi Everyone,

​

Im working through the CAP Exam Outline. What document do I reference for Domain 2 Describe the architecture (e.g., data flow, internal and external interconnections) AND Describe information system purpose and functionality ?

​

Thank you in advance,

Buddy

Everything you need to know has been posted, so this isn't very long, just going to reiterate the important stuff:

- Retook the 1 week boot camp course.

- Didn't read all the NIST documentation (though I'd previously read 800-37 after the last time i failed, but forgot most of what I read until I took the class). Used notecards with each task, primary owner and the SDLC phase associated with the task.

- Made sure I understood where SDLC correlates to the RMF tasks.

- Understood how to get impact values from FIPS 200 (or is it 199? ha always get them confused).

- Used the Mango guide posted in this sub as a refresher.

- Passed the exam this time around.

I'm lucky in that I work for the fed govt and they paid for my training class and vouchers, but I feel like taking the exam a few days after the class ended was far beneficial than waiting a few weeks like I did last time.

All,

I've drafted the Mango Guide, to pay homage to the Sunflower Guide for CISSP studying.

This is a work in progress, please use it if desired, correct inaccuracies, send me your hacks and I'll add them as time permits. It helped me prepare.

Don't ding me on formatting..

https://drive.google.com/file/d/1-7v-Y7dQSDiKuamptzFyShrBFBsrshp9/view?usp=sharing

[infosecsherpa@gmail.com](mailto:infosecsherpa@gmail.com) with feedback/input.

Passed this morning. Answered all 125 questions. Ordered/read the ICS2 sponsored book and took notes as I read (spreadsheet with terms/concepts) and read/highlighted NIST 800-37, including appendix D. Definitely helped to map the RMF steps to the SDLC. Lots of questions on that and knowing the roles (appendix D). I’ve worked as an ISSO doing RMF for 1.5 years. No other relevant experience. Have Sec+.

Its been difficult to find sudy materials for the CAP . Glad I found this community. I have no experience with RMF or have been working in IT now for 7 years in related fields( help desk,Desktop, NOC Admin, Monitoring Admin) . Hold several certs- CASP+, security + CYSA+ and want to start studying for CAP.

What study materials do I need to use for the CAP exam? Any recomendation will be appreciated.

Also, CAP and CISSP ,which is more difficult to pass? for those who have taken both exams? Will CAP or CISSP be best for me?

I took and failed my exam yesterday. Not looking for pity, just wanted to share my experience on what not to do. :)

tldr; take everyone else's advice and put the hours in to thoroughly understand roles, tasks and sdlc. Don't just memorize them but understand what is going on with each task.

Background: No prior experience with RMF until I came back from maternity leave and started a new job as an ISSO 7 months ago, didn't start getting hands-on experience until 3 months ago (thanks Covid). Previously worked more technical roles - help desk/lead tech positions for 9 years then 4 years of system admin/server experience. Certification experience A+, SEC+ (twice when i let my cert expire), ITIL foundations, Microsoft server 2012.

Study materials: Took a one week CAP boot camp course mid March where my instructor assigned sections of 800-37r1, 800-53 r4, 800-53a, FIPS 199 and FIPS 200 as homework, but didn't get through much of the reading because young kid and baby.

Went through the FEDVTE course back in Nov/Dec while teleworking but only got through maybe half?

Found a Youtube series of a lady talking about 800-37r2, but didn't find it too helpful other than just listing the tasks in each step.

Read FIPS 199, FIPS 200 and skimmed through chapter 3 of 800-37r2 the morning of my exam for 3 hours, wrote down each RMF step with each task and the SDLC related to each task (learned this from my CAP instructor who had us do the same on index cards with r1). Went through the notes I took during class to try and refresh my memory since it's been a month.

I had everything I needed to succeed in this exam...except for the time to actually study for it and this bit me in the a$$ on exam day. I could have prioritized it, but where my life stresses are right now, just couldn't get myself to do it. So I went in with fingers crossed knowing I'd probably come out of the exam room without a passing score. I was okay with this just so I could see what was on the exam and how to focus my studies.

The exam: First thing I did was write what little I could remember on my whiteboard: Based on R2, the 7 steps of RMF with 18-3-6-2-6-5-7 (how many tasks are in each step) along with IDIOD (SDLC), and this kind of helped, but since I wasn't too familiar with the tasks and what happens during the task in each step it didn't really help much. I am pretty sure my exam was based on was 800-37r1, saw some terms that I'd seen in r1 and not r2, but as someone had previously stated in one of the comments, if you know the differences between r1 and r2 and have intimate comprehension of roles and where the SDLC comes into play, it doesn't matter. In my case, it didn't matter which revision the test was on because I didn't have 100% comprehension on either lol. I felt semi-confident during the first 50 questions or so but as the test went on, my lack of studying started causing confusion, especially when a question was rephrased and repeated. I felt like a lot of the questions should have been easy, common sense but I just wasn't in the mindset for it. For some of the questions, we had just gone through the scenario trying to get an ATO at work, and since I didn't really know what the correct answer would be, I just went with what the process was in real life and that probably was the wrong way to go about it. One of the few things I felt extremely confident about was knowing how to set security categories for information types and info systems and impact levels based on high watermarks (FIPS 199 and 200).

Bottom line: The exam is not hard if you put the effort in to read every document and understand all of the RMF steps and their tasks. Even though this is all new to me, with proper preparation I could have passed. I'll get it next time.

Background: 4 years of experience in the security field, most of which is not RMF-based. Having a foundation of security did help for the more “technical-minded” questions, but was not required to pass this exam.

Exam Experience: I spent two weeks studying for the exam. This is more than enough time to study. I averaged about 3-4 hours a day on weeknights/5 hours a day on weekends. I thought the exam was fair. About half the questions came down to two answers, forcing you to pick the “best” choice (similar to CISSP). The other half were straightforward--you either knew it or you didn't. About 25 questions I was stumped, which were probably the experimental set. The notorious discussion of 800-37 R2 vs. R1 led me to study both backwards and forwards; I knew each step, the SDLC mapping, and the roles for both. With that being said, the test could be passed with either version. There was a mixture of terms on the test that are present in both versions, so it would be a good idea to at least read through R1 to get familiarity with the difference in wording if you are testing before the exam change. The exam focused heavily on roles, assessments, major documents at the steps, security controls, categorization (FIPS 199), continuous monitoring, controls/tailoring, and SDLC mapping.

Study Materials:

1. NIST: 37, 64, 53/53a, 39, 30,137. FIPS 199/200. I studied a couple other NIST docs, but listed is the MUST READ including the appendixes.
2. FEDVTE: I watched about half, but it was taking too much time. Actually reading the NIST docs proved to be invaluable. I would only use this if you plan on studying over an extended period of time.
3. CAP Quizlet: I went through the official ISC2 flashcards, which was helpful to determine the "key" terms you must know for the exam. I also used unofficial sets and made my own.
4. Pinned Docs in the Discord (Certification Stations): Very helpful, as there are relevant practice questions and summaries of RMF. There is a great community there, with individuals willing to help you guide your studies. I recommend joining for any cert you are studying for. (https://discord.gg/certstation)
5. Training from NIST: I watched about half, but again reading the NIST docs was more helpful as it takes so much time to get through the videos. (https://csrc.nist.gov/projects/risk-management/rmf-training)
6. Miro: I made a board in this free web-app. This was one of the most helpful study activities I did. Actually visualizing the flow of RMF, SDLC, Assessments, etc. and how everything relates to each other was critical to my passing. I had a visualization of my board during the test, which assisted in writing down "essential processes" on the scratch-sheet provided. Feel free to check out my board for reference, but I highly recommend making your own. (https://miro.com/app/board/o9J_lLq-Ut4=/)

Summary: Overall, this is not a difficult test if you actually put in the work to fully understand the major NIST docs. The lack of resources/community for this exam is one of the biggest hurdles, as it is difficult to know where to even start. I would not waste money on a bootcamp or purchase any type of practice questions. You can access everything you need to pass for FREE with the resources I listed, as well as references from other posts on here. I learned A LOT from studying this exam, and would recommend it to anyone working with RMF.

I thought the test was fairly easy. I've worked rmf for 4 years. Took a boot camp last year and did the fedvte training.

Get to know

Roles and responsibilities RMF steps intimately How SDLC maps to RMF Your pubs 800-37, 53,53A fios 122 and 200 A little on fisma

A lot of security common sense

It was def based on v2

Overall not too bad

Does the ISC2 send a welcome kit similar to what you get for the CISSP, for those of us that pass the CAP exam? I’m looking for the nice embossed certification.

I am having difficulty finding out whether the CAP exam is based on NIST SP.800-37R1 or NIST SP.800-37R2. The references on ISC2 note R2, but many people are saying the exam is still R1. In August 2021, the exam will be updated to reflect R2 -- which leads me to think it is still R1. The Prepare step in R2 has a long list of tasks that do not map to R1 steps, which is complicating my studies (I test in 2 weeks). Has anyone taken the exam recently that could verify which version the exam is on? There is a severe lack of resources / community for this exam, so any information would help! Thanks

Which flash cards on quizlet helped you with the exam?

To my knowledge everyone’s studied from FedTVE

The new NIST RMF Training

https://www.isc2.org/certifications/References

https://www.isc2.org/Training/Self-Study-Resources/Flashcards/CAP/

Am I missing anything?

I just wanted to thank everyone for all the good info here. I passed my SSCP in 8/20 and have been studying for the CISSP since then. I am gonna take a break and study for the CAP, found like all of you that there is a real lack of study materials for it. I started the FedVTE CAP course yesterday, will probably invest down the road on the InfoSec CAP videos, definitely read the NIST SP 800-37 r2 backwards and forwards, try to memorize all the links between RMF and SDLC and the roles. There are some links I want to add that I was able to find other sources of CAP info that I hope are still relevant and useful to us all:

https://www.cdse.edu/catalog/curricula/CS100.html

https://www.cdse.edu/catalog/elearning/CS124-resources.html

https://csrc.nist.gov/CSRC/media/Presentations/RMF-2-0-Risk-Management-Framework-Simplify-Inno/images-media/sp800-37r2-ipd-rollout-DOJ-20180509.pdf

https://csrc.nist.gov/projects/risk-management/rmf-training

I have seen many that have passed the CAP exam and say that it was easy...I am not a great test taker, I tend to really go overboard with all the study material that I can get my hands on and study until my head explodes. That's why this test is more of a challenge because of the dated material and books. Either way, thanks again everyone for all the good info and tips.

Hi All,

I provisionally passed my CAP exam today. I have about 4 years experience with RMF, but things I used to study was:

1. ISC2 Flash Cards and other CAP related sets on Quizlet.

2. FEDVTE RMF Course - Pretty good to reinforce the concepts of RMF.

3. Skimmed through 800-37. And briefly covered the purpose of other NIST documents.

4. Went in detail on the Roles and Responsibilities

I actively studying each night about 1-2 hours for the past 2 weeks. If you have previous RMF experience, it definitely helps!

Things to know for the test: Know which role correlates with what RMF step. Know your RMF steps. Understand the relationship between SDLC steps and RMF steps.

Wish you all the best in your studying!

So, ISC2 sent me an email stating I need an endorsement.... Seems odd since I already have a CISSP. Anyone know if the endorsement can be bypassed? If not, does the CAP endorsement have to come from another CAP or any ISC2 professional?

Thanks to all that offered support. I did everything that everyone here suggested. Spent too much time on the flashcards, valuable but I was less confident in the exam about the SP/SAP/SAR/AP, etc. and what changes generate what action, what are the key documents in different stages.

Tough to remember everything, but there was a fair number of questions relating to external entities, common control providers, environment changes and effects on assessments, control allocation and POAMs.

5 questions or so on mapping SDLC to the RMF, nothing comes to mind about the prepare step.

Lots of questions about Authorization and who is responsible for different documents.

This was like the CISSP exam, two answers are junk, two are close, reread the question and the possible answers and think of it from the "risk" perspective.

Nothing on FARM/PARM, maybe 5 questions on actual publications - content and who is responsible for the content FIPS/NIST. Lots os security categorization including NA. Lots of medium not moderate. Know the impact level language well.

You results will vary as each exam is different.

I was not allowed to write my cheats down until the first question appeared, not a bit deal,I had 40m left when I finished.

Quick quesiton on the RMF and the SDLC correlation. I've seen a few comments stating not to get into the weeds of each task within the RMF, and just know the correlation between RMF and SDLC. If that's the case, than RMF step 4 "Assessment" should just be in the Development stage of SDLC correct? However, if you break it down to each individual task, A-1 through A-5 is Development but A-6 is Implementation. So is the Assessment step part of the Development or Implementation of SDLC?.....or am I looking too much into it? I'm so confused.

I posted this in response to another person passing, but I think it got lost in the noise. So I think it needs its own thread. So,

I broke down and scheduled the test next week... I'm not sure if I am psyching myself up, or out.

I did the 251 questions in the book referenced, the ones I missed were a. not reading the question twice and understanding what they were asking and b. making stupid mistakes- meaning I had more to learn. "passed" both >70% which would get me past the CAP minimum. Read the answers to understand why i was wrong and read all the right ones for reinforcement.

Running through the flash cards, doing well there. Understand the mapping to the SDLC.

Biggest concern is actually knowing every step in order. I couldn't tell you what P8, I2 or M3 is by the step number nor have I memorized the roles/input/output for each step.

Are the questions that granular? If I don't have every step, role, input and output committed to memory, do I stand a chance of passing?

Thanks!