CAP Exam Review
I took the Certified Authorization Professional (CAP) exam yesterday and thought I would leave a review, since there is so little information about it on these forums. The exam itself is not difficult and the questions are structured similarly to CISSP exam questions, so, if you have taken the CISSP, you will recognize the question style. There is one challenge to the CAP that I believe is the cause of difficulty for many people who have taken it and not been successful. The fact that there isn't much in the way of study materials and books and little information about the exam itself makes preparing and gauging your readiness the difficult part. So in short, if you are properly prepared, the exam is trivial and the questions are fair and direct. Below is how I prepared myself for the exam in less than three weeks.
Resources
NIST and FIPS Documentation
FedVTE CAP Training
Official Guide to the CAP CBK, Second Edition
Study Plan
The reality is that the current CAP CIB lays out everything you need to know, and based on my experience, you will pass easily if you follow the CIB to the letter and know every single topic on it. The CAP has seven domains and all of them involve the Risk Management Framework (RMF). The first domain covers the necessities of the RMF and each of the six domains that follow map directly to the six chronological steps of the RMF. DIACAP/NIACAP should not be studied for this exam.
Knowing that the exam is essentially all about the RMF, I decided to master the NIST and FIPS documents themselves as the primary source of preparation. This turned out to be the ideal and recommended way to prepare. By knowing the major NIST and FIPS documents inside and out, you will be adequately prepared for the exam. You also must know all of the relevant terms. I advise going through the glossary of the major NIST documents and knowing the terminology that is used. Below are the documents you should know by heart:
FIPS 199
FIPS 200
NIST SP 800-18 R4
NIST SP 800-30 R1
NIST SP 800-37 R1
NIST SP 800-39
NIST SP 800-53 R4
NIST SP 800-53A
NIST SP 800-59
NIST SP 800-60
All of the documents are related and each has its place. If you understand the RMF inside and out, as well as how these documents work together, you will be prepared. Just remember that the exam is about the RMF, so adequately preparing for the exam means knowing everything about the RMF so you can answer any question that may be thrown your way. Stick to the CIB to make sure you do not miss any topics.
Of the material listed in my study plan above, all of it was outdated except the actual documentation. This is another important fact to point out. The FedVTE was a good resource to get me introduced to the RMF in general, but I did not bother finishing it. I got about 66% of the way through it before I realized it would be better to use my time on the actual documentation itself. The Official Guide to the CAP CBK, Second Edition (2012) is also outdated. However, it does have a lot of good information in it, and I used it a couple days before the exam to fine-tune some topics from the CIB I had not covered during my documentation study. I would recommend reading it or skimming through it to get your introduction to CAP. You really need to understand and know the official documentation if you truly want to be prepared for the CAP. For example, you should be able to write out the entire RMF process in fine detail, to include the steps, tasks, primary roles, supporting documentation, and relationship to the exact phase of the SDLC it maps to. If you can do this with no problem, you are well on your way to your CAP certification.
It is difficult to understand what you need to be prepared for this exam, but I am hoping that this write-up provides assistance. Using this study plan, I was able to pass the CAP exam in 107 minutes. Furthermore, I would recommend that whoever attempts this exam have DoD C&A experience. I have three years experience and found that this was a huge factor in my ability to quickly prepare for the exam. The more experience you have with it, the more natural the RMF will be and the more sense it will all make to you as you read through the documentation and prepare.
Feel free to ask any questions you may have. I would be more than happy to answer any questions, provided they do not violate the ISC2 ethics.
