Test your basic knowledge |

CISM: Certified Information Security Manager

Subjects : certifications, cism, it-skills

Instructions:

Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. Also required to guarantee fulfillment of laws and regulations of the organization and - therefore - the information security manager will be obligated to comply with the law.
Increase business value and confidence
Requirements of the data owners
Security awareness training for all employees
Monitoring processes

2. There is a time lag between the time when a security vulnerability is first published - and the time when a patch is delivered. - The best protection is to _____________________ until a patch is installed.
SWOT analysis
Identify the vulnerable systems and apply compensating controls
Platform security - intrusion detection and antivirus controls
Get senior management onboard

3. Needs to define the access rules - which is troublesome and error prone in large organizations.
Risk management and the requirements of the organization
Breakeven point of risk reduction and cost
Process of introducing changes to systems
Rule-based access control

4. Will associate data access with the role performed by an individual - thus restricting access to data required to perform the individual's tasks.
Cost of control
Threat assessment
Compliance with the organization's information security requirements
Role-based policy

5. The most relevant piece of information to include in a cost-benefit analysis of a two-factor authentication system - it would establish a cost baseline and it must be considered for the full life cycle of the control. .
Data classification
Total cost of ownership (TCO)
Conduct a risk assessment
Performing a risk assessment

6. It is important to achieve ____________________ - and obtain inputs from various organizational entities since security needs to be aligned to the needs of the organization.
Control risk
Single sign-on (SSO) product
Security awareness training for all employees
Consensus on risks and controls

7. The PRIMARY goal in developing an information security strategy is to: _________________________.
Risk appetite
Defined objectives
Support the business objectives of the organization
Certificate authority (CA)

8. An effective tool but primarily focuses on malicious code from external sources - and only for those applications that are online.
Security risk
Retention of business records
Virus detection
Cyber extortionist

9. Most effective in protecting classified data that have been encrypted to prevent disclosure and transmission outside the organization's network.
Safeguards over keys
Script kiddie
Data mart
Hacker

10. All within the responsibility of the information security manager.
Creation of a business continuity plan
Knowledge management
Platform security - intrusion detection and antivirus controls
Control effectiveness

11. The MOST important component of a privacy policy is: A Privacy policies must contain _______________; they are a high-level management statement of direction. They do not necessarily address warranties - liabilities or geographic coverage - which are
Notifications and opt-out provisions
Patch management
Reduce risk to an acceptable level
The database administrator

12. Provides process needs but not impact.
Nondisclosure agreement (NDA)
0-day vulnerabilities
Protective switch covers
Resource dependency assessment

13. Has full responsibility over data.
Decentralization
The data owner
Residual risk would be reduced by a greater amount
Risk assessment - evaluation and impact analysis

14. When considering the value of assets ______________________ would give the information security manager the MOST objective basis for measurement of value delivery in information security governance
Consensus on risks and controls
Comparison of cost of achievement
Control effectiveness
Defining and ratifying the classification structure of information assets

15. Most effective in providing reasonable assurance of physical access compliance to an unmanned server room controlled with biometric devices.
Equal error rate (EER)
Background check
Threat assessment
Regular review of access control lists

16. Has to be integrated into the requirements of every software application's design.
Encryption key management
Examples of containment defenses
Owner of the information asset
Risk management and the requirements of the organization

17. Would protect against spoofing an internal address but would not provide strong authentication.
Confidentiality
IP address packet filtering
The data owner
Comparison of cost of achievement

18. Senior management commitment and support for information security can BEST be obtained through presentations that ____________________.
Hacker
Compliance with the organization's information security requirements
Centralization of information security management
Tie security risks to key business objectives

19. The first step in a risk analysis process to determine the impact to the organization - which is the ultimate goal.
Asset classification
Calculating the value of the information or asset
Background check
Impractical and is often cost-prohibitive

20. provides the most effective protection of data on mobile devices.
Use of security metrics
Encryption
Asset classification
Security baselines

21. Addresses strengths - weaknesses - opportunities and threats. Although useful - a SWOT analysis is not as effective a tool.
Power surge/over voltage (spike)
Centralization of information security management
SWOT analysis
Exceptions to policy

22. The best measure for preventing the unauthorized disclosure of confidential information.
Protective switch covers
Single sign-on (SSO) product
Security awareness training for all employees
Acceptable use policies

23. The MOST effective way to ensure network users are aware of their responsibilities to comply with an organization's security requirements is - ______________ would appear every time the user logs on - and the user would be required to read and agree
Gap analysis
Nondisclosure agreement (NDA)
Information security manager
Logon banners

24. Lists only the threats that the information asset is exposed to. It does not consider the value of the asset and impact of the threat on the value.
Threat assessment
Overall organizational structure
Virus
Total cost of ownership (TCO)

25. Without _____________________ - there cannot be accountability.
Skills inventory
Well-defined roles and responsibilities
OBusiness case development
Properly aligned with business goals and objectives

26. In biometric systems where the possibility of false rejects is a problem - it may be necessary to reduce sensitivity and thereby increase the number of false accepts.
Threat assessment
Equal error rate (EER)
The board of directors and senior management
Personal firewall

27. Ensures that there are no scalability problems.
Multinational organization
Exceptions to policy
Well-defined roles and responsibilities
Stress testing

28. Most effective for evaluating the degree to which information security objectives are being met.
Lack of change management
include security responsibilities in a job description
Residual risk would be reduced by a greater amount
The balanced scorecard

29. The _____________________is a severe omission and will greatly increase information security risk. Presents the GREATEST information security risk for an organization with multiple - but small - domestic processing locations
Identify the vulnerable systems and apply compensating controls
Threat assessment
Retention of business records
Lack of change management

30. ecurity design flaws require a ____________________.
Properly aligned with business goals and objectives
Role-based access control
Multinational organization
Deeper level of analysis

31. The most critical process for deciding which part of the information system/business process should be given prioritization in case of a security incident.It provides results - such as impact from a security incident and required response times.
Classification of assets needs
include security responsibilities in a job description
Residual risk would be reduced by a greater amount
BIA (Business Impact Assessment

32. A risk assessment should be conducted _________________.
Patch management
Annually or whenever there is a significant change
Decentralization
Continuous monitoring control initiatives

33. The MOST effective approach to address issues that arise between IT management - business units and security management when implementing a new security strategy is for the information security manager to ____________________ with any security recomm
Defined objectives
IP address packet filtering
Get senior management onboard
Personal firewall

34. Attackers who exploit flawed ___________________________________ can sniff network traffic and crack keys to gain unauthorized access to information.
Get senior management onboard
Cryptographic secure sockets layer (SSL) implementations and short key lengths
Control risk
Acceptable use policies

35. Occurs after the risk assessment process - it does not measure it.
Worm
Use of security metrics
Equal error rate (EER)
Fault-tolerant computer

36. _________________________ will allow the information security manager to prioritize the remedial measures and provide a means to convey a sense of urgency to management.
Deeper level of analysis
Personal firewall
Waterfall chart
Performing a risk assessment

37. Are expensive - so they have to be used in areas where the risk is at its greatest level. These areas are the ones with high impact and high frequency of occurrence.
Continuous monitoring control initiatives
Tailgating
MAL wear
Increase business value and confidence

38. The most fundamental evaluation criteria for the appropriate selection of any security technology is ________________________.
Data warehouse
Its ability to reduce or eliminate business risks
Transferred risk
Well-defined roles and responsibilities

39. Should be performed to identify the risk and determine needed controls.
Internal risk assessment
The database administrator
Cost of control
Risk management and the requirements of the organization

40. While useful for identifying the difference between the current state and the desired future state - e.g. organization has to comply with recently published industry regulatory requirements compliance that potentially has high implementation costs -
Baseline standard and then develop additional standards
The authentication process is broken
Residual risk would be reduced by a greater amount
Gap analysis

41. Primarily reduce risk and are most effective for the protection of information assets.
Key controls
Retention of business records
Logon banners
Identify the vulnerable systems and apply compensating controls

42. A trusted third party that attests to the identity of the signatory - and reliance will be a function of the level of trust afforded the CA.
Regular review of access control lists
Certificate authority (CA)
Continuous monitoring control initiatives
Digital signatures

43. To determine sensitivity of assets in terms of risk to the business operation so that proportional countermeasures can be effectively implemented.
Classification of assets needs
Skills inventory
Get senior management onboard
Proficiency testing

44. Ensure that transmitted information can be attributed to the named sender.
Confidentiality
Calculating the value of the information or asset
Encryption
Digital signatures

45. Uses security metrics to measure the performance of the information security program.
Safeguards over keys
All personnel
Waterfall chart
Information security manager

46. The weakest link in security implementation - and awareness would reduce this risk. Through security awareness and training programs - individual employees can be informed and sensitized on various security policies and other security topics - thus e
Cyber extortionist
People
A network vulnerability assessment
Personal firewall

47. Lists only the vulnerabilities inherent in the information asset that can attract threats. It does not consider the value of the asset and the impact of perceived threats on the value.
Vulnerability assessment
Biometric access control systems
Support the business objectives of the organization
Defined objectives

48. The primary role of the information security manager in the process of information classification within the organization.
Nondisclosure agreement (NDA)
Defining and ratifying the classification structure of information assets
Stress testing
Background checks of prospective employees

49. Allows you to use field security personnel as security missionaries or ambassadors to spread the security awareness message. It allows security administrators to be more responsive.
Decentralization
Penetration testing
0-day vulnerabilities
Internal risk assessment

50. Information security governance models are highly dependent on the _____________________.
Fault-tolerant computer
The board of directors and senior management
Overall organizational structure
Risk management and the requirements of the organization