SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
CISM: Certified Information Security Manager
Start Test
Study First
Subjects
:
certifications
,
cism
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Responsible for assigning user entitlements and approving access to the systems for which they are responsible.
Return on security investment (ROSI)
Data owners
Risk management and the requirements of the organization
Annual loss expectancy (ALE)calculations
2. Identification and _______________ of business risk enables project managers to address areas with most significance.
Its ability to reduce or eliminate business risks
Prioritization
include security responsibilities in a job description
Annually or whenever there is a significant change
3. A key indicator of performance measurement.
Strategic alignment of security with business objectives
Malicious software and spyware
Identify the vulnerable systems and apply compensating controls
Total cost of ownership (TCO)
4. Can be used to detect an external attack but would not help in authenticating a user attempting to connect.
Nondisclosure agreement (NDA)
Worm
include security responsibilities in a job description
Intrusion detection system (IDS)
5. To identify known vulnerabilities based on common misconfigurations and missing updates.
A network vulnerability assessment
Gain unauthorized access to applications
Is willing to accept
Virus
6. Provides an additional security mechanism over and above that provided by passwords alone. This is frequently used by mobile users needing to establish connectivity to a corporate network.
People
SWOT analysis
Security baselines
Two-factor authentication
7. The first step in a risk analysis process to determine the impact to the organization - which is the ultimate goal.
Classification of assets needs
Aligned with organizational goals
Lack of change management
Calculating the value of the information or asset
8. A risk assessment should be conducted _________________.
SWOT analysis
Power surge/over voltage (spike)
Multinational organization
Annually or whenever there is a significant change
9. While useful for identifying the difference between the current state and the desired future state - e.g. organization has to comply with recently published industry regulatory requirements compliance that potentially has high implementation costs -
Well-defined roles and responsibilities
Process of introducing changes to systems
Data mart
Gap analysis
10. When developing an information security program _________________ would help identify the available resources - any gaps and the training requirements for developing resources.
Owner of the information asset
Skills inventory
Protective switch covers
Methodology used in the assessment
11. Reducing risk to a level too small to measure is _______________.
Undervoltage (brownout)
Risk assessment - evaluation and impact analysis
Skills inventory
Impractical and is often cost-prohibitive
12. Program that copies itself repeatedly - using up resources and possibly shutting down the computer or network
Fault-tolerant computer
Platform security - intrusion detection and antivirus controls
Worm
Decentralization
13. The MOST important element of the request for proposal (RFP) ro assess the maturity level of the organization's information security management is _______________________.
Methodology used in the assessment
Do with the information it collects
Detection defenses
Undervoltage (brownout)
14. BEST option to improve accountability for a system administrator is to _____________________.
Digital signatures
Platform security - intrusion detection and antivirus controls
include security responsibilities in a job description
Get senior management onboard
15. The MOST useful way to describe the objectives in the information security strategy is through ______________________.
Warning
: Invalid argument supplied for foreach() in
/var/www/html/basicversity.com/show_quiz.php
on line
183
16. The risk that has been assumed by a third party and may not necessarily be equal to the minimal form of residual risk.
Regular review of access control lists
Transferred risk
Script kiddie
Identify the relevant systems and processes
17. Someone who accesses a computer or network illegally
Trusted source
Patch management
Hacker
Personal firewall
18. Ensures that there are no scalability problems.
Process of introducing changes to systems
Fault-tolerant computer
Information security manager
Stress testing
19. Attackers who exploit flawed ___________________________________ can sniff network traffic and crack keys to gain unauthorized access to information.
Cryptographic secure sockets layer (SSL) implementations and short key lengths
Total cost of ownership (TCO)
Increase business value and confidence
Developing an information security baseline
20. Warranted in circumstances where compliance may be difficult or impossible and the risk of noncompliance is outweighed by the benefits.
Risk assessment - evaluation and impact analysis
Normalization
Certificate authority (CA)
Exceptions to policy
21. Lists only the threats that the information asset is exposed to. It does not consider the value of the asset and impact of the threat on the value.
Equal error rate (EER)
Aligned with organizational goals
Do with the information it collects
Threat assessment
22. In assessing the degree to which an organization may be affected by new privacy legislation - information security management should first _____________________.
Encryption key management
Risk appetite
Identify the relevant systems and processes
Aligned with organizational goals
23. Programs that act without a user's knowledge and deliberately alter a computer's operations
MAL wear
Cracker
Trusted source
Normalization
24. Also required to guarantee fulfillment of laws and regulations of the organization and - therefore - the information security manager will be obligated to comply with the law.
Overall organizational structure
Gap analysis
Monitoring processes
Penetration testing
25. Awareness - training and physical security defenses.
Examples of containment defenses
Developing an information security baseline
Negotiating a local version of the organization standards
Script kiddie
26. Provides strong online authentication.
Public key infrastructure (PKI)
Tie security risks to key business objectives
People
Data isolation
27. Should be performed to identify the risk and determine needed controls.
Internal risk assessment
IP address packet filtering
Lack of change management
Knowledge management
28. The most critical process for deciding which part of the information system/business process should be given prioritization in case of a security incident.It provides results - such as impact from a security incident and required response times.
BIA (Business Impact Assessment
Single sign-on (SSO) product
Asset classification
What happened and how the breach was resolved
29. Will prevent unauthorized access to the laptop even when the laptop is lost or stolen.
Return on security investment (ROSI)
Encryption of the hard disks
Waterfall chart
Well-defined roles and responsibilities
30. Has full responsibility over data.
Cost of control
Asset classification
The data owner
Phishing
31. The MOST effective approach to address issues that arise between IT management - business units and security management when implementing a new security strategy is for the information security manager to ____________________ with any security recomm
Get senior management onboard
Support the business objectives of the organization
Role-based policy
Negotiating a local version of the organization standards
32. It is easier to manage and control a _________________.
Confidentiality
Risk appetite
Key controls
Centralized structure
33. Potentially damaging computer program that affects - or infects a computer negatively by altering the way the computer works
Assess the risks to the business operation
Virus
Confidentiality
Data classification
34. _______________ of the organization have the responsibility of ensuring information systems security this can include indirect personnel such as physical security personnel.
Knowledge management
All personnel
Control effectiveness
Nondisclosure agreement (NDA)
35. The PRIMARY goal in developing an information security strategy is to: _________________________.
Breakeven point of risk reduction and cost
Process of introducing changes to systems
Support the business objectives of the organization
Asset classification
36. A notice that guarantees a user or a web site is legitimate
Lack of change management
Information contained on the equipment
Attributes and characteristics of the 'desired state'
Digital certificate
37. On a company's e-commerce web site - a good legal statement regarding data privacy should include a statement regarding what the company will ___________________.
Do with the information it collects
Trusted source
Negotiating a local version of the organization standards
Multinational organization
38. Computer that has duplicate components so it can continue to operate when one of its main components fail
Is willing to accept
Calculating the value of the information or asset
Fault-tolerant computer
Defining high-level business security requirements
39. Used to understand the flow of one process into another.
Applying the proper classification to the data
Malicious software and spyware
Waterfall chart
Control effectiveness
40. Most effective in providing reasonable assurance of physical access compliance to an unmanned server room controlled with biometric devices.
Regular review of access control lists
Security baselines
SWOT analysis
Intrusion detection system (IDS)
41. The most fundamental evaluation criteria for the appropriate selection of any security technology is ________________________.
Comparison of cost of achievement
Total cost of ownership (TCO)
Its ability to reduce or eliminate business risks
Tailgating
42. Are expensive - so they have to be used in areas where the risk is at its greatest level. These areas are the ones with high impact and high frequency of occurrence.
Continuous monitoring control initiatives
Compliance with the organization's information security requirements
Role-based policy
The data owner
43. The best measure and will involve reviewing the entire source code to detect all instances of back doors.
Security code reviews for the entire software application
Patch management process
BIA (Business Impact Assessment
Background check
44. Carries out the technical administration.
Background check
The database administrator
Gap analysis
The authentication process is broken
45. Occurs after the risk assessment process - it does not measure it.
Phishing
Get senior management onboard
Creation of a business continuity plan
Use of security metrics
46. Helps to define the minimum acceptable security that will be implemented to protect the information resources in accordance with the respective criticality levels.
Background checks of prospective employees
Retention of business records
Developing an information security baseline
Confidentiality
47. The best strategy for risk management is to ___________________- as this will take into account the organization's appetite for risk and the fact that it would not be practical to eliminate all risk.
Calculating the value of the information or asset
Reduce risk to an acceptable level
The balanced scorecard
Prioritization
48. May show the performance result of the security related activities; however - the result is interpreted in terms of money and extends to multiple facets of security initiatives.
Return on security investment (ROSI)
Data classification
Decentralization
All personnel
49. From a security standpoint - _______________________ is one of the most important topics that should be included in the contract with third-party service provider.
Warning
: Invalid argument supplied for foreach() in
/var/www/html/basicversity.com/show_quiz.php
on line
183
50. Accesses a computer or network illegally
Personal firewall
MAL wear
Cracker
Continuous monitoring control initiatives