Test your basic knowledge |

CISM: Certified Information Security Manager

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. The best measure and will involve reviewing the entire source code to detect all instances of back doors.






2. Without _____________________ - there cannot be accountability.






3. The risk that has been assumed by a third party and may not necessarily be equal to the minimal form of residual risk.






4. Inject malformed input.






5. Potentially damaging computer program that affects - or infects a computer negatively by altering the way the computer works






6. Has full responsibility over data.






7. It is easier to manage and control a _________________.






8. Only valid if assets have first been identified and appropriately valued.






9. Computer that has duplicate components so it can continue to operate when one of its main components fail






10. Would reduce the possibility of an individual accidentally pressing the power button on a device - thereby turning off the device.






11. The BEST way to justify the implementation of a _____________________ is to use a business case. Return on investment (ROI) would only provide the costs needed to preclude specific risks - and would not provide other indirect benefits such as process






12. Company or person you believe will not send a virus-infect file knowingly






13. The MAIN reason why _______________ is important to a successful information security program is because classification determines the appropriate level of protection to the asset.






14. A function of the session keys distributed by the PKI.






15. Cannot be minimized






16. A tool to be used in internal control assessment. KRI setup presents a threshold to alert management when controls are being compromised in business processes. This is a control tool rather than a maturity model support tool.






17. Normally addressed through antivirus and antispyware policies.






18. The MOST useful way to describe the objectives in the information security strategy is through ______________________.


19. Responsible for securing the information.






20. In order to highlight to management the importance of network security - the security manager should FIRST _______________.






21. The _____________________ should be the person with the decision-making power in the department deriving the most benefit from the asset.






22. Should be performed to identify the risk and determine needed controls.






23. Allows you to use field security personnel as security missionaries or ambassadors to spread the security awareness message. It allows security administrators to be more responsive.






24. If the firewall allows source routing - any outsider can carry out _________________ by stealing the internal (private) IP addresses of the organization.






25. May show the performance result of the security related activities; however - the result is interpreted in terms of money and extends to multiple facets of security initiatives.






26. Should PRIMARILY be based on regulatory and legal requirements.






27. Residual risk is unmanaged - i.e. - inherent risk which remains uncontrolled. This is key to the organization's _____________ and is the amount of residual risk that a business is living with that affects its viability.






28. All within the responsibility of the information security manager.






29. From a security standpoint - _______________________ is one of the most important topics that should be included in the contract with third-party service provider.


30. Scam in which a perpetrator sends an official looking email message that attempts to obtain your personal and financial information






31. Someone who uses email as a vehicle for extortion; send company threatening emails indicating they will expose confidential information - exploit security launch - etc.






32. _________________________ will allow the information security manager to prioritize the remedial measures and provide a means to convey a sense of urgency to management.






33. Whenever personal data are transferred across national boundaries; ________________________ are required.






34. Attackers who exploit flawed ___________________________________ can sniff network traffic and crack keys to gain unauthorized access to information.






35. Effective and efficient in large user communities because it controls system access by the roles defined for groups of users. Users are assigned to the various roles and the system controls the access based on those roles.






36. Can be used to detect an external attack but would not help in authenticating a user attempting to connect.






37. Legal document to be signed by all employees - suppliers etc before they 'touch' the organization - to protect the organization's intellectual property.






38. Provide metrics to which outsourcing firms can be held accountable.






39. The best strategy for risk management is to ___________________- as this will take into account the organization's appetite for risk and the fact that it would not be practical to eliminate all risk.






40. The risk that controls may not prevent/detect an incident with a measure of control effectiveness.






41. Has to be integrated into the requirements of every software application's design.






42. Someone who accesses a computer or network illegally






43. The weakest link in security implementation - and awareness would reduce this risk. Through security awareness and training programs - individual employees can be informed and sensitized on various security policies and other security topics - thus e






44. Using public key infrastructure (PKI) is currently accepted as the most secure method to _____________.






45. Provides strong online authentication.






46. Occurs when the incoming level






47. provides the most effective protection of data on mobile devices.






48. Occurs after the risk assessment process - it does not measure it.






49. It is important to achieve ____________________ - and obtain inputs from various organizational entities since security needs to be aligned to the needs of the organization.






50. Lists only the threats that the information asset is exposed to. It does not consider the value of the asset and impact of the threat on the value.