Test your basic knowledge |

CISM: Certified Information Security Manager

Subjects : certifications, cism, it-skills

Instructions:

Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. Ensures that there are no scalability problems.
Get senior management onboard
Role-based policy
Threat assessment
Stress testing

2. Provides process needs but not impact.
Cyber extortionist
Resource dependency assessment
Multinational organization
Compliance with the organization's information security requirements

3. The MOST important element of the request for proposal (RFP) ro assess the maturity level of the organization's information security management is _______________________.
What happened and how the breach was resolved
Methodology used in the assessment
Notifications and opt-out provisions
Information contained on the equipment

4. Warranted in circumstances where compliance may be difficult or impossible and the risk of noncompliance is outweighed by the benefits.
Developing an information security baseline
Well-defined roles and responsibilities
Exceptions to policy
Is willing to accept

5. Whenever personal data are transferred across national boundaries; ________________________ are required.
Power surge/over voltage (spike)
Control effectiveness
The awareness and agreement of the data subjects
Conduct a risk assessment

6. Lists only the threats that the information asset is exposed to. It does not consider the value of the asset and impact of the threat on the value.
Threat assessment
Vulnerability assessment
Intrusion detection system (IDS)
Process of introducing changes to systems

7. BEST option to improve accountability for a system administrator is to _____________________.
include security responsibilities in a job description
Role-based access control
Personal firewall
Rule-based access control

8. An internal review of a web-based application system finds the ability to gain access to all employees' accounts by changing the employee's ID on the URL used for accessing the account. It means _____________.
Logon banners
Negotiating a local version of the organization standards
Owner of the information asset
The authentication process is broken

9. Program that hides within or looks like a legit program
Trojan horse
Confidentiality
Risk management and the requirements of the organization
Continuous monitoring control initiatives

10. New security ulnerabilities should be managed through a ________________.
Gap analysis
Patch management process
Return on security investment (ROSI)
Is willing to accept

11. To determine sensitivity of assets in terms of risk to the business operation so that proportional countermeasures can be effectively implemented.
Cross-site scripting attacks
Classification of assets needs
Methodology used in the assessment
Well-defined roles and responsibilities

12. A method for analyzing and reducing a relational database to its most streamlined form
Alignment with business strategy
Creation of a business continuity plan
Normalization
Internal risk assessment

13. Scam in which a perpetrator sends an official looking email message that attempts to obtain your personal and financial information
Information contained on the equipment
Power surge/over voltage (spike)
Phishing
Residual risk

14. btaining senior management support for establishing a warm site can BEST be accomplished by ____________________ - including a cost-benefit analysis - will be most persuasive to management. A risk assessment may be included in the business case - but
Phishing
Continuous monitoring control initiatives
Service level agreements (SLAs)
OBusiness case development

15. The best strategy for risk management is to ___________________- as this will take into account the organization's appetite for risk and the fact that it would not be practical to eliminate all risk.
Gain unauthorized access to applications
Reduce risk to an acceptable level
Developing an information security baseline
Protective switch covers

16. May show the performance result of the security related activities; however - the result is interpreted in terms of money and extends to multiple facets of security initiatives.
Baseline standard and then develop additional standards
Breakeven point of risk reduction and cost
Data mart
Return on security investment (ROSI)

17. A function of the session keys distributed by the PKI.
Confidentiality
Resource dependency assessment
Access control matrix
Assess the risks to the business operation

18. On a company's e-commerce web site - a good legal statement regarding data privacy should include a statement regarding what the company will ___________________.
Requirements of the data owners
Do with the information it collects
Get senior management onboard
Decentralization

19. Are not infallible. When tuning the solution - one has to adjust the sensitivity level to give preference either to false reject rate (type I error rate) where the system will be more prone to err denying access to a valid user or erring and allowing
Acceptable use policies
IP address packet filtering
Equal error rate (EER)
Biometric access control systems

20. The security manager would be most concerned with whether _____________________ than the cost of adding additional controls.
Total cost of ownership (TCO)
Conduct a risk assessment
Residual risk would be reduced by a greater amount
Access control matrix

21. Involves the correction of software weaknesses and would necessarily follow change management procedures.
Notifications and opt-out provisions
Defining and ratifying the classification structure of information assets
Patch management
Confidentiality

22. The best measure for preventing the unauthorized disclosure of confidential information.
Acceptable use policies
Role-based access control
Defining high-level business security requirements
Risk management and the requirements of the organization

23. The MAIN reason why _______________ is important to a successful information security program is because classification determines the appropriate level of protection to the asset.
Data isolation
Exceptions to policy
Asset classification
Is willing to accept

24. It is important to achieve ____________________ - and obtain inputs from various organizational entities since security needs to be aligned to the needs of the organization.
Spoofing attacks
Consensus on risks and controls
Alignment with business strategy
Multinational organization

25. When mobile equipment is lost or stolen - the ______________________ matters most in determining the impact of the loss.
Attributes and characteristics of the 'desired state'
Overall organizational structure
Cross-site scripting attacks
Information contained on the equipment

26. When developing an information security program _________________ would help identify the available resources - any gaps and the training requirements for developing resources.
Information security manager
Penetration testing
Alignment with business strategy
Skills inventory

27. The most important characteristic of good security policies is that they be ____________________.
Countermeasure cost-benefit analysis
Owner of the information asset
IP address packet filtering
Aligned with organizational goals

28. Occurs when the incoming level
Encryption of the hard disks
Power surge/over voltage (spike)
Data classification
Key controls

29. The information security manager needs to prioritize the controls based on ________________________.
Lack of change management
IP address packet filtering
Risk management and the requirements of the organization
Equal error rate (EER)

30. Programs that act without a user's knowledge and deliberately alter a computer's operations
Data owners
Cracker
Confidentiality
MAL wear

31. Helps to define the minimum acceptable security that will be implemented to protect the information resources in accordance with the respective criticality levels.
Data warehouse
Comparison of cost of achievement
Rule-based access control
Developing an information security baseline

32. Using public key infrastructure (PKI) is currently accepted as the most secure method to _____________.
Transmit e-mail messages
Defining and ratifying the classification structure of information assets
Overall organizational structure
Monitoring processes

33. Needs to define the access rules - which is troublesome and error prone in large organizations.
Aligned with organizational goals
include security responsibilities in a job description
Rule-based access control
Requirements of the data owners

34. The most critical process for deciding which part of the information system/business process should be given prioritization in case of a security incident.It provides results - such as impact from a security incident and required response times.
BIA (Business Impact Assessment
Attributes and characteristics of the 'desired state'
Transmit e-mail messages
Security risk

35. _________________________ will allow the information security manager to prioritize the remedial measures and provide a means to convey a sense of urgency to management.
Proficiency testing
Classification of assets needs
Return on security investment (ROSI)
Performing a risk assessment

36. It is easier to manage and control a _________________.
BIA (Business Impact Assessment
Penetration testing
Internal risk assessment
Centralized structure

37. The best indicator of the level of compliance with the service level agreement ( SLA ) data confidentiality clauses.
OBusiness case development
Inherent risk
Annual loss expectancy (ALE)calculations
Access control matrix

38. Because past performance is a strong predictor of future performance - _______________________ best prevents attacks from originating within an organization.
Background checks of prospective employees
Power surge/over voltage (spike)
Cryptographic secure sockets layer (SSL) implementations and short key lengths
Residual risk

39. Accesses a computer or network illegally
Baseline standard and then develop additional standards
Skills inventory
Role-based policy
Cracker

40. The weakest link in security implementation - and awareness would reduce this risk. Through security awareness and training programs - individual employees can be informed and sensitized on various security policies and other security topics - thus e
Single sign-on (SSO) product
Cyber extortionist
People
Owner of the information asset

41. Adherence to local regulations must always be the priority. _______________________ is the most effective compromise in this situation.
Cyber terrorist
Continuous analysis - monitoring and feedback
Two-factor authentication
Negotiating a local version of the organization standards

42. The data owner is responsible for _______________________.
Cyber terrorist
Notifications and opt-out provisions
Intrusion detection system (IDS)
Applying the proper classification to the data

43. Responsible for assigning user entitlements and approving access to the systems for which they are responsible.
Data owners
Applying the proper classification to the data
Role-based policy
Classification of assets needs

44. There is a time lag between the time when a security vulnerability is first published - and the time when a patch is delivered. - The best protection is to _____________________ until a patch is installed.
Detection defenses
Annually or whenever there is a significant change
Identify the vulnerable systems and apply compensating controls
Encryption key management

45. Reducing risk to a level too small to measure is _______________.
Virus detection
Gain unauthorized access to applications
Impractical and is often cost-prohibitive
Phishing

46. Has to be integrated into the requirements of every software application's design.
Encryption key management
Detection defenses
Background checks of prospective employees
IP address packet filtering

47. Information security architecture should always be _______________________. Alignment with IT plans or industry and security best practices is secondary by comparison.
Developing an information security baseline
Identify the vulnerable systems and apply compensating controls
Classification of assets needs
Properly aligned with business goals and objectives

48. Only valid if assets have first been identified and appropriately valued.
Malicious software and spyware
Compliance with the organization's information security requirements
Annual loss expectancy (ALE)calculations
Use of security metrics

49. When considering the value of assets ______________________ would give the information security manager the MOST objective basis for measurement of value delivery in information security governance
Tie security risks to key business objectives
Comparison of cost of achievement
Get senior management onboard
What happened and how the breach was resolved

50. Used to understand the flow of one process into another.
Encryption key management
Waterfall chart
Rule-based access control
Cross-site scripting attacks