Test your basic knowledge |

CISM: Certified Information Security Manager

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Should PRIMARILY be based on regulatory and legal requirements.






2. If the firewall allows source routing - any outsider can carry out _________________ by stealing the internal (private) IP addresses of the organization.






3. In order to highlight to management the importance of network security - the security manager should FIRST _______________.






4. The PRIMARY goal in developing an information security strategy is to: _________________________.






5. A key indicator of performance measurement.






6. Provide metrics to which outsourcing firms can be held accountable.






7. A tool to be used in internal control assessment. KRI setup presents a threshold to alert management when controls are being compromised in business processes. This is a control tool rather than a maturity model support tool.






8. The BEST justification to convince management to invest in an information security program is that doing so would _________________.






9. Occurs when the incoming level






10. An information security manager has to impress upon the human resources department the need for _____________________.






11. Risk should be reduced to a level that an organization _____________.






12. The job of the information security officer on a management team is to ___________________.






13. The primary role of the information security manager in the process of information classification within the organization.






14. In assessing the degree to which an organization may be affected by new privacy legislation - information security management should first _____________________.






15. It is important to achieve ____________________ - and obtain inputs from various organizational entities since security needs to be aligned to the needs of the organization.






16. A method for analyzing and reducing a relational database to its most streamlined form






17. The best measure and will involve reviewing the entire source code to detect all instances of back doors.






18. Can be used to detect an external attack but would not help in authenticating a user attempting to connect.






19. The MOST important element of an information security strategy.






20. When developing an information security program _________________ would help identify the available resources - any gaps and the training requirements for developing resources.






21. When considering the value of assets ______________________ would give the information security manager the MOST objective basis for measurement of value delivery in information security governance






22. Company or person you believe will not send a virus-infect file knowingly






23. The best strategy for risk management is to ___________________- as this will take into account the organization's appetite for risk and the fact that it would not be practical to eliminate all risk.






24. The risk that has been assumed by a third party and may not necessarily be equal to the minimal form of residual risk.






25. Scam in which a perpetrator sends an official looking email message that attempts to obtain your personal and financial information






26. Whenever personal data are transferred across national boundaries; ________________________ are required.






27. The information security manager needs to prioritize the controls based on ________________________.






28. Risk assessment is a very important process for the ___________________. Risk assessment provides information on the likelihood of occurrence of security incidence and assists in the selection of countermeasures - but not in the prioritization.






29. Only valid if assets have first been identified and appropriately valued.






30. Someone who uses email as a vehicle for extortion; send company threatening emails indicating they will expose confidential information - exploit security launch - etc.






31. Applications cannot access data associated with other apps






32. A risk assessment should be conducted _________________.






33. Someone who uses the internet or network to destroy or damage computers for political reasons






34. Most effective for evaluating the degree to which information security objectives are being met.






35. Change management controls the _____________________. This is often the point at which a weakness will be introduced.






36. Used to understand the flow of one process into another.






37. Should be determined from the risk assessment results.






38. When mobile equipment is lost or stolen - the ______________________ matters most in determining the impact of the loss.






39. Ultimately responsible for all that happens in the organization. The others are not individually liable for failures of security in the organization.






40. btaining senior management support for establishing a warm site can BEST be accomplished by ____________________ - including a cost-benefit analysis - will be most persuasive to management. A risk assessment may be included in the business case - but






41. Adherence to local regulations must always be the priority. _______________________ is the most effective compromise in this situation.






42. Carries out the technical administration.






43. From a security standpoint - _______________________ is one of the most important topics that should be included in the contract with third-party service provider.

Warning: Invalid argument supplied for foreach() in /var/www/html/basicversity.com/show_quiz.php on line 183


44. Identification and _______________ of business risk enables project managers to address areas with most significance.






45. The first step in a risk analysis process to determine the impact to the organization - which is the ultimate goal.






46. Ensures that there are no scalability problems.






47. Someone who accesses a computer or network illegally






48. It is more efficient to establish a ___________________for locations that must meet specific requirements.






49. When reporting an incident to senior management - the initial information to be communicated should include an explanation of _____________________ A summary of security logs would be too technical to report to senior management. An analysis of the i






50. Occurs when the electrical supply drops