SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
CISM: Certified Information Security Manager
Start Test
Study First
Subjects
:
certifications
,
cism
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Occurs after the risk assessment process - it does not measure it.
Classification of assets needs
Use of security metrics
Waterfall chart
People
2. Accesses a computer or network illegally
Comparison of cost of achievement
Regulatory compliance
Assess the risks to the business operation
Cracker
3. Provides strong online authentication.
Public key infrastructure (PKI)
Return on security investment (ROSI)
Regulatory compliance
Acceptable use policies
4. Has to be integrated into the requirements of every software application's design.
Security risk
Audit objectives
Gain unauthorized access to applications
Encryption key management
5. Addresses strengths - weaknesses - opportunities and threats. Although useful - a SWOT analysis is not as effective a tool.
Information contained on the equipment
Acceptable use policies
SWOT analysis
Conduct a risk assessment
6. Someone who accesses a computer or network illegally
Service level agreements (SLAs)
Hacker
Deeper level of analysis
Total cost of ownership (TCO)
7. Residual risk is unmanaged - i.e. - inherent risk which remains uncontrolled. This is key to the organization's _____________ and is the amount of residual risk that a business is living with that affects its viability.
The data custodian
Confidentiality
Power surge/over voltage (spike)
Risk appetite
8. All within the responsibility of the information security manager.
People
Attributes and characteristics of the 'desired state'
Rule-based access control
Platform security - intrusion detection and antivirus controls
9. Adherence to local regulations must always be the priority. _______________________ is the most effective compromise in this situation.
Information contained on the equipment
Negotiating a local version of the organization standards
Power surge/over voltage (spike)
Cryptographic secure sockets layer (SSL) implementations and short key lengths
10. Someone who uses email as a vehicle for extortion; send company threatening emails indicating they will expose confidential information - exploit security launch - etc.
Cyber extortionist
Retention of business records
Internal risk assessment
Normalization
11. Lists only the vulnerabilities inherent in the information asset that can attract threats. It does not consider the value of the asset and the impact of perceived threats on the value.
Resource dependency assessment
Vulnerability assessment
0-day vulnerabilities
Risk assessment - evaluation and impact analysis
12. Someone who uses the internet or network to destroy or damage computers for political reasons
Cyber terrorist
Negotiating a local version of the organization standards
Deeper level of analysis
All personnel
13. The information security manager needs to prioritize the controls based on ________________________.
Data isolation
Risk management and the requirements of the organization
Exceptions to policy
Threat assessment
14. The most critical process for deciding which part of the information system/business process should be given prioritization in case of a security incident.It provides results - such as impact from a security incident and required response times.
Defining and ratifying the classification structure of information assets
Stress testing
Is willing to accept
BIA (Business Impact Assessment
15. The risk that remains after putting into place an effective risk management program; therefore - acceptable risk is achieved when this amount is minimized.
OBusiness case development
Support the business objectives of the organization
Spoofing attacks
Residual risk
16. Would protect against spoofing an internal address but would not provide strong authentication.
Fault-tolerant computer
Creation of a business continuity plan
Performing a risk assessment
IP address packet filtering
17. When developing an information security program _________________ would help identify the available resources - any gaps and the training requirements for developing resources.
Inherent risk
Strategic alignment of security with business objectives
Normalization
Skills inventory
18. _______________ of the organization have the responsibility of ensuring information systems security this can include indirect personnel such as physical security personnel.
All personnel
Spoofing attacks
Do with the information it collects
Cyber extortionist
19. Information security governance models are highly dependent on the _____________________.
Overall organizational structure
Gap analysis
Information security manager
Retention of business records
20. Effective and efficient in large user communities because it controls system access by the roles defined for groups of users. Users are assigned to the various roles and the system controls the access based on those roles.
Single sign-on (SSO) product
Logon banners
Role-based access control
Background check
21. Information security architecture should always be _______________________. Alignment with IT plans or industry and security best practices is secondary by comparison.
Properly aligned with business goals and objectives
Regulatory compliance
Data owners
What happened and how the breach was resolved
22. The best measure and will involve reviewing the entire source code to detect all instances of back doors.
Security code reviews for the entire software application
Defining and ratifying the classification structure of information assets
Encryption of the hard disks
Return on security investment (ROSI)
23. Identification and _______________ of business risk enables project managers to address areas with most significance.
Calculating the value of the information or asset
Prioritization
Fault-tolerant computer
Proficiency testing
24. Because past performance is a strong predictor of future performance - _______________________ best prevents attacks from originating within an organization.
Gain unauthorized access to applications
Protective switch covers
Data warehouse
Background checks of prospective employees
25. Inject malformed input.
Single sign-on (SSO) product
Security risk
Performing a risk assessment
Cross-site scripting attacks
26. provides the most effective protection of data on mobile devices.
Encryption
Continuous analysis - monitoring and feedback
OBusiness case development
Two-factor authentication
27. Programs that act without a user's knowledge and deliberately alter a computer's operations
Requirements of the data owners
Identify the relevant systems and processes
Return on security investment (ROSI)
MAL wear
28. _________________________ will allow the information security manager to prioritize the remedial measures and provide a means to convey a sense of urgency to management.
Encryption key management
Performing a risk assessment
Audit objectives
Tailgating
29. Should be a standard requirement for the service provider.
Countermeasure cost-benefit analysis
Regular review of access control lists
Background check
Cross-site scripting attacks
30. The data owner is responsible for _______________________.
Applying the proper classification to the data
Acceptable use policies
Transferred risk
The board of directors and senior management
31. Determined by the business risk - i.e. - the potential impact on the business of the loss - corruption or disclosure of information. It must be applied to information in all forms - both electronic and physical (paper) - and should be applied by the
Data classification
Multinational organization
Assess the risks to the business operation
Intrusion detection system (IDS)
32. Ensure that transmitted information can be attributed to the named sender.
Digital signatures
Requirements of the data owners
Nondisclosure agreement (NDA)
Confidentiality
33. Carries out the technical administration.
Biometric access control systems
Digital signatures
The database administrator
Safeguards over keys
34. Occurs when the electrical supply drops
Identify the relevant systems and processes
Impractical and is often cost-prohibitive
0-day vulnerabilities
Undervoltage (brownout)
35. Will prevent unauthorized access to the laptop even when the laptop is lost or stolen.
Encryption of the hard disks
Audit objectives
Comparison of cost of achievement
Properly aligned with business goals and objectives
36. Provides an additional security mechanism over and above that provided by passwords alone. This is frequently used by mobile users needing to establish connectivity to a corporate network.
The balanced scorecard
Two-factor authentication
Identify the relevant systems and processes
MAL wear
37. Most effective in providing reasonable assurance of physical access compliance to an unmanned server room controlled with biometric devices.
Regular review of access control lists
Continuous monitoring control initiatives
Fault-tolerant computer
Asset classification
38. The risk that controls may not prevent/detect an incident with a measure of control effectiveness.
Control risk
Encryption key management
Hacker
Risk assessment - evaluation and impact analysis
39. It is important to achieve ____________________ - and obtain inputs from various organizational entities since security needs to be aligned to the needs of the organization.
Skills inventory
Reduce risk to an acceptable level
Consensus on risks and controls
The data custodian
40. Should PRIMARILY be based on regulatory and legal requirements.
Retention of business records
What happened and how the breach was resolved
Script kiddie
Defining high-level business security requirements
41. btaining senior management support for establishing a warm site can BEST be accomplished by ____________________ - including a cost-benefit analysis - will be most persuasive to management. A risk assessment may be included in the business case - but
OBusiness case development
Its ability to reduce or eliminate business risks
Use of security metrics
include security responsibilities in a job description
42. A risk assessment should be conducted _________________.
include security responsibilities in a job description
Comparison of cost of achievement
Cyber terrorist
Annually or whenever there is a significant change
43. A notice that guarantees a user or a web site is legitimate
Data mart
Breakeven point of risk reduction and cost
The balanced scorecard
Digital certificate
44. The _____________________ should be the person with the decision-making power in the department deriving the most benefit from the asset.
Script kiddie
Residual risk would be reduced by a greater amount
A network vulnerability assessment
Owner of the information asset
45. It is more efficient to establish a ___________________for locations that must meet specific requirements.
Trojan horse
Alignment with business strategy
Residual risk
Baseline standard and then develop additional standards
46. A Successful risk management should lead to a ________________.
Encryption key management
Breakeven point of risk reduction and cost
Digital certificate
Security baselines
47. Provide minimum recommended settings and do not prevent introduction of control weaknesses.'
Its ability to reduce or eliminate business risks
Security baselines
Data isolation
Tailgating
48. Change management controls the _____________________. This is often the point at which a weakness will be introduced.
Attributes and characteristics of the 'desired state'
Process of introducing changes to systems
Owner of the information asset
Data owners
49. The MOST important component of a privacy policy is: A Privacy policies must contain _______________; they are a high-level management statement of direction. They do not necessarily address warranties - liabilities or geographic coverage - which are
Continuous analysis - monitoring and feedback
Notifications and opt-out provisions
Malicious software and spyware
Role-based policy
50. Ensures that there are no scalability problems.
Properly aligned with business goals and objectives
Methodology used in the assessment
Stress testing
Risk management and the requirements of the organization
Sorry!:) No result found.
Can you answer 50 questions in 15 minutes?
Let me suggest you:
Browse all subjects
Browse all tests
Most popular tests
Major Subjects
Tests & Exams
AP
CLEP
DSST
GRE
SAT
GMAT
Certifications
CISSP go to https://www.isc2.org/
PMP
ITIL
RHCE
MCTS
More...
IT Skills
Android Programming
Data Modeling
Objective C Programming
Basic Python Programming
Adobe Illustrator
More...
Business Skills
Advertising Techniques
Business Accounting Basics
Business Strategy
Human Resource Management
Marketing Basics
More...
Soft Skills
Body Language
People Skills
Public Speaking
Persuasion
Job Hunting And Resumes
More...
Vocabulary
GRE Vocab
SAT Vocab
TOEFL Essential Vocab
Basic English Words For All
Global Words You Should Know
Business English
More...
Languages
AP German Vocab
AP Latin Vocab
SAT Subject Test: French
Italian Survival
Norwegian Survival
More...
Engineering
Audio Engineering
Computer Science Engineering
Aerospace Engineering
Chemical Engineering
Structural Engineering
More...
Health Sciences
Basic Nursing Skills
Health Science Language Fundamentals
Veterinary Technology Medical Language
Cardiology
Clinical Surgery
More...
English
Grammar Fundamentals
Literary And Rhetorical Vocab
Elements Of Style Vocab
Introduction To English Major
Complete Advanced Sentences
Literature
Homonyms
More...
Math
Algebra Formulas
Basic Arithmetic: Measurements
Metric Conversions
Geometric Properties
Important Math Facts
Number Sense Vocab
Business Math
More...
Other Major Subjects
Science
Economics
History
Law
Performing-arts
Cooking
Logic & Reasoning
Trivia
Browse all subjects
Browse all tests
Most popular tests