Test your basic knowledge |

CISM: Certified Information Security Manager

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Ultimately responsible for all that happens in the organization. The others are not individually liable for failures of security in the organization.






2. Occurs after the risk assessment process - it does not measure it.






3. Senior management commitment and support for information security can BEST be obtained through presentations that ____________________.






4. The primary role of the information security manager in the process of information classification within the organization.






5. Would protect against spoofing an internal address but would not provide strong authentication.






6. _________________________ will allow the information security manager to prioritize the remedial measures and provide a means to convey a sense of urgency to management.






7. All within the responsibility of the information security manager.






8. The information security manager needs to prioritize the controls based on ________________________.






9. To identify known vulnerabilities based on common misconfigurations and missing updates.






10. Occurs when the incoming level






11. In order to highlight to management the importance of network security - the security manager should FIRST _______________.






12. There is a time lag between the time when a security vulnerability is first published - and the time when a patch is delivered. - The best protection is to _____________________ until a patch is installed.






13. Information security architecture should always be _______________________. Alignment with IT plans or industry and security best practices is secondary by comparison.






14. Because past performance is a strong predictor of future performance - _______________________ best prevents attacks from originating within an organization.






15. Ensure that transmitted information can be attributed to the named sender.






16. When mobile equipment is lost or stolen - the ______________________ matters most in determining the impact of the loss.






17. The _____________________is a severe omission and will greatly increase information security risk. Presents the GREATEST information security risk for an organization with multiple - but small - domestic processing locations






18. A trusted third party that attests to the identity of the signatory - and reliance will be a function of the level of trust afforded the CA.






19. S small warehouse - designed for the end-user needs in a strategic business unit






20. Identification and _______________ of business risk enables project managers to address areas with most significance.






21. Change management controls the _____________________. This is often the point at which a weakness will be introduced.






22. Only valid if assets have first been identified and appropriately valued.






23. Awareness - training and physical security defenses.






24. The MOST important element of the request for proposal (RFP) ro assess the maturity level of the organization's information security management is _______________________.






25. A Successful risk management should lead to a ________________.






26. When developing an information security program _________________ would help identify the available resources - any gaps and the training requirements for developing resources.






27. Should PRIMARILY be based on regulatory and legal requirements.






28. Provides an additional security mechanism over and above that provided by passwords alone. This is frequently used by mobile users needing to establish connectivity to a corporate network.






29. A function of the session keys distributed by the PKI.






30. Warranted in circumstances where compliance may be difficult or impossible and the risk of noncompliance is outweighed by the benefits.






31. Lists only the threats that the information asset is exposed to. It does not consider the value of the asset and impact of the threat on the value.






32. The data owner is responsible for _______________________.






33. While useful for identifying the difference between the current state and the desired future state - e.g. organization has to comply with recently published industry regulatory requirements compliance that potentially has high implementation costs -






34. The most fundamental evaluation criteria for the appropriate selection of any security technology is ________________________.






35. Program that copies itself repeatedly - using up resources and possibly shutting down the computer or network






36. By definition are not previously known and therefore are undetectable.






37. Accesses a computer or network illegally






38. Lists only the vulnerabilities inherent in the information asset that can attract threats. It does not consider the value of the asset and the impact of perceived threats on the value.






39. A repository of historical data organized by subject to support decision makers in the org






40. In assessing the degree to which an organization may be affected by new privacy legislation - information security management should first _____________________.






41. The best measure for preventing the unauthorized disclosure of confidential information.






42. __________________________ is of utmost importance. Understanding business objectives is critical in determining the security needs of the organization.






43. The PRIMARY goal in developing an information security strategy is to: _________________________.






44. In biometric systems where the possibility of false rejects is a problem - it may be necessary to reduce sensitivity and thereby increase the number of false accepts.






45. Results in greater uniformity and better adherence to security policies. It is generally less expensive to administer due to the economies of scale. However - turnaround can be slower due to the lack of alignment with business units.






46. Would reduce the possibility of an individual accidentally pressing the power button on a device - thereby turning off the device.






47. If the firewall allows source routing - any outsider can carry out _________________ by stealing the internal (private) IP addresses of the organization.






48. Program that hides within or looks like a legit program






49. The MOST useful way to describe the objectives in the information security strategy is through ______________________.


50. Most effective in protecting classified data that have been encrypted to prevent disclosure and transmission outside the organization's network.