Test your basic knowledge |

CISSP Certified Information Systems Security Professional

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Natural or human-readable form of message






2. The process of categorizing attack alerts produced from an IDS in order to distinguish false positives from actual attacks






3. The ability an IDS has to dynamically change its rules and configurations in response to changing environmental activity






4. Layer 1 network device that is used to connect network segments together - but provides no traffic control (a concentrator).






5. The first rating that requires security labels






6. A formal announcement by pre-authorized personnel that a disaster or severe outage is predicted or has occurred and that triggers pre-arranged mitigating actions (e.g. A move to an alternate site.)






7. Subjects will not interact with each other's objects






8. Binary decision by a system of permitting or denying access to the entire system






9. A copy of transaction data - designed for querying and reporting






10. Malware that makes many small changes over time to a single data point or system






11. For PKI - to store another copy of a key






12. Process of identifying the risks to an organization - assessing the critical functions - defining the controls in place to reduce organization exposure and evaluating the cost for such controls.






13. Continuous surveillance - to provide for detection and response of any failure in preventive controls.






14. Provides a physical cross connect point for devices.






15. Eavesdropping on network communications by a third party.






16. Review of data






17. Slang for making (burning) a CD-ROM copy of data - whether it is music - software - or other data.






18. High level design or model with a goal of consistency - integrity - and balance






19. A plan used by an organization or business unit to respond to a specific systems failure or disruption of operations. A contingency plan may use any number of resources (e.e workaround procedures - alternate work area - etc.)






20. A layer 2 device that used to connect two network segments and regulate traffic.






21. A mathematical tool for verifying no unintentional changes have been made






22. Asymmetric encryption of a hash of message






23. Less granular organization of controls -






24. To create a copy of data as a precaution against the loss or damage of the original data.






25. Companies should have their own team - made up of ppl from management - IT leagal - HR - and public relations - security and other key areas






26. Inappropriate data






27. The partial or full duplication of data from a source database to one or more destination databases.






28. Malware that subverts the detective controls of an operating system






29. An access policy determined by the owner of a file (or other resource). The owner decides who's allowed access to the file and what privileges they have - most commonly used in the PC environment (i.e. file permissions).






30. Eight bits.






31. Minimal Protection - and is used for systems that were evaluated but failed to meet the criteria for higher divisions






32. A choice in risk management - to implement a control that limits or lessens negative effects






33. Location where coordination and execution of BCP or DRP is directed






34. The assignment of a level of sensitivity to data (or information) that results in the specification of controls for each level of classification.






35. An attack involving the hijacking of a TCP session by predicting a sequence number.






36. Written step-by-step actions






37. Dedicated fast memory located on the same board as the CPU






38. Mitigation of spamming and other attacks by delaying incoming connections as long as possible.






39. Uses a role-based method to determine access rights and permissions. Role based access control is based on the user's role and responsibilities within the company.






40. Uncleared buffers or media






41. A library of commands maintained by a system for other programs to use - provides consistency and integrity for the programs






42. Adversary intercepts encrypted communications - decrypts - views - encrypts - and send along to the true destination






43. Actions measured against either a policy or what a reasonable person would do






44. May be responsible for overall recovery of an organization or unit(s).






45. Unauthorized access of information (e.g. Tapping - sniffing - unsecured wireless communication - emanations)






46. A passive network attack involving monitoring of traffic.






47. Memory - RAM






48. A test conducted on one or more components of a plan under actual operating conditions.






49. Pertaining to law - verified as real






50. The past U.S. military accepted set of standards and processes for network evaluation and assurance - which combines function and assurance requirements