SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Assessment And Risk Mgmt
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A commercial password cracker that can test password strength and recover passwords; and perform dictionary and brute force attacks
security officer
elcomsoft
CobiT
performance baseline
2. Ensures reliable timely access to data/resources to authorized individuals
risk analysis
ISO/IEC 27004
availability
ISO/IEC 27799
3. This tool scans network devices listening for open ports - (i.e. Nmap - scanmetender - superscan - NHS nohack scanner)
port scanner
vulnerability scanner
risk mitigation
Operationally Critical Threat - Asset - and Vulnerability Evaluation
4. Risk assessment that is scenario based - ranks threats and countermeasures - uses experience - judgment - intuition and opinion
vulnerability scanner
qualitative
AS/NZS 4360
physical
5. Plan and Organize - Implement - Operate and Maintain - Monitor and Evaluate
security program
annualized rate of occurrence
administrative
Facilitated Risk Analysis Process
6. Type of audit that checks information classification and change control procedures
CISO
blueprints
corporate security officer
administrative
7. Type of audit that checks procedures and policies for escalating issues to management
threat
annualized loss expectancy
escalation
network mapping
8. An open language from mitre.org for determining vulnerabilities and problems on computer systems
usage
OVAL
risk
SP 800-30
9. Type of audit that checks that network resources - systems and software are used appropriately
No events - Errors only - Errors and warnings - All events
CISO
usage
delayed
10. Provides good practice advice on ISMS (ISO 17799)(based on BS7799 Part 1)
single loss expectancy
annualized loss expectancy
protocol analyzer
ISO/IEC 27002
11. Controls that include policies - standards - procedures -risk management - personnel screening - training - change control
administrative
CISO
port scanner
qualitative
12. Event levels available for logging in a MS DNS server
Facilitated Risk Analysis Process
CobiT
annualized rate of occurrence
No events - Errors only - Errors and warnings - All events
13. COSO
privilege
CobiT
Committee of Sponsoring Organizations
security program
14. Controls that implement access control - password mangement - identification and authentication methods - configuration
due care
mappers
IRM
technical
15. Ensures managment security directives are fulfilled
delayed
technical
security officer
port scanner
16. FRAP
availability
security governanace
Facilitated Risk Analysis Process
risk
17. An password cracker that uses dictionary and brute force attacks - rainbow tables - can test password strength and recover passwords - was originally free - but now a commercial product
CobiT
L0phtCrack
risk catagories
ISO 17799
18. Legal term used to determine liability - acting responsibly - have lower risk of liability due to security breach
mappers
single loss expectancy
operational
due care
19. NIST risk management methodology
COSO
Information risk management
SP 800-30
OVAL
20. Control environment - company culture - Risk assessment - manage change - Control activities - policies - procedures - practices - Information and communication - right people - info - time - Monitoring - detect and respond
data owner
exposure factor
strategic
COSO
21. Potential danger to information or systems
ISO/IEC 27004
security program
administrative
threat
22. The tools - personnel and business processes necessary to ensure that security meets needs
security governanace
countermeasure
chief information security officer
confidentiality
23. __________ loss has a negative effect after a vulnerability is initially exploited
delayed
performance baseline
security program
firewall
24. A weakness (software - hardware - procedural - human) that can be exploited
john the ripper
vulnerability
ISO/IEC 27005
blueprints
25. The likelihood of exploitation and the loss potential
risk catagories
administrative
risk
CISO
26. Internationally recognized Information Security Management standard - provides high level conceptual recomendations on enterprise security - brish standard
strategic
technical
BS7799
ISO/IEC 27002
27. Long-term goals focused on risk managment - compliance - security responsiblities - continual improvement - using security to attract customers
strategic
corporate security officer
ISO/IEC 27004
elcomsoft
28. The asset's value multiplied by the EF percentage - (SLE)
single loss expectancy
vulnerability scanner
ISO 17799
L0phtCrack
29. A tool that monitors network traffic - shows data and protocols in use - also known as a packet sniffer (i.e wireshark - TCPDump - Microsoft Network Monitor - Carnivore)
protocol analyzer
CobiT
blueprints
vulnerability
30. Method of ID functions and their failures - causes of failures their effect - originally designed for systems engineering
administrative
FMEA
IRM
port scanner
31. OCTAVE
confidentiality
COSO
risk analysis
Operationally Critical Threat - Asset - and Vulnerability Evaluation
32. Controls that manage facility access - locking systems - media sanitation - intrusion monitoring - environmental
security program
COSO
physical
IRM
33. Plan and Organize - Acquire and Implement - Deliver and Support - Monitor and Evaluate
single loss expectancy
mappers
CobiT
data owner
34. Provides a cost/benefit comparision
port scanner
FRAP
risk analysis
Information Security Management
35. IT governance at the operational level
security program
CobiT
port scanner
Information Security Management
36. FMEA
Information Security Management
chief information security officer
Failure Modes and Effect Analysis
john the ripper
37. Assurance of accurancy and reliability of information and systems
FMEA
CobiT
integrity
planning horizon
38. Physical damage - human interaction - equip malfunction - misuse of data - loss of data - application error
physical
risk catagories
performance baseline
Operationally Critical Threat - Asset - and Vulnerability Evaluation
39. Daily goals focused on productivity and task-oriented activities
operational
elcomsoft
vulnerability
annualized loss expectancy
40. The following tools (Nessus - Qualys - Retina) are ______________ scanners
risk
vulnerability
delayed
administrative
41. CSO
Facilitated Risk Analysis Process
network mapping
threat
corporate security officer
42. Hp OpenView - Nmap - Qualys - Solana Networks - SolarWinds are all network _____________
CobiT
Information Security Management
L0phtCrack
mappers
43. This type of testing scans for vulnerabilities - attacks to determine extent - tests countermeasures by circumvention - and can be internal or external
network mapping
penetration
exposure
port scanner
44. Responsible for communicating to senior mgmt organizational risks and compliance regulations
exposure
ITIL
CISO
network mapping
45. CobiT
network mapping
ISO 17799
administrative
Control Objectives for Information and related Technology
46. Guide to illustrate how to protect personal health information
ISO/IEC 27799
tactical
risk
countermeasure
47. Port scanners - vulnerability scanners - protocol analyzers - password crackers - network mappers - open vulnerability and assessment language (OVAL) are all tool used in a ___________________ assessment
FRAP
vulnerability
CobiT
elcomsoft
48. Mitigates a potential risk
countermeasure
vulnerability
administrative
administrative
49. Guide assist in the implemenation of information security based on risk managent approach
risk catagories
ISO/IEC 27005
administrative
Committee of Sponsoring Organizations
50. Midterm goals
OVAL
blueprints
tactical
security program