SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Assessment And Risk Mgmt
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A process to ID assests and their value - ID vulnerabilities and threats - quantify probability and impact of threats - provide balance between impact and cost
COSO
risk anlysis
blueprints
usage
2. Potential danger to information or systems
fault tree analysis
Information risk management
threat
annualized rate of occurrence
3. The asset's value multiplied by the EF percentage - (SLE)
single loss expectancy
risk anlysis
Information Technology Infrastructure Library (ITIL)
COSO
4. Control environment - company culture - Risk assessment - manage change - Control activities - policies - procedures - practices - Information and communication - right people - info - time - Monitoring - detect and respond
COSO
penetration
administrative
risk analysis
5. Midterm goals
operational
tactical
Operationally Critical Threat - Asset - and Vulnerability Evaluation
vulnerability
6. The likelihood of exploitation and the loss potential
Operationally Critical Threat - Asset - and Vulnerability Evaluation
usage
risk
IRM
7. The following tools (Nessus - Qualys - Retina) are ______________ scanners
strategic
CobiT
IRM
vulnerability
8. __________ loss has a negative effect after a vulnerability is initially exploited
SP 800-30
due care
delayed
CobiT
9. An open language from mitre.org for determining vulnerabilities and problems on computer systems
corporate security officer
risk mitigation
OVAL
threat
10. Tools to ID - develop - and design security requirements for business needs
exposure
blueprints
ITIL
network mapping
11. Percentage of an asset's value that would be lost in a single incident - (EF)
FMEA
Committee of Sponsoring Organizations
exposure factor
exposure
12. Developed by the Treadway Commission in 1985 to deal with fraudulent financial activities and reporting
Committee of Sponsoring Organizations
CISO
COSO
L0phtCrack
13. An password cracker that uses dictionary and brute force attacks - rainbow tables - can test password strength and recover passwords - was originally free - but now a commercial product
security program
COSO
L0phtCrack
CISO
14. Risk mgmt method created by Carnegie Mellon University - people manage/direct the risk evaluation for IT security in a company
security program
threat
OCTAVE
FMEA
15. Internationally recognized Information Security Management standard - provides high level conceptual recomendations on enterprise security - brish standard
performance baseline
risk
ISO/IEC 27002
BS7799
16. Provides good practice advice on ISMS (ISO 17799)(based on BS7799 Part 1)
exposure factor
usage
exposure
ISO/IEC 27002
17. An instance of being exposed to losses from a threat
elcomsoft
Operationally Critical Threat - Asset - and Vulnerability Evaluation
exposure
IRM
18. Possiblity of damage and the ramifications should it occur
risk
security program
security governanace
exposure factor
19. Risk mgmt method with much broader focus than IT security
network mapping
FMEA
AS/NZS 4360
L0phtCrack
20. Method of ID functions and their failures - causes of failures their effect - originally designed for systems engineering
risk analysis
physical
performance monitor
FMEA
21. Controls that manage facility access - locking systems - media sanitation - intrusion monitoring - environmental
security officer
physical
security program
operational
22. Responsible for information classification and protection
blueprints
data owner
physical
Operationally Critical Threat - Asset - and Vulnerability Evaluation
23. NIST risk management methodology
tactical
corporate security officer
risk analysis
SP 800-30
24. FRAP
security program
single loss expectancy
data owner
Facilitated Risk Analysis Process
25. Strategic - tactical and operational planning
planning horizon
CobiT
Facilitated Risk Analysis Process
corporate security officer
26. Focus on service level agreements between IT dept and internal customers
ITIL
data owner
exposure factor
Control Objectives for Information and related Technology
27. Provides a cost/benefit comparision
security governanace
vulnerability
risk analysis
COSO
28. IT governance at the operational level
vulnerability
ISO 17799
CobiT
ISO/IEC 27799
29. Risk assessment that is scenario based - ranks threats and countermeasures - uses experience - judgment - intuition and opinion
ISO/IEC 27799
Information risk management
qualitative
Committee of Sponsoring Organizations
30. A weakness (software - hardware - procedural - human) that can be exploited
Control Objectives for Information and related Technology
ISO 17799
CISO
vulnerability
31. Ensures managment security directives are fulfilled
Facilitated Risk Analysis Process
security program
security officer
FRAP
32. Guide assist in the implemenation of information security based on risk managent approach
AS/NZS 4360
Control Objectives for Information and related Technology
ISO/IEC 27005
single loss expectancy
33. Derived from the COSO framework
CobiT
ISO/IEC 27799
mappers
planning horizon
34. Collection of controls an organization must have in place
security program
COSO
risk
CobiT
35. CobiT
network mapping
vulnerability scanner
Control Objectives for Information and related Technology
countermeasure
36. FMEA
ISO/IEC 27004
risk
Failure Modes and Effect Analysis
COSO
37. Framework/set of best practices that define goals for controls used to properly manage IT and to ensure IT maps to business needs
CobiT
OCTAVE
Operationally Critical Threat - Asset - and Vulnerability Evaluation
blueprints
38. Type of audit that checks procedures and policies for escalating issues to management
escalation
CISO
risk anlysis
countermeasure
39. This tool scans network devices listening for open ports - (i.e. Nmap - scanmetender - superscan - NHS nohack scanner)
escalation
OCTAVE
port scanner
vulnerability
40. The tools - personnel and business processes necessary to ensure that security meets needs
security governanace
CISO
ISO/IEC 27001
CobiT
41. Responsible for communicating to senior mgmt organizational risks and compliance regulations
delayed
exposure factor
SP 800-30
CISO
42. Physical damage - human interaction - equip malfunction - misuse of data - loss of data - application error
strategic
FRAP
risk catagories
exposure factor
43. Used to predict changes based on trends - detect deviations - and watch events across multiple system components
ITIL
OCTAVE
performance monitor
strategic
44. COSO
availability
L0phtCrack
Committee of Sponsoring Organizations
tactical
45. A tool that maps weaknesses of systems / networks by scanning for ports - checking for applications - determining OS and patch level - and attempting exploits
vulnerability scanner
SP 800-30
escalation
risk
46. Assurance of accurancy and reliability of information and systems
integrity
IRM
mappers
port scanner
47. Daily goals focused on productivity and task-oriented activities
IRM
security program
blueprints
operational
48. Process of ID and assessing risk - reducing to acceptable level - implementing mechanisms to maintain.
CobiT
IRM
ISO/IEC 27002
countermeasure
49. CSO
OCTAVE
ISO 17799
corporate security officer
vulnerability
50. Type of audit that checks that accounts - groups and roles are correctly assigned
OCTAVE
privilege
Information risk management
ISO/IEC 27005