Test your basic knowledge |

Comptia Security +: Assessment And Risk Mgmt

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Controls that implement access control - password mangement - identification and authentication methods - configuration






2. Midterm goals






3. Possiblity of damage and the ramifications should it occur






4. Framework/set of best practices that define goals for controls used to properly manage IT and to ensure IT maps to business needs






5. Port scanners - vulnerability scanners - protocol analyzers - password crackers - network mappers - open vulnerability and assessment language (OVAL) are all tool used in a ___________________ assessment






6. Provides good practice advice on ISMS (ISO 17799)(based on BS7799 Part 1)






7. A quantative risk assesment process that allows for tests to be conducted to allow users to determine areas that require a risk analysis






8. Made up of ten domains - a mechanism to describe security processes






9. Assurance of accurancy and reliability of information and systems






10. Information security managment measurements






11. Process of ID and assessing risk - reducing to acceptable level - implementing mechanisms to maintain.






12. ____________ can discover network devices / application - check password strength - measure internal / external access - analyze vulnerabilities in NOS - test response to DOS attacks






13. NIST risk management methodology






14. Used in assurance risk mgmt - methodical way to ID major failure modes (not useful for complex failure modes)






15. Used to ID failures in a complex systems to understand underlying causes of threats






16. Ensures necessary level of secrecy and prevents unauthorized disclosure






17. Controls that include policies - standards - procedures -risk management - personnel screening - training - change control






18. Percentage of an asset's value that would be lost in a single incident - (EF)






19. Tools to ID - develop - and design security requirements for business needs






20. Corporate governance at the strategic level






21. Strategic - tactical and operational planning






22. The asset's value multiplied by the EF percentage - (SLE)






23. ISM Standard






24. Risk assessment that is scenario based - ranks threats and countermeasures - uses experience - judgment - intuition and opinion






25. Plan and Organize - Implement - Operate and Maintain - Monitor and Evaluate






26. Responsible for information classification and protection






27. Potential danger to information or systems






28. Risk mgmt method created by Carnegie Mellon University - people manage/direct the risk evaluation for IT security in a company






29. The following tools (Nessus - Qualys - Retina) are ______________ scanners






30. Provides a cost/benefit comparision






31. Risk mgmt method with much broader focus than IT security






32. COSO






33. __________ loss has a negative effect after a vulnerability is initially exploited






34. Security policy - map business objectives to security - Security infrastructure - security officer - reviews - Assest classification/control - inventory - Personnel security - screening - training - roles - Physical security - Communication/operation






35. Event levels available for logging in a MS DNS server






36. Establish - implement - control and improve the Information Security Managment System (based on BS7799 Part 2)






37. Guide assist in the implemenation of information security based on risk managent approach






38. An instance of being exposed to losses from a threat






39. Collection of controls an organization must have in place






40. Long-term goals focused on risk managment - compliance - security responsiblities - continual improvement - using security to attract customers






41. Responsible for developing: security awareness program - budget for information security related activities; policies - procdures - and guidelines - a security compliance program - and metrics






42. Type of audit that checks procedures and policies for escalating issues to management






43. An open source password cracker that uses dictionary and brute force attacks - stores previously cracked passwords - uses unshadow to merge password /shadow files






44. Method of ID functions and their failures - causes of failures their effect - originally designed for systems engineering






45. FMEA






46. IT governance at the operational level






47. Daily goals focused on productivity and task-oriented activities






48. IRM






49. A weakness (software - hardware - procedural - human) that can be exploited






50. Controls that manage facility access - locking systems - media sanitation - intrusion monitoring - environmental