SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Assessment And Risk Mgmt
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Percentage of an asset's value that would be lost in a single incident - (EF)
escalation
risk
risk catagories
exposure factor
2. De facto standard of best practices for IT service mgmt
Information Technology Infrastructure Library (ITIL)
vulnerability
ITIL
FMEA
3. A log that can record outgoing requests - incoming traffic - and internet usage
firewall
risk
IRM
COSO
4. Establish - implement - control and improve the Information Security Managment System (based on BS7799 Part 2)
CobiT
privilege
ISO/IEC 27001
risk
5. Provides a cost/benefit comparision
risk analysis
blueprints
corporate security officer
AS/NZS 4360
6. Controls that manage facility access - locking systems - media sanitation - intrusion monitoring - environmental
performance monitor
physical
integrity
annualized loss expectancy
7. Process of ID and assessing risk - reducing to acceptable level - implementing mechanisms to maintain.
IRM
delayed
privilege
john the ripper
8. Information security managment measurements
port scanner
ISO/IEC 27004
technical
network mapping
9. Long-term goals focused on risk managment - compliance - security responsiblities - continual improvement - using security to attract customers
security governanace
usage
john the ripper
strategic
10. NIST risk management methodology
administrative
usage
SP 800-30
Information risk management
11. Tools to ID - develop - and design security requirements for business needs
blueprints
IRM
CobiT
protocol analyzer
12. Method of ID functions and their failures - causes of failures their effect - originally designed for systems engineering
due care
FMEA
CobiT
technical
13. Mitigates a potential risk
COSO
AS/NZS 4360
countermeasure
vulnerability
14. A tool that monitors network traffic - shows data and protocols in use - also known as a packet sniffer (i.e wireshark - TCPDump - Microsoft Network Monitor - Carnivore)
CobiT
AS/NZS 4360
escalation
protocol analyzer
15. IT governance at the operational level
risk
CobiT
escalation
No events - Errors only - Errors and warnings - All events
16. FRAP
Facilitated Risk Analysis Process
ISO/IEC 27005
No events - Errors only - Errors and warnings - All events
COSO
17. Responsible for developing: security awareness program - budget for information security related activities; policies - procdures - and guidelines - a security compliance program - and metrics
administrative
planning horizon
L0phtCrack
CISO
18. COSO
administrative
Control Objectives for Information and related Technology
Committee of Sponsoring Organizations
COSO
19. Type of audit that checks information classification and change control procedures
COSO
corporate security officer
annualized rate of occurrence
administrative
20. Used to ID failures in a complex systems to understand underlying causes of threats
due care
fault tree analysis
confidentiality
Facilitated Risk Analysis Process
21. Developed by the Treadway Commission in 1985 to deal with fraudulent financial activities and reporting
planning horizon
COSO
blueprints
IRM
22. Guide to illustrate how to protect personal health information
qualitative
security program
ISO/IEC 27799
performance monitor
23. Control environment - company culture - Risk assessment - manage change - Control activities - policies - procedures - practices - Information and communication - right people - info - time - Monitoring - detect and respond
threat
COSO
OCTAVE
escalation
24. A weakness (software - hardware - procedural - human) that can be exploited
protocol analyzer
data owner
vulnerability
single loss expectancy
25. CSO
Information risk management
usage
security officer
corporate security officer
26. Port scanners - vulnerability scanners - protocol analyzers - password crackers - network mappers - open vulnerability and assessment language (OVAL) are all tool used in a ___________________ assessment
blueprints
vulnerability
qualitative
vulnerability scanner
27. Assurance of accurancy and reliability of information and systems
integrity
L0phtCrack
Information Technology Infrastructure Library (ITIL)
delayed
28. CISO
CobiT
AS/NZS 4360
chief information security officer
delayed
29. Ensures reliable timely access to data/resources to authorized individuals
CISO
ISO/IEC 27004
availability
COSO
30. Ensures managment security directives are fulfilled
AS/NZS 4360
COSO
security officer
exposure factor
31. Strategic - tactical and operational planning
annualized rate of occurrence
planning horizon
security program
risk mitigation
32. Controls that implement access control - password mangement - identification and authentication methods - configuration
strategic
privilege
technical
countermeasure
33. ____________ can discover network devices / application - check password strength - measure internal / external access - analyze vulnerabilities in NOS - test response to DOS attacks
vulnerability
network mapping
CobiT
ISO/IEC 27001
34. OCTAVE
risk
Operationally Critical Threat - Asset - and Vulnerability Evaluation
Information risk management
risk analysis
35. IRM
security officer
Facilitated Risk Analysis Process
ISO/IEC 27799
Information risk management
36. Framework/set of best practices that define goals for controls used to properly manage IT and to ensure IT maps to business needs
exposure factor
port scanner
CobiT
security officer
37. Type of audit that checks that accounts - groups and roles are correctly assigned
Information risk management
administrative
vulnerability
privilege
38. Risk mgmt method created by Carnegie Mellon University - people manage/direct the risk evaluation for IT security in a company
OCTAVE
confidentiality
network mapping
ISO/IEC 27799
39. A commercial password cracker that can test password strength and recover passwords; and perform dictionary and brute force attacks
CobiT
AS/NZS 4360
CobiT
elcomsoft
40. Midterm goals
tactical
Information Security Management
AS/NZS 4360
security program
41. Ensures necessary level of secrecy and prevents unauthorized disclosure
Control Objectives for Information and related Technology
network mapping
confidentiality
CobiT
42. An open source password cracker that uses dictionary and brute force attacks - stores previously cracked passwords - uses unshadow to merge password /shadow files
delayed
CobiT
john the ripper
countermeasure
43. A plan of action to deal with risks defined in the risk assessment - may remediate or transfer risk
countermeasure
risk anlysis
risk mitigation
port scanner
44. Number of time the incident might occur annually - (ARO)
protocol analyzer
Committee of Sponsoring Organizations
annualized rate of occurrence
ISO/IEC 27004
45. SLE x ARO - (ALE)
COSO
SP 800-30
annualized loss expectancy
protocol analyzer
46. __________ loss has a negative effect after a vulnerability is initially exploited
due care
delayed
physical
security program
47. The tools - personnel and business processes necessary to ensure that security meets needs
security governanace
CobiT
Information risk management
fault tree analysis
48. Plan and Organize - Implement - Operate and Maintain - Monitor and Evaluate
security program
OCTAVE
FMEA
ITIL
49. Internationally recognized Information Security Management standard - provides high level conceptual recomendations on enterprise security - brish standard
vulnerability
threat
BS7799
FRAP
50. Guide assist in the implemenation of information security based on risk managent approach
threat
confidentiality
security program
ISO/IEC 27005