SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Assessment And Risk Mgmt
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Developed by the Treadway Commission in 1985 to deal with fraudulent financial activities and reporting
administrative
COSO
network mapping
Operationally Critical Threat - Asset - and Vulnerability Evaluation
2. An open source password cracker that uses dictionary and brute force attacks - stores previously cracked passwords - uses unshadow to merge password /shadow files
john the ripper
ISO/IEC 27004
vulnerability
OVAL
3. Process of ID and assessing risk - reducing to acceptable level - implementing mechanisms to maintain.
integrity
qualitative
CISO
IRM
4. Used to ID failures in a complex systems to understand underlying causes of threats
chief information security officer
usage
fault tree analysis
ISO/IEC 27001
5. Type of audit that checks information classification and change control procedures
qualitative
administrative
risk
Information risk management
6. Risk assessment that is scenario based - ranks threats and countermeasures - uses experience - judgment - intuition and opinion
penetration
COSO
ISO/IEC 27005
qualitative
7. Midterm goals
qualitative
FMEA
tactical
ISO/IEC 27001
8. The following tools (Nessus - Qualys - Retina) are ______________ scanners
vulnerability
Facilitated Risk Analysis Process
COSO
Committee of Sponsoring Organizations
9. Long-term goals focused on risk managment - compliance - security responsiblities - continual improvement - using security to attract customers
tactical
strategic
CISO
CobiT
10. FRAP
risk
Facilitated Risk Analysis Process
risk
CobiT
11. Responsible for information classification and protection
CISO
ISO/IEC 27005
data owner
network mapping
12. A commercial password cracker that can test password strength and recover passwords; and perform dictionary and brute force attacks
risk anlysis
vulnerability scanner
strategic
elcomsoft
13. ____________ can discover network devices / application - check password strength - measure internal / external access - analyze vulnerabilities in NOS - test response to DOS attacks
network mapping
vulnerability
threat
FMEA
14. Responsible for developing: security awareness program - budget for information security related activities; policies - procdures - and guidelines - a security compliance program - and metrics
vulnerability
due care
CISO
OVAL
15. CISO
annualized loss expectancy
chief information security officer
confidentiality
ISO/IEC 27001
16. Information security managment measurements
blueprints
ISO/IEC 27004
chief information security officer
CobiT
17. Controls that implement access control - password mangement - identification and authentication methods - configuration
technical
performance baseline
OCTAVE
protocol analyzer
18. Risk mgmt method with much broader focus than IT security
exposure factor
single loss expectancy
ITIL
AS/NZS 4360
19. Strategic - tactical and operational planning
exposure
CobiT
planning horizon
privilege
20. Provides a cost/benefit comparision
ISO/IEC 27005
ISO/IEC 27001
FMEA
risk analysis
21. Ensures necessary level of secrecy and prevents unauthorized disclosure
confidentiality
AS/NZS 4360
network mapping
data owner
22. A process to ID assests and their value - ID vulnerabilities and threats - quantify probability and impact of threats - provide balance between impact and cost
risk anlysis
physical
security program
COSO
23. Possiblity of damage and the ramifications should it occur
risk
security program
Failure Modes and Effect Analysis
Operationally Critical Threat - Asset - and Vulnerability Evaluation
24. Tools to ID - develop - and design security requirements for business needs
integrity
blueprints
security officer
performance monitor
25. Internationally recognized Information Security Management standard - provides high level conceptual recomendations on enterprise security - brish standard
tactical
vulnerability
L0phtCrack
BS7799
26. Type of audit that checks that network resources - systems and software are used appropriately
Failure Modes and Effect Analysis
ITIL
usage
planning horizon
27. SLE x ARO - (ALE)
SP 800-30
annualized loss expectancy
elcomsoft
CISO
28. Control environment - company culture - Risk assessment - manage change - Control activities - policies - procedures - practices - Information and communication - right people - info - time - Monitoring - detect and respond
COSO
Facilitated Risk Analysis Process
due care
CISO
29. An open language from mitre.org for determining vulnerabilities and problems on computer systems
Operationally Critical Threat - Asset - and Vulnerability Evaluation
security program
OVAL
CISO
30. Physical damage - human interaction - equip malfunction - misuse of data - loss of data - application error
security governanace
No events - Errors only - Errors and warnings - All events
risk catagories
countermeasure
31. Used in assurance risk mgmt - methodical way to ID major failure modes (not useful for complex failure modes)
FMEA
COSO
administrative
elcomsoft
32. Mitigates a potential risk
john the ripper
countermeasure
ISO/IEC 27001
ISO 17799
33. This tool scans network devices listening for open ports - (i.e. Nmap - scanmetender - superscan - NHS nohack scanner)
No events - Errors only - Errors and warnings - All events
port scanner
risk analysis
usage
34. Percentage of an asset's value that would be lost in a single incident - (EF)
exposure factor
mappers
COSO
CobiT
35. A plan of action to deal with risks defined in the risk assessment - may remediate or transfer risk
risk mitigation
FMEA
elcomsoft
countermeasure
36. Framework/set of best practices that define goals for controls used to properly manage IT and to ensure IT maps to business needs
exposure
CobiT
strategic
security governanace
37. Ensures managment security directives are fulfilled
security officer
Information Security Management
availability
ISO/IEC 27002
38. Daily goals focused on productivity and task-oriented activities
L0phtCrack
operational
due care
security program
39. Potential danger to information or systems
CobiT
due care
CISO
threat
40. Risk mgmt method created by Carnegie Mellon University - people manage/direct the risk evaluation for IT security in a company
OCTAVE
administrative
IRM
risk anlysis
41. Guide assist in the implemenation of information security based on risk managent approach
threat
ISO/IEC 27005
ISO/IEC 27001
OCTAVE
42. De facto standard of best practices for IT service mgmt
ISO/IEC 27799
OCTAVE
Control Objectives for Information and related Technology
Information Technology Infrastructure Library (ITIL)
43. A weakness (software - hardware - procedural - human) that can be exploited
COSO
risk analysis
annualized loss expectancy
vulnerability
44. Method of ID functions and their failures - causes of failures their effect - originally designed for systems engineering
CobiT
AS/NZS 4360
FMEA
elcomsoft
45. Legal term used to determine liability - acting responsibly - have lower risk of liability due to security breach
AS/NZS 4360
usage
Information Technology Infrastructure Library (ITIL)
due care
46. Event levels available for logging in a MS DNS server
IRM
No events - Errors only - Errors and warnings - All events
countermeasure
Information Security Management
47. Controls that include policies - standards - procedures -risk management - personnel screening - training - change control
administrative
OCTAVE
performance monitor
exposure
48. A tool that monitors network traffic - shows data and protocols in use - also known as a packet sniffer (i.e wireshark - TCPDump - Microsoft Network Monitor - Carnivore)
firewall
ISO/IEC 27005
protocol analyzer
risk catagories
49. ISM Standard
No events - Errors only - Errors and warnings - All events
Information Security Management
strategic
OVAL
50. Corporate governance at the strategic level
OVAL
annualized loss expectancy
ISO/IEC 27001
COSO