Test your basic knowledge |

CISM: Certified Information Security Manager

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. If the firewall allows source routing - any outsider can carry out _________________ by stealing the internal (private) IP addresses of the organization.






2. Will associate data access with the role performed by an individual - thus restricting access to data required to perform the individual's tasks.






3. Utility program that detects and protects a personal computer from unauthorized intrusions






4. When the ________________ is more than the cost of the risk - the risk should be accepted.






5. A Successful risk management should lead to a ________________.






6. Using public key infrastructure (PKI) is currently accepted as the most secure method to _____________.






7. Uses security metrics to measure the performance of the information security program.






8. Only valid if assets have first been identified and appropriately valued.






9. Can be used to detect an external attack but would not help in authenticating a user attempting to connect.






10. Should be performed to identify the risk and determine needed controls.






11. Residual risk is unmanaged - i.e. - inherent risk which remains uncontrolled. This is key to the organization's _____________ and is the amount of residual risk that a business is living with that affects its viability.






12. Oversees the overall classification management of the information.






13. Adherence to local regulations must always be the priority. _______________________ is the most effective compromise in this situation.






14. When defining the information classification policy - the ___________________ need to be identified.






15. By definition are not previously known and therefore are undetectable.






16. The best indicator of the level of compliance with the service level agreement ( SLA ) data confidentiality clauses.






17. Information security governance models are highly dependent on the _____________________.






18. Program that hides within or looks like a legit program






19. Allows you to use field security personnel as security missionaries or ambassadors to spread the security awareness message. It allows security administrators to be more responsive.






20. To identify known vulnerabilities based on common misconfigurations and missing updates.






21. Information security architecture should always be _______________________. Alignment with IT plans or industry and security best practices is secondary by comparison.






22. Can be a standalone driver for an information security governance measure. No further analysis nor justification is required since the entity has no choice in the regulatory requirements.






23. Culture has a significant impact on how information security will be implemented in a ______________________.






24. A risk assessment should be conducted _________________.






25. To determine sensitivity of assets in terms of risk to the business operation so that proportional countermeasures can be effectively implemented.






26. Used to understand the flow of one process into another.






27. Requires a process to verify that the control process worked as intended. Examples such as dual-control or dual-entry bookkeeping provide verification and assurance that the process operated as intended.






28. Someone who uses the internet or network to destroy or damage computers for political reasons






29. When reporting an incident to senior management - the initial information to be communicated should include an explanation of _____________________ A summary of security logs would be too technical to report to senior management. An analysis of the i






30. Normally addressed through antivirus and antispyware policies.






31. The job of the information security officer on a management team is to ___________________.






32. provides the most effective protection of data on mobile devices.






33. Ensure that transmitted information can be attributed to the named sender.






34. When mobile equipment is lost or stolen - the ______________________ matters most in determining the impact of the loss.






35. An information security manager has to impress upon the human resources department the need for _____________________.






36. The MOST useful way to describe the objectives in the information security strategy is through ______________________.


37. A notice that guarantees a user or a web site is legitimate






38. An organization without any formal information security program should start with _______________________ because the implementation should be based on those security requirements.






39. Attackers who exploit weak application authentication controls can ___________________ and this has little to do with cross-site scripting vulnerabilities.






40. Accesses a computer or network illegally






41. Helps to define the minimum acceptable security that will be implemented to protect the information resources in accordance with the respective criticality levels.






42. Are not infallible. When tuning the solution - one has to adjust the sensitivity level to give preference either to false reject rate (type I error rate) where the system will be more prone to err denying access to a valid user or erring and allowing






43. Provides process needs but not impact.






44. Risk should be reduced to a level that an organization _____________.






45. When developing an information security program _________________ would help identify the available resources - any gaps and the training requirements for developing resources.






46. Someone who accesses a computer or network illegally






47. Program that copies itself repeatedly - using up resources and possibly shutting down the computer or network






48. From a security standpoint - _______________________ is one of the most important topics that should be included in the contract with third-party service provider.


49. Inject malformed input.






50. A tool to be used in internal control assessment. KRI setup presents a threshold to alert management when controls are being compromised in business processes. This is a control tool rather than a maturity model support tool.