Test your basic knowledge |

CISM: Certified Information Security Manager

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Ensures that there are no scalability problems.






2. provides the most effective protection of data on mobile devices.






3. The most important characteristic of good security policies is that they be ____________________.






4. The BEST way to justify the implementation of a _____________________ is to use a business case. Return on investment (ROI) would only provide the costs needed to preclude specific risks - and would not provide other indirect benefits such as process






5. A notice that guarantees a user or a web site is legitimate






6. Senior management commitment and support for information security can BEST be obtained through presentations that ____________________.






7. The primary role of the information security manager in the process of information classification within the organization.






8. Provide minimum recommended settings and do not prevent introduction of control weaknesses.'






9. Inject malformed input.






10. _______________ of the organization have the responsibility of ensuring information systems security this can include indirect personnel such as physical security personnel.






11. Should be determined from the risk assessment results.






12. On a company's e-commerce web site - a good legal statement regarding data privacy should include a statement regarding what the company will ___________________.






13. Residual risk is unmanaged - i.e. - inherent risk which remains uncontrolled. This is key to the organization's _____________ and is the amount of residual risk that a business is living with that affects its viability.






14. Focuses on identifying vulnerabilities.






15. When developing an information security program _________________ would help identify the available resources - any gaps and the training requirements for developing resources.






16. The most fundamental evaluation criteria for the appropriate selection of any security technology is ________________________.






17. Can be a standalone driver for an information security governance measure. No further analysis nor justification is required since the entity has no choice in the regulatory requirements.






18. An internal review of a web-based application system finds the ability to gain access to all employees' accounts by changing the employee's ID on the URL used for accessing the account. It means _____________.






19. Would protect against spoofing an internal address but would not provide strong authentication.






20. Whenever personal data are transferred across national boundaries; ________________________ are required.






21. Lists only the vulnerabilities inherent in the information asset that can attract threats. It does not consider the value of the asset and the impact of perceived threats on the value.






22. __________________________ is of utmost importance. Understanding business objectives is critical in determining the security needs of the organization.






23. Carries out the technical administration.






24. In assessing the degree to which an organization may be affected by new privacy legislation - information security management should first _____________________.






25. Involves the correction of software weaknesses and would necessarily follow change management procedures.






26. Awareness training would most likely result in any attempted ____________ being challenged by the authorized employee






27. While useful for identifying the difference between the current state and the desired future state - e.g. organization has to comply with recently published industry regulatory requirements compliance that potentially has high implementation costs -






28. The BEST justification to convince management to invest in an information security program is that doing so would _________________.






29. Cannot be minimized






30. Accesses a computer or network illegally






31. The starting point for driving management's attention to information security. All other choices will follow the risk assessment.






32. Change management controls the _____________________. This is often the point at which a weakness will be introduced.






33. Utility program that detects and protects a personal computer from unauthorized intrusions






34. There is a time lag between the time when a security vulnerability is first published - and the time when a patch is delivered. - The best protection is to _____________________ until a patch is installed.






35. Should be performed to identify the risk and determine needed controls.






36. The _____________________ should be the person with the decision-making power in the department deriving the most benefit from the asset.






37. Has full responsibility over data.






38. Reducing risk to a level too small to measure is _______________.






39. Computer that has duplicate components so it can continue to operate when one of its main components fail






40. In biometric systems where the possibility of false rejects is a problem - it may be necessary to reduce sensitivity and thereby increase the number of false accepts.






41. The best measure and will involve reviewing the entire source code to detect all instances of back doors.






42. Same intent as a cracker but does not have the technical skills and knowledge






43. A risk assessment should be conducted _________________.






44. S small warehouse - designed for the end-user needs in a strategic business unit






45. It is easier to manage and control a _________________.






46. Someone who uses email as a vehicle for extortion; send company threatening emails indicating they will expose confidential information - exploit security launch - etc.






47. When considering the value of assets ______________________ would give the information security manager the MOST objective basis for measurement of value delivery in information security governance






48. Only valid if assets have first been identified and appropriately valued.






49. The _____________________is a severe omission and will greatly increase information security risk. Presents the GREATEST information security risk for an organization with multiple - but small - domestic processing locations






50. An information security manager has to impress upon the human resources department the need for _____________________.