Test your basic knowledge |

CISM: Certified Information Security Manager

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. The job of the information security officer on a management team is to ___________________.






2. A trusted third party that attests to the identity of the signatory - and reliance will be a function of the level of trust afforded the CA.






3. Logging as well as monitoring - measuring - auditing - detecting viruses and intrusion.






4. Same intent as a cracker but does not have the technical skills and knowledge






5. Should PRIMARILY be based on regulatory and legal requirements.






6. Has full responsibility over data.






7. Using public key infrastructure (PKI) is currently accepted as the most secure method to _____________.






8. Used to understand the flow of one process into another.






9. Lists only the threats that the information asset is exposed to. It does not consider the value of the asset and impact of the threat on the value.






10. Program that copies itself repeatedly - using up resources and possibly shutting down the computer or network






11. An organization without any formal information security program should start with _______________________ because the implementation should be based on those security requirements.






12. Ensures that there are no scalability problems.






13. Inject malformed input.






14. It is more efficient to establish a ___________________for locations that must meet specific requirements.






15. Focuses on identifying vulnerabilities.






16. The best measure and will involve reviewing the entire source code to detect all instances of back doors.






17. Responsible for securing the information.






18. Would reduce the possibility of an individual accidentally pressing the power button on a device - thereby turning off the device.






19. Requires a process to verify that the control process worked as intended. Examples such as dual-control or dual-entry bookkeeping provide verification and assurance that the process operated as intended.






20. A method for analyzing and reducing a relational database to its most streamlined form






21. A process that helps organizations manipulate important knowledge that is part of the orgs. memory






22. A Successful risk management should lead to a ________________.






23. Will prevent unauthorized access to the laptop even when the laptop is lost or stolen.






24. Information security governance models are highly dependent on the _____________________.






25. When developing an information security program _________________ would help identify the available resources - any gaps and the training requirements for developing resources.






26. A risk assessment should be conducted _________________.






27. A repository of historical data organized by subject to support decision makers in the org






28. Oversees the overall classification management of the information.






29. ecurity design flaws require a ____________________.






30. The best measure for preventing the unauthorized disclosure of confidential information.






31. provides the most effective protection of data on mobile devices.






32. Occurs when the incoming level






33. The most critical process for deciding which part of the information system/business process should be given prioritization in case of a security incident.It provides results - such as impact from a security incident and required response times.






34. The _____________________is a severe omission and will greatly increase information security risk. Presents the GREATEST information security risk for an organization with multiple - but small - domestic processing locations






35. An internal review of a web-based application system finds the ability to gain access to all employees' accounts by changing the employee's ID on the URL used for accessing the account. It means _____________.






36. Allows you to use field security personnel as security missionaries or ambassadors to spread the security awareness message. It allows security administrators to be more responsive.






37. The BEST way to justify the implementation of a _____________________ is to use a business case. Return on investment (ROI) would only provide the costs needed to preclude specific risks - and would not provide other indirect benefits such as process






38. Culture has a significant impact on how information security will be implemented in a ______________________.






39. When defining the information classification policy - the ___________________ need to be identified.






40. The most important characteristic of good security policies is that they be ____________________.






41. The weakest link in security implementation - and awareness would reduce this risk. Through security awareness and training programs - individual employees can be informed and sensitized on various security policies and other security topics - thus e






42. To improve the security governance framework and achieve a higher level of maturity _____________________ is most important.






43. Risk should be reduced to a level that an organization _____________.






44. The MOST important element of an information security strategy.






45. An effective tool but primarily focuses on malicious code from external sources - and only for those applications that are online.






46. Potentially damaging computer program that affects - or infects a computer negatively by altering the way the computer works






47. Programs that act without a user's knowledge and deliberately alter a computer's operations






48. Carries out the technical administration.






49. Provides an additional security mechanism over and above that provided by passwords alone. This is frequently used by mobile users needing to establish connectivity to a corporate network.






50. The risk that controls may not prevent/detect an incident with a measure of control effectiveness.