Test your basic knowledge |

CISM: Certified Information Security Manager

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Applications cannot access data associated with other apps






2. If the firewall allows source routing - any outsider can carry out _________________ by stealing the internal (private) IP addresses of the organization.






3. On a company's e-commerce web site - a good legal statement regarding data privacy should include a statement regarding what the company will ___________________.






4. New security ulnerabilities should be managed through a ________________.






5. Accesses a computer or network illegally






6. When reporting an incident to senior management - the initial information to be communicated should include an explanation of _____________________ A summary of security logs would be too technical to report to senior management. An analysis of the i






7. Using public key infrastructure (PKI) is currently accepted as the most secure method to _____________.






8. Most effective for evaluating the degree to which information security objectives are being met.






9. The security manager would be most concerned with whether _____________________ than the cost of adding additional controls.






10. Attackers who exploit flawed ___________________________________ can sniff network traffic and crack keys to gain unauthorized access to information.






11. The first step in a risk analysis process to determine the impact to the organization - which is the ultimate goal.






12. A tool to be used in internal control assessment. KRI setup presents a threshold to alert management when controls are being compromised in business processes. This is a control tool rather than a maturity model support tool.






13. Effective and efficient in large user communities because it controls system access by the roles defined for groups of users. Users are assigned to the various roles and the system controls the access based on those roles.






14. Information security governance models are highly dependent on the _____________________.






15. Awareness training would most likely result in any attempted ____________ being challenged by the authorized employee






16. A function of the session keys distributed by the PKI.






17. Also required to guarantee fulfillment of laws and regulations of the organization and - therefore - the information security manager will be obligated to comply with the law.






18. Senior management commitment and support for information security can BEST be obtained through presentations that ____________________.






19. Would reduce the possibility of an individual accidentally pressing the power button on a device - thereby turning off the device.






20. Responsible for securing the information.






21. BEST option to improve accountability for a system administrator is to _____________________.






22. The MAIN reason why _______________ is important to a successful information security program is because classification determines the appropriate level of protection to the asset.






23. Adherence to local regulations must always be the priority. _______________________ is the most effective compromise in this situation.






24. __________________________ is of utmost importance. Understanding business objectives is critical in determining the security needs of the organization.






25. Attackers who exploit weak application authentication controls can ___________________ and this has little to do with cross-site scripting vulnerabilities.






26. Should be a standard requirement for the service provider.






27. When mobile equipment is lost or stolen - the ______________________ matters most in determining the impact of the loss.






28. The risk that controls may not prevent/detect an incident with a measure of control effectiveness.






29. Helps to define the minimum acceptable security that will be implemented to protect the information resources in accordance with the respective criticality levels.






30. Can be used to detect an external attack but would not help in authenticating a user attempting to connect.






31. Can be a standalone driver for an information security governance measure. No further analysis nor justification is required since the entity has no choice in the regulatory requirements.






32. Awareness - training and physical security defenses.






33. Results in greater uniformity and better adherence to security policies. It is generally less expensive to administer due to the economies of scale. However - turnaround can be slower due to the lack of alignment with business units.






34. The PRIMARY goal in developing an information security strategy is to: _________________________.






35. Involves the correction of software weaknesses and would necessarily follow change management procedures.






36. Useful but only with regard to specific technical skills.






37. Ensures that there are no scalability problems.






38. Programs that act without a user's knowledge and deliberately alter a computer's operations






39. A repository of historical data organized by subject to support decision makers in the org






40. Should PRIMARILY be based on regulatory and legal requirements.






41. The BEST way to justify the implementation of a _____________________ is to use a business case. Return on investment (ROI) would only provide the costs needed to preclude specific risks - and would not provide other indirect benefits such as process






42. A key indicator of performance measurement.






43. Without _____________________ - there cannot be accountability.






44. It is important to achieve ____________________ - and obtain inputs from various organizational entities since security needs to be aligned to the needs of the organization.






45. When considering the value of assets ______________________ would give the information security manager the MOST objective basis for measurement of value delivery in information security governance






46. Occurs when the incoming level






47. Because past performance is a strong predictor of future performance - _______________________ best prevents attacks from originating within an organization.






48. In biometric systems where the possibility of false rejects is a problem - it may be necessary to reduce sensitivity and thereby increase the number of false accepts.






49. Most effective in protecting classified data that have been encrypted to prevent disclosure and transmission outside the organization's network.






50. To improve the security governance framework and achieve a higher level of maturity _____________________ is most important.