SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
CISM: Certified Information Security Manager
Start Test
Study First
Subjects
:
certifications
,
cism
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. When developing an information security program _________________ would help identify the available resources - any gaps and the training requirements for developing resources.
Information security manager
Assess the risks to the business operation
Continuous analysis - monitoring and feedback
Skills inventory
2. S small warehouse - designed for the end-user needs in a strategic business unit
Data classification
Single sign-on (SSO) product
Data mart
Asset classification
3. An internal review of a web-based application system finds the ability to gain access to all employees' accounts by changing the employee's ID on the URL used for accessing the account. It means _____________.
Patch management
The authentication process is broken
Penetration testing
Threat assessment
4. In assessing the degree to which an organization may be affected by new privacy legislation - information security management should first _____________________.
Notifications and opt-out provisions
Overall organizational structure
Identify the relevant systems and processes
Cryptographic secure sockets layer (SSL) implementations and short key lengths
5. Warranted in circumstances where compliance may be difficult or impossible and the risk of noncompliance is outweighed by the benefits.
Defined objectives
Exceptions to policy
Aligned with organizational goals
Penetration testing
6. Ultimately responsible for all that happens in the organization. The others are not individually liable for failures of security in the organization.
Lack of change management
Personal firewall
The board of directors and senior management
Multinational organization
7. Cannot be minimized
Inherent risk
Data mart
Asset classification
Deeper level of analysis
8. It is more efficient to establish a ___________________for locations that must meet specific requirements.
Baseline standard and then develop additional standards
Prioritization
Owner of the information asset
Defined objectives
9. When mobile equipment is lost or stolen - the ______________________ matters most in determining the impact of the loss.
Information contained on the equipment
Applying the proper classification to the data
Get senior management onboard
Calculating the value of the information or asset
10. Program that copies itself repeatedly - using up resources and possibly shutting down the computer or network
Control effectiveness
Residual risk
Is willing to accept
Worm
11. Most effective for evaluating the degree to which information security objectives are being met.
Cost of control
The balanced scorecard
Encryption key management
0-day vulnerabilities
12. An effective tool but primarily focuses on malicious code from external sources - and only for those applications that are online.
Security baselines
Virus detection
Continuous analysis - monitoring and feedback
Script kiddie
13. It is important to achieve ____________________ - and obtain inputs from various organizational entities since security needs to be aligned to the needs of the organization.
What happened and how the breach was resolved
Consensus on risks and controls
include security responsibilities in a job description
Reduce risk to an acceptable level
14. Change management controls the _____________________. This is often the point at which a weakness will be introduced.
MAL wear
Process of introducing changes to systems
Penetration testing
The data owner
15. Responsible for assigning user entitlements and approving access to the systems for which they are responsible.
Data owners
Process of introducing changes to systems
Patch management
Security baselines
16. Addresses strengths - weaknesses - opportunities and threats. Although useful - a SWOT analysis is not as effective a tool.
SWOT analysis
Support the business objectives of the organization
Logon banners
Is willing to accept
17. Also required to guarantee fulfillment of laws and regulations of the organization and - therefore - the information security manager will be obligated to comply with the law.
A network vulnerability assessment
Defining and ratifying the classification structure of information assets
Monitoring processes
Knowledge management
18. Provides process needs but not impact.
Resource dependency assessment
Encryption key management
Consensus on risks and controls
Malicious software and spyware
19. Ensures that there are no scalability problems.
Stress testing
Data mart
Role-based policy
Is willing to accept
20. The primary role of the information security manager in the process of information classification within the organization.
Platform security - intrusion detection and antivirus controls
Waterfall chart
Gain unauthorized access to applications
Defining and ratifying the classification structure of information assets
21. Identification and _______________ of business risk enables project managers to address areas with most significance.
Aligned with organizational goals
Prioritization
Identify the relevant systems and processes
include security responsibilities in a job description
22. A trusted third party that attests to the identity of the signatory - and reliance will be a function of the level of trust afforded the CA.
Penetration testing
Certificate authority (CA)
Its ability to reduce or eliminate business risks
Cryptographic secure sockets layer (SSL) implementations and short key lengths
23. Requires a process to verify that the control process worked as intended. Examples such as dual-control or dual-entry bookkeeping provide verification and assurance that the process operated as intended.
Cyber extortionist
The balanced scorecard
Control effectiveness
Asset classification
24. Responsible for securing the information.
The data custodian
Alignment with business strategy
Digital certificate
People
25. Program that hides within or looks like a legit program
Trojan horse
Rule-based access control
Risk management and the requirements of the organization
Spoofing attacks
26. Needs to define the access rules - which is troublesome and error prone in large organizations.
Information contained on the equipment
Power surge/over voltage (spike)
Rule-based access control
BIA (Business Impact Assessment
27. Information security architecture should always be _______________________. Alignment with IT plans or industry and security best practices is secondary by comparison.
Defining high-level business security requirements
Decentralization
Properly aligned with business goals and objectives
Certificate authority (CA)
28. By definition are not previously known and therefore are undetectable.
Defining high-level business security requirements
0-day vulnerabilities
Equal error rate (EER)
Increase business value and confidence
29. The risk that remains after putting into place an effective risk management program; therefore - acceptable risk is achieved when this amount is minimized.
Residual risk
Gain unauthorized access to applications
Centralization of information security management
Access control matrix
30. Inject malformed input.
Applying the proper classification to the data
Malicious software and spyware
Role-based policy
Cross-site scripting attacks
31. Scam in which a perpetrator sends an official looking email message that attempts to obtain your personal and financial information
Virus
Retention of business records
Phishing
Notifications and opt-out provisions
32. Without _____________________ - there cannot be accountability.
Well-defined roles and responsibilities
Defining and ratifying the classification structure of information assets
Methodology used in the assessment
Role-based policy
33. Only valid if assets have first been identified and appropriately valued.
Logon banners
Virus detection
Comparison of cost of achievement
Annual loss expectancy (ALE)calculations
34. Attackers who exploit weak application authentication controls can ___________________ and this has little to do with cross-site scripting vulnerabilities.
Role-based access control
Defining high-level business security requirements
Identify the relevant systems and processes
Gain unauthorized access to applications
35. The _____________________ should be the person with the decision-making power in the department deriving the most benefit from the asset.
Cracker
Its ability to reduce or eliminate business risks
Logon banners
Owner of the information asset
36. The best strategy for risk management is to ___________________- as this will take into account the organization's appetite for risk and the fact that it would not be practical to eliminate all risk.
Reduce risk to an acceptable level
Trusted source
Overall organizational structure
Encryption key management
37. Occurs when the electrical supply drops
Patch management process
Undervoltage (brownout)
People
Single sign-on (SSO) product
38. Residual risk is unmanaged - i.e. - inherent risk which remains uncontrolled. This is key to the organization's _____________ and is the amount of residual risk that a business is living with that affects its viability.
Negotiating a local version of the organization standards
Risk appetite
Risk assessment - evaluation and impact analysis
Monitoring processes
39. The weakest link in security implementation - and awareness would reduce this risk. Through security awareness and training programs - individual employees can be informed and sensitized on various security policies and other security topics - thus e
Information contained on the equipment
People
Data warehouse
Spoofing attacks
40. Company or person you believe will not send a virus-infect file knowingly
Trusted source
Comparison of cost of achievement
Rule-based access control
Gap analysis
41. Has to be integrated into the requirements of every software application's design.
Key controls
Resource dependency assessment
Encryption key management
MAL wear
42. Should be a standard requirement for the service provider.
Background check
Deeper level of analysis
Residual risk would be reduced by a greater amount
Background checks of prospective employees
43. Lists only the vulnerabilities inherent in the information asset that can attract threats. It does not consider the value of the asset and the impact of perceived threats on the value.
Nondisclosure agreement (NDA)
MAL wear
Continuous analysis - monitoring and feedback
Vulnerability assessment
44. The information security manager needs to prioritize the controls based on ________________________.
Its ability to reduce or eliminate business risks
The balanced scorecard
Risk management and the requirements of the organization
Overall organizational structure
45. Has full responsibility over data.
Performing a risk assessment
The data owner
Consensus on risks and controls
Strategic alignment of security with business objectives
46. Utility program that detects and protects a personal computer from unauthorized intrusions
The database administrator
Vulnerability assessment
Process of introducing changes to systems
Personal firewall
47. Used to understand the flow of one process into another.
The balanced scorecard
Penetration testing
Waterfall chart
0-day vulnerabilities
48. The MOST effective approach to address issues that arise between IT management - business units and security management when implementing a new security strategy is for the information security manager to ____________________ with any security recomm
Knowledge management
Get senior management onboard
BIA (Business Impact Assessment
Security risk
49. The _____________________is a severe omission and will greatly increase information security risk. Presents the GREATEST information security risk for an organization with multiple - but small - domestic processing locations
Malicious software and spyware
Transferred risk
Performing a risk assessment
Lack of change management
50. Should PRIMARILY be based on regulatory and legal requirements.
Logon banners
The data owner
Retention of business records
Malicious software and spyware