Test your basic knowledge |

CISM: Certified Information Security Manager

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. When developing an information security program _________________ would help identify the available resources - any gaps and the training requirements for developing resources.






2. S small warehouse - designed for the end-user needs in a strategic business unit






3. An internal review of a web-based application system finds the ability to gain access to all employees' accounts by changing the employee's ID on the URL used for accessing the account. It means _____________.






4. In assessing the degree to which an organization may be affected by new privacy legislation - information security management should first _____________________.






5. Warranted in circumstances where compliance may be difficult or impossible and the risk of noncompliance is outweighed by the benefits.






6. Ultimately responsible for all that happens in the organization. The others are not individually liable for failures of security in the organization.






7. Cannot be minimized






8. It is more efficient to establish a ___________________for locations that must meet specific requirements.






9. When mobile equipment is lost or stolen - the ______________________ matters most in determining the impact of the loss.






10. Program that copies itself repeatedly - using up resources and possibly shutting down the computer or network






11. Most effective for evaluating the degree to which information security objectives are being met.






12. An effective tool but primarily focuses on malicious code from external sources - and only for those applications that are online.






13. It is important to achieve ____________________ - and obtain inputs from various organizational entities since security needs to be aligned to the needs of the organization.






14. Change management controls the _____________________. This is often the point at which a weakness will be introduced.






15. Responsible for assigning user entitlements and approving access to the systems for which they are responsible.






16. Addresses strengths - weaknesses - opportunities and threats. Although useful - a SWOT analysis is not as effective a tool.






17. Also required to guarantee fulfillment of laws and regulations of the organization and - therefore - the information security manager will be obligated to comply with the law.






18. Provides process needs but not impact.






19. Ensures that there are no scalability problems.






20. The primary role of the information security manager in the process of information classification within the organization.






21. Identification and _______________ of business risk enables project managers to address areas with most significance.






22. A trusted third party that attests to the identity of the signatory - and reliance will be a function of the level of trust afforded the CA.






23. Requires a process to verify that the control process worked as intended. Examples such as dual-control or dual-entry bookkeeping provide verification and assurance that the process operated as intended.






24. Responsible for securing the information.






25. Program that hides within or looks like a legit program






26. Needs to define the access rules - which is troublesome and error prone in large organizations.






27. Information security architecture should always be _______________________. Alignment with IT plans or industry and security best practices is secondary by comparison.






28. By definition are not previously known and therefore are undetectable.






29. The risk that remains after putting into place an effective risk management program; therefore - acceptable risk is achieved when this amount is minimized.






30. Inject malformed input.






31. Scam in which a perpetrator sends an official looking email message that attempts to obtain your personal and financial information






32. Without _____________________ - there cannot be accountability.






33. Only valid if assets have first been identified and appropriately valued.






34. Attackers who exploit weak application authentication controls can ___________________ and this has little to do with cross-site scripting vulnerabilities.






35. The _____________________ should be the person with the decision-making power in the department deriving the most benefit from the asset.






36. The best strategy for risk management is to ___________________- as this will take into account the organization's appetite for risk and the fact that it would not be practical to eliminate all risk.






37. Occurs when the electrical supply drops






38. Residual risk is unmanaged - i.e. - inherent risk which remains uncontrolled. This is key to the organization's _____________ and is the amount of residual risk that a business is living with that affects its viability.






39. The weakest link in security implementation - and awareness would reduce this risk. Through security awareness and training programs - individual employees can be informed and sensitized on various security policies and other security topics - thus e






40. Company or person you believe will not send a virus-infect file knowingly






41. Has to be integrated into the requirements of every software application's design.






42. Should be a standard requirement for the service provider.






43. Lists only the vulnerabilities inherent in the information asset that can attract threats. It does not consider the value of the asset and the impact of perceived threats on the value.






44. The information security manager needs to prioritize the controls based on ________________________.






45. Has full responsibility over data.






46. Utility program that detects and protects a personal computer from unauthorized intrusions






47. Used to understand the flow of one process into another.






48. The MOST effective approach to address issues that arise between IT management - business units and security management when implementing a new security strategy is for the information security manager to ____________________ with any security recomm






49. The _____________________is a severe omission and will greatly increase information security risk. Presents the GREATEST information security risk for an organization with multiple - but small - domestic processing locations






50. Should PRIMARILY be based on regulatory and legal requirements.