Test your basic knowledge |

CISM: Certified Information Security Manager

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. When defining the information classification policy - the ___________________ need to be identified.






2. The most relevant piece of information to include in a cost-benefit analysis of a two-factor authentication system - it would establish a cost baseline and it must be considered for the full life cycle of the control. .






3. __________________________ is of utmost importance. Understanding business objectives is critical in determining the security needs of the organization.






4. The best strategy for risk management is to ___________________- as this will take into account the organization's appetite for risk and the fact that it would not be practical to eliminate all risk.






5. Computer that has duplicate components so it can continue to operate when one of its main components fail






6. The MOST important component of a privacy policy is: A Privacy policies must contain _______________; they are a high-level management statement of direction. They do not necessarily address warranties - liabilities or geographic coverage - which are






7. All within the responsibility of the information security manager.






8. The best measure and will involve reviewing the entire source code to detect all instances of back doors.






9. A key indicator of performance measurement.






10. Program that copies itself repeatedly - using up resources and possibly shutting down the computer or network






11. Lists only the threats that the information asset is exposed to. It does not consider the value of the asset and impact of the threat on the value.






12. In order to highlight to management the importance of network security - the security manager should FIRST _______________.






13. Awareness training would most likely result in any attempted ____________ being challenged by the authorized employee






14. btaining senior management support for establishing a warm site can BEST be accomplished by ____________________ - including a cost-benefit analysis - will be most persuasive to management. A risk assessment may be included in the business case - but






15. Utility program that detects and protects a personal computer from unauthorized intrusions






16. When developing an information security program _________________ would help identify the available resources - any gaps and the training requirements for developing resources.






17. Should be a standard requirement for the service provider.






18. Should PRIMARILY be based on regulatory and legal requirements.






19. On a company's e-commerce web site - a good legal statement regarding data privacy should include a statement regarding what the company will ___________________.






20. Primarily reduce risk and are most effective for the protection of information assets.






21. The PRIMARY goal in developing an information security strategy is to: _________________________.






22. Company or person you believe will not send a virus-infect file knowingly






23. The risk that has been assumed by a third party and may not necessarily be equal to the minimal form of residual risk.






24. Program that hides within or looks like a legit program






25. The MOST effective way to ensure network users are aware of their responsibilities to comply with an organization's security requirements is - ______________ would appear every time the user logs on - and the user would be required to read and agree






26. Ensure that transmitted information can be attributed to the named sender.






27. The MOST important element of the request for proposal (RFP) ro assess the maturity level of the organization's information security management is _______________________.






28. A notice that guarantees a user or a web site is legitimate






29. Reducing risk to a level too small to measure is _______________.






30. Awareness - training and physical security defenses.






31. Change management controls the _____________________. This is often the point at which a weakness will be introduced.






32. Because past performance is a strong predictor of future performance - _______________________ best prevents attacks from originating within an organization.






33. The first step in a risk analysis process to determine the impact to the organization - which is the ultimate goal.






34. Cannot be minimized






35. The best indicator of the level of compliance with the service level agreement ( SLA ) data confidentiality clauses.






36. Should be performed to identify the risk and determine needed controls.






37. The job of the information security officer on a management team is to ___________________.






38. To identify known vulnerabilities based on common misconfigurations and missing updates.






39. Someone who uses the internet or network to destroy or damage computers for political reasons






40. An effective tool but primarily focuses on malicious code from external sources - and only for those applications that are online.






41. The MOST important element of an information security strategy.






42. A process that helps organizations manipulate important knowledge that is part of the orgs. memory






43. Normally addressed through antivirus and antispyware policies.






44. Provides process needs but not impact.






45. The _____________________is a severe omission and will greatly increase information security risk. Presents the GREATEST information security risk for an organization with multiple - but small - domestic processing locations






46. Needs to define the access rules - which is troublesome and error prone in large organizations.






47. Residual risk is unmanaged - i.e. - inherent risk which remains uncontrolled. This is key to the organization's _____________ and is the amount of residual risk that a business is living with that affects its viability.






48. Adherence to local regulations must always be the priority. _______________________ is the most effective compromise in this situation.






49. A trusted third party that attests to the identity of the signatory - and reliance will be a function of the level of trust afforded the CA.






50. It is more efficient to establish a ___________________for locations that must meet specific requirements.