Test your basic knowledge |

CISM: Certified Information Security Manager

Subjects : certifications, cism, it-skills

Instructions:

Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. Program that hides within or looks like a legit program
The database administrator
Reduce risk to an acceptable level
Examples of containment defenses
Trojan horse

2. Involves the correction of software weaknesses and would necessarily follow change management procedures.
Cost of control
Detection defenses
Patch management
Annual loss expectancy (ALE)calculations

3. n a _________________________ - the annual cost of safeguards is compared with the expected cost of loss. This can then be used to justify a specific control measure.
Risk management and the requirements of the organization
Countermeasure cost-benefit analysis
Methodology used in the assessment
Notifications and opt-out provisions

4. The best strategy for risk management is to ___________________- as this will take into account the organization's appetite for risk and the fact that it would not be practical to eliminate all risk.
Annual loss expectancy (ALE)calculations
Reduce risk to an acceptable level
Identify the relevant systems and processes
Personal firewall

5. Ensure that transmitted information can be attributed to the named sender.
Security code reviews for the entire software application
Get senior management onboard
Digital signatures
All personnel

6. A trusted third party that attests to the identity of the signatory - and reliance will be a function of the level of trust afforded the CA.
Gain unauthorized access to applications
What happened and how the breach was resolved
Certificate authority (CA)
Gap analysis

7. Most effective in protecting classified data that have been encrypted to prevent disclosure and transmission outside the organization's network.
Safeguards over keys
Defining and ratifying the classification structure of information assets
Examples of containment defenses
The awareness and agreement of the data subjects

8. A process that helps organizations manipulate important knowledge that is part of the orgs. memory
What happened and how the breach was resolved
Phishing
Background checks of prospective employees
Knowledge management

9. Using public key infrastructure (PKI) is currently accepted as the most secure method to _____________.
OBusiness case development
Power surge/over voltage (spike)
Assess the risks to the business operation
Transmit e-mail messages

10. _______________ of the organization have the responsibility of ensuring information systems security this can include indirect personnel such as physical security personnel.
All personnel
Asset classification
Internal risk assessment
Acceptable use policies

11. Accesses a computer or network illegally
Developing an information security baseline
The board of directors and senior management
Negotiating a local version of the organization standards
Cracker

12. Applications cannot access data associated with other apps
Applying the proper classification to the data
Data isolation
Background checks of prospective employees
Increase business value and confidence

13. The MOST effective way to ensure network users are aware of their responsibilities to comply with an organization's security requirements is - ______________ would appear every time the user logs on - and the user would be required to read and agree
Creation of a business continuity plan
Security awareness training for all employees
Data warehouse
Logon banners

14. Any event or action that could cause a loss of or damage to computer hardware - software - data - information - or processing capability
Security risk
Methodology used in the assessment
Decentralization
Defining and ratifying the classification structure of information assets

15. The _____________________is a severe omission and will greatly increase information security risk. Presents the GREATEST information security risk for an organization with multiple - but small - domestic processing locations
Patch management
Certificate authority (CA)
Residual risk
Lack of change management

16. To determine sensitivity of assets in terms of risk to the business operation so that proportional countermeasures can be effectively implemented.
Baseline standard and then develop additional standards
Control risk
Classification of assets needs
Penetration testing

17. When considering the value of assets ______________________ would give the information security manager the MOST objective basis for measurement of value delivery in information security governance
Countermeasure cost-benefit analysis
Transferred risk
Increase business value and confidence
Comparison of cost of achievement

18. The best measure for preventing the unauthorized disclosure of confidential information.
Acceptable use policies
Certificate authority (CA)
Alignment with business strategy
The data custodian

19. The weakest link in security implementation - and awareness would reduce this risk. Through security awareness and training programs - individual employees can be informed and sensitized on various security policies and other security topics - thus e
Countermeasure cost-benefit analysis
Role-based policy
People
Background checks of prospective employees

20. The MOST important component of a privacy policy is: A Privacy policies must contain _______________; they are a high-level management statement of direction. They do not necessarily address warranties - liabilities or geographic coverage - which are
Notifications and opt-out provisions
Use of security metrics
Public key infrastructure (PKI)
Vulnerability assessment

21. The BEST justification to convince management to invest in an information security program is that doing so would _________________.
Risk appetite
Increase business value and confidence
Biometric access control systems
Threat assessment

22. S small warehouse - designed for the end-user needs in a strategic business unit
Data mart
Access control matrix
Conduct a risk assessment
The database administrator

23. The risk that controls may not prevent/detect an incident with a measure of control effectiveness.
Data isolation
Control risk
A network vulnerability assessment
Patch management

24. In biometric systems where the possibility of false rejects is a problem - it may be necessary to reduce sensitivity and thereby increase the number of false accepts.
Identify the relevant systems and processes
Protective switch covers
Applying the proper classification to the data
Equal error rate (EER)

25. Carries out the technical administration.
Audit objectives
Attributes and characteristics of the 'desired state'
Encryption key management
The database administrator

26. May show the performance result of the security related activities; however - the result is interpreted in terms of money and extends to multiple facets of security initiatives.
Platform security - intrusion detection and antivirus controls
Return on security investment (ROSI)
SWOT analysis
Spoofing attacks

27. Programs that act without a user's knowledge and deliberately alter a computer's operations
Negotiating a local version of the organization standards
MAL wear
Trusted source
Security awareness training for all employees

28. It is easier to manage and control a _________________.
Cracker
Stress testing
Centralized structure
Key controls

29. Needs to define the access rules - which is troublesome and error prone in large organizations.
Access control matrix
Penetration testing
Rule-based access control
Certificate authority (CA)

30. Would reduce the possibility of an individual accidentally pressing the power button on a device - thereby turning off the device.
Gain unauthorized access to applications
Protective switch covers
Do with the information it collects
Consensus on risks and controls

31. Lists only the threats that the information asset is exposed to. It does not consider the value of the asset and impact of the threat on the value.
Knowledge management
Trojan horse
Digital signatures
Threat assessment

32. The primary role of the information security manager in the process of information classification within the organization.
Calculating the value of the information or asset
Equal error rate (EER)
Defining and ratifying the classification structure of information assets
Well-defined roles and responsibilities

33. To improve the security governance framework and achieve a higher level of maturity _____________________ is most important.
Platform security - intrusion detection and antivirus controls
Access control matrix
Public key infrastructure (PKI)
Continuous analysis - monitoring and feedback

34. The most fundamental evaluation criteria for the appropriate selection of any security technology is ________________________.
Single sign-on (SSO) product
Its ability to reduce or eliminate business risks
Background check
Use of security metrics

35. A tool to be used in internal control assessment. KRI setup presents a threshold to alert management when controls are being compromised in business processes. This is a control tool rather than a maturity model support tool.
Key risk indicator (KRI) setup
Digital signatures
Threat assessment
Worm

36. Potentially damaging computer program that affects - or infects a computer negatively by altering the way the computer works
Phishing
Virus
Role-based policy
Data isolation

37. Also required to guarantee fulfillment of laws and regulations of the organization and - therefore - the information security manager will be obligated to comply with the law.
include security responsibilities in a job description
Monitoring processes
Patch management
Rule-based access control

38. Would protect against spoofing an internal address but would not provide strong authentication.
Acceptable use policies
Rule-based access control
Multinational organization
IP address packet filtering

39. _________________________ will allow the information security manager to prioritize the remedial measures and provide a means to convey a sense of urgency to management.
Inherent risk
Patch management
Performing a risk assessment
Knowledge management

40. The starting point for driving management's attention to information security. All other choices will follow the risk assessment.
The board of directors and senior management
Risk assessment - evaluation and impact analysis
Risk appetite
Tailgating

41. Should be a standard requirement for the service provider.
Biometric access control systems
The information security officer
Background check
Cost of control

42. Logging as well as monitoring - measuring - auditing - detecting viruses and intrusion.
Detection defenses
Monitoring processes
Two-factor authentication
The board of directors and senior management

43. Information security governance models are highly dependent on the _____________________.
Gap analysis
Overall organizational structure
Gain unauthorized access to applications
Vulnerability assessment

44. The MOST important element of an information security strategy.
Background checks of prospective employees
Patch management
Annual loss expectancy (ALE)calculations
Defined objectives

45. An internal review of a web-based application system finds the ability to gain access to all employees' accounts by changing the employee's ID on the URL used for accessing the account. It means _____________.
Developing an information security baseline
Nondisclosure agreement (NDA)
The authentication process is broken
Support the business objectives of the organization

46. The job of the information security officer on a management team is to ___________________.
Risk appetite
Assess the risks to the business operation
Risk management and the requirements of the organization
Centralized structure

47. Will prevent unauthorized access to the laptop even when the laptop is lost or stolen.
Developing an information security baseline
Confidentiality
Compliance with the organization's information security requirements
Encryption of the hard disks

48. Requires a process to verify that the control process worked as intended. Examples such as dual-control or dual-entry bookkeeping provide verification and assurance that the process operated as intended.
Fault-tolerant computer
Aligned with organizational goals
Total cost of ownership (TCO)
Control effectiveness

49. Helps to define the minimum acceptable security that will be implemented to protect the information resources in accordance with the respective criticality levels.
Attributes and characteristics of the 'desired state'
Single sign-on (SSO) product
Developing an information security baseline
Owner of the information asset

50. A function of the session keys distributed by the PKI.
Risk management and the requirements of the organization
Confidentiality
Cost of control
Waterfall chart