Test your basic knowledge |

CISSP Certified Information Systems Security Professional

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. The risk that remains after management implements internal controls - or some other response to risk - (Threats x Vulnerability x Asset Value) x Controls Gap = Residual Risk






2. A risk assessment method - measurable real money cost






3. Line noise that is superimposed on the supply circuit.






4. To reduce sudden rises in current






5. Long term knowledge building






6. The property that data meet with a priority expectation of quality and that the data can be relied upon.






7. A type of multitasking that allows for more even distribution of computing time among competing request






8. Amount of time for restoring a business process or function to normal operations without major loss






9. Initial surge of current






10. The first rating that requires security labels






11. OOP concept of an object at runtime






12. A peripheral data storage device that may be found inside a desktop or laptop as permanent storage solution. The hard disk may also be a transportable version and attached to a desktop or laptop.






13. Segmented memory addressing - encapsulation of objects - time multiplexing of shared resources - naming distinctions - and virtual mapping.






14. Try a list of words in passwords or encryption keys






15. To know more than one job






16. A program with an inappropriate second purpose






17. An opportunity for a threat to cause loss. (terminology that encompasses many recent risk terms)






18. Location to perform the business function






19. Line by line translation from a high level language to machine code






20. A tag of three or four letters - preceded by a period - which identifies a data file's format or the application used to create the file.






21. Hiding the fact that communication has occurred






22. Object based description of a single resource and the permission each subject






23. Siphoning out or leaking information by dumping computer files or stealing computer reports and tapes.






24. Layer 1 network device that is used to connect network segments together - but provides no traffic control (a concentrator).






25. Interception of a communication session by an attacker.






26. Uncleared buffers or media






27. People who interact with assets






28. Unsolicited commercial email






29. Uses a role-based method to determine access rights and permissions. Role based access control is based on the user's role and responsibilities within the company.






30. A test conducted on one or more components of a plan under actual operating conditions.






31. A list of team members and/or key players to be contacted including their backups. The list will include the necessary contact information (i.e. Home phone - pager - cell - etc.) And in most cases be considered confidential.






32. An attack technique that exploits systems that do not perform input validation by embedding partial SQL queries inside input.






33. Planning with a goal of returning to the normal business function






34. Threats x Vulnerability x Asset Value = Total Risk






35. Prolonged loss of commercial power






36. High level design or model with a goal of consistency - integrity - and balance






37. Mediation of subject and object interactions






38. OOP concept of a taking attributes from the original or parent






39. A design methodology which executes in a linear one way fashion






40. Methodical research of an incident with the purpose of finding the root cause






41. Information that - if made public or even shared around the organization - could seriously impede the organization's operations






42. A state for operating system tasks only






43. A programming design concept which abstracts one set of functions from another in a serialized fashion






44. The process of recovering a database to the point of failure by applying active journal or log data to the current backup files of the database.






45. One of the most important first steps in the planning development. Qualitative and quantitative data needs to be gathered - analyzed - interpreted and presented to management






46. Control type- that is communication based - typically written or oral






47. Layer 1 network device that is used to connect network segments together - but provides no traffic control (a concentrator).






48. Is secondhand and usually not admissible in court






49. Potentially retrievable data residue that remains following intended erasure of data.






50. Individuals - normally managers or directors - who have responsibility .for the integrity - accurate reporting and use of computerized data.