Test your basic knowledge |

CISSP Certified Information Systems Security Professional

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Tool which mediates access






2. Intermediate level - pertaining to planning






3. Robust project management process of new systems with at least the following phases: design and development - production - distribution - operation - maintenance - retirement - and disposal






4. People who interact with assets






5. An asymmetric cryptography mechanism that provides authentication.






6. The current internationally accepted set of standards and processes for information security products evaluation and assurance - which joins function and assurance requirements






7. Program that inappropriately collects private data or activity






8. A comprehensive set of controls comprising best practices in information security and provides guidelines on how to set up and maintain security programs.






9. Actions measured against either a policy or what a reasonable person would do






10. The ability an IDS has to dynamically change its rules and configurations in response to changing environmental activity






11. Real-time - automatic and transparent backup of data.






12. Control category- to discourage an adversary from attempting to access






13. Reduces causes of fire






14. An ongoing program supported and funded by executive staff to ensure business continuity requirements are assessed - resources are allocated and - recovery and continuity strategies and procedures are completed and tested.






15. One of the most important first steps in the planning development. Qualitative and quantitative data needs to be gathered - analyzed - interpreted and presented to management






16. Business and technical process of applying security software updates in a regulated periodic way






17. Intellectual property management technique for identifying after distribution






18. Return to a normal state






19. Intellectual property protection for an confidential and critical process






20. Records or documents that - if damaged or destroyed - would cause considerable inconvenience and/or require replacement or recreation at considerable expense.






21. The risk that remains after management implements internal controls - or some other response to risk - (Threats x Vulnerability x Asset Value) x Controls Gap = Residual Risk






22. The document that defines the resources - actions - tasks and data required to manage the business recovery process in the event of a business interruption within the stated disaster recovery goals.






23. Natural or human-readable form of message






24. A subnetwork with storage devices servicing all servers on the attached network.






25. The past U.S. military accepted set of standards and processes for computer systems evaluation and assurance - which combines function and assurance requirements






26. May render the data inaccessible to the application intended to be used in processing the file - but may not actually remove the data






27. The first rating that requires security labels






28. Converts a high level language into machine language






29. Hiding the fact that communication has occurred






30. An attack technique that exploits systems that do not perform input validation by embedding partial SQL queries inside input.






31. Low level - pertaining to planning






32. Evidence must be: admissible - authentic - complete - accurate - and convincing






33. A backup of data located where staff can gain access immediately






34. Small data files written to a user's hard drive by a web server.






35. A set of laws that the organization agrees to be bound by






36. Requirement to take time off






37. Requires security labels for all subjects and devices - the existence of a trusted path - routine covert channel analysis - and provision of separate administrator functionality.






38. Physical description on the exterior of an object that communicates the existence of a label






39. An access policy determined by the owner of a file (or other resource). The owner decides who's allowed access to the file and what privileges they have - most commonly used in the PC environment (i.e. file permissions).






40. System of law based upon precedence - with major divisions of criminal - tort - and administrative






41. Trading one for another






42. Guidelines within an organization that control the rules and configurations of an IDS






43. A failure of an IDS to detect an actual attack






44. A risk assessment method - intrinsic value






45. Vehicle or tool that exploits a weakness






46. A protocol for the efficient transmission of voice over the Internet






47. Maintaining full control over requests - implementation - traceability - and proper documentation of changes.






48. A device that provides the functions of both a bridge and a router.






49. To set the clearance of a subject or the classification of an object






50. A test conducted on multiple components of a plan - in conjunction with each other - typically under simulated operating conditions