Test your basic knowledge |

CISSP Certified Information Systems Security Professional

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. The time period between a disaster and a return to normal functions - during which the disaster recovery plan is employed.






2. Malware that subverts the detective controls of an operating system






3. Requires security labels for all subjects and devices - the existence of a trusted path - routine covert channel analysis - and provision of separate administrator functionality.






4. Recovery alternative - complete duplication of services including personnel






5. Layer 1 network device that is used to connect network segments together - but provides no traffic control (a concentrator).






6. An application that is essential to the organization's ability to perform necessary business functions. Loss of the mission-critical application would have a negative impact on the business - as well as legal or regulatory impacts.






7. A committee of decision makers - business owners - technology experts and continuity professionals - tasked with making strategic recovery and continuity planning decisions for the organization.






8. Real-time - automatic and transparent backup of data.






9. A passive network attack involving monitoring of traffic.






10. Record history of incident






11. A Denial of Service attack that floods the target system with connection requests that are not finalized.






12. The guardian of asset(s) - a maintenance activity






13. Trading one for another






14. A copy of transaction data - designed for querying and reporting






15. Loss would inconvenience the organization but disclosure is unlikely to result in financial loss or serious damage to credibility.






16. Standard for the establishment - implementation - control - and improvement of the Information Security Management System






17. A process state - (blocked) needing input before continuing






18. It is embedded as part of a complete device often including hardware and mechanical parts - Features a limited OS - Mobile phones - routers and wireless devices take a similar approach - Less than robust security features - Difficult to patch.






19. A mobilized resource purchased or contracted for the purpose of business recovery.






20. Maintaining full control over requests - implementation - traceability - and proper documentation of changes.






21. A set of best practices for programmers to seek in all application or data base design: Atomicity - Consistency - Isolation - Durability






22. A covert storage channel on the file attribute






23. Adversary intercepts encrypted communications - decrypts - views - encrypts - and send along to the true destination






24. System directed mediation of access with labels






25. Controls for termination of attempt to access object






26. Guidelines within an organization that control the rules and configurations of an IDS






27. Collection of data on business functions which determines the strategy of resiliency






28. A technology that reduces the size of a file.






29. A critical event - which - if not handled in an appropriate manner - may dramatically impact an organization's profitability - reputation - or ability to operate.






30. Unauthorized access of network devices.






31. A group of individuals responsible for maintaining the business recovery procedures and coordinating the recovery of business functions and processes.






32. Representatives from each functional area or department get together and walk through the plan from beginning to end.






33. One method of exercising teams in which participants perform some or all of the actions they would take in the event of plan activation. Operational exercises are typically performed under actual operating conditions






34. A comprehensive set of controls comprising best practices in information security and provides guidelines on how to set up and maintain security programs.






35. A formal announcement by pre-authorized personnel that a disaster or severe outage is predicted or has occurred and that triggers pre-arranged mitigating actions (e.g. A move to an alternate site.)






36. The duplication of data for purposes of backup or to distribute network traffic among several computers with identical data.






37. Two certificate authorities that trust each other






38. A Trojan horse with the express underlying purpose of controlling host from a distance






39. Written step-by-step actions






40. The level and label given to an individual for the purpose of compartmentalization






41. Uses two or more legal systems






42. A device that provides the functions of both a bridge and a router.






43. Code breaking - practice of defeating the protective properties of cryptography.






44. A list of team members and/or key players to be contacted including their backups. The list will include the necessary contact information (i.e. Home phone - pager - cell - etc.) And in most cases be considered confidential.






45. Another subject cannot see an ongoing or pending update until it is complete






46. Portable media used to store data that is not presently in use by an organization to free up space but still allow for disaster recovery. May also be called "Backup Tapes."






47. Are bound to objects and indicate what subjects can use them - typically kept by a network device (router - switch and so on) to control access to or from the device for a number of services






48. To reduce fire






49. Communication of a security incident to stakeholders and data owners.






50. Controls deployed to avert unauthorized and/or undesired actions.