Test your basic knowledge |

CISSP Certified Information Systems Security Professional

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A Denial of Service attack initiated by sending spoofed UDP echo request to IP broadcast addresses. (See Smurf)






2. Line by line translation from a high level language to machine code






3. Uncleared buffers or media






4. Recovery alternative - complete duplication of services including personnel






5. Written internalized or nationalized norms that are internal to an organization






6. A state where two subjects can access the same object without proper mediation






7. Malware that makes small random changes to many data points






8. Moving letters around






9. The core of a computer that calculates






10. Two different keys decrypt the same cipher text






11. A copy of transaction data - designed for querying and reporting






12. A program with an inappropriate second purpose






13. One of the most important first steps in the planning development. Qualitative and quantitative data needs to be gathered - analyzed - interpreted and presented to management






14. Code making






15. A condition in which neither party is willing to stop their activity for the other to complete






16. Renders the file inaccessible to the operating system - available to reuse for data storage.






17. Policy or stated actions






18. Potentially compromising leakage of electrical or acoustical signals.






19. Sudden rise in voltage in the power supply.






20. A mail server that improperly allows inbound SMTP connections for domains it does not serve.






21. Those actions and backup processes determined by an organization to be necessary to meet its data recovery and restoration objectives - including timeframes - technologies - offsite storage - and will ensuretime objectives can be met.






22. Program instructions based upon the CPU's specific architecture






23. A vulnerability in IP that allows an attacker to dictate the path of a communication and thereby access an internal network.






24. Planning for the delegation of authority required when decisions must be made without the normal chain of command






25. Unauthorized intrusion - unauthorized alteration or destruction - and using malicious code






26. High frequency noise






27. The one person responsible for data - its classification and control setting






28. Subject based description of a system or a collection of resources






29. A control after attack






30. Control type- that is communication based - typically written or oral






31. An activity that is performed for the purpose of training and conditioning team members - and improving their performance.






32. The least formatted and therefore most portable form of text for computerized documents. ASCII files are often called plaintext files.






33. Reconnaissance technique - involving automated - brute force identification of potentially vulnerable modems.






34. A programming design philosophy and a type of programming language - which breaks a program into smaller units. Each unit has its own function.






35. A list of team members and/or key players to be contacted including their backups. The list will include the necessary contact information (i.e. Home phone - pager - cell - etc.) And in most cases be considered confidential.






36. Firewalls - encryption - and access control lists






37. Define the way in which the organization operates.






38. Systematic assessment of threats and vulnerabilities that provides a basis for effective management of risk.






39. Initial surge of current






40. Methodical research of an incident with the purpose of finding the root cause






41. The restoration of computer files from backup media to restore programs and production data to the state that existed at the time of the last safe backup.






42. Object based description of a single resource and the permission each subject






43. Includes identification and collection of the evidence - its storage - preservation - transportation - presentation in court - and return to the owner






44. Control category- to discourage an adversary from attempting to access






45. The past U.S. military accepted set of standards and processes for computer systems evaluation and assurance - which combines function and assurance requirements






46. The duplication of data on separate disks in real time to ensure its continuous availability - currency and accuracy. True mirroring will enable a zero recovery point objective.






47. A tag of three or four letters - preceded by a period - which identifies a data file's format or the application used to create the file.






48. Mediation of covert channels must be addressed






49. An attack that breaks up malicious code into fragments - in an attempt to elude detection.






50. Framework that defines goals for the controls that should be used to properly manage IT - consists of 4 domains: - Plan and Organize - - Acquire and Implement - Deliver and Support - Monitor and Evaluate