Test your basic knowledge |

CISSP Certified Information Systems Security Professional

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Records or documents that - if damaged or destroyed - would cause considerable inconvenience and/or require replacement or recreation at considerable expense.






2. Moving letters around






3. A passive network attack involving monitoring of traffic.






4. A specialized wireless receiver/ transmitter placed in orbit that facilitates long distance communication.






5. Program that inappropriately collects private data or activity






6. Information about a particular data set






7. Alternate facility - other than the primary production site - where duplicated vital records and documentation may be stored for use during disaster recovery.






8. Interception of a communication session by an attacker.






9. Minimal Protection - and is used for systems that were evaluated but failed to meet the criteria for higher divisions






10. A choice in risk management - to implement a control that limits or lessens negative effects






11. What is will remain - persistence






12. A procedure that renders the contents of a message or file unintelligible to anyone not authorized to read it.






13. Act of luring an intruder and is legal.






14. Two different keys decrypt the same cipher text






15. Disk space it used to occupy has been designated by the computer as available for reuse. The deleted file remains intact until it has been overwritten with a new file.






16. Pertaining to law - no omissions






17. Memory management technique which allows data to be moved from one memory address to another






18. The component of Disaster Recovery which deals specifically with the relocation of a key function or department in the event of a disaster - including personnel - essential records - communication facilities - fax - mail services - etc.






19. Autonomous malware that requires a flaw in a service






20. A design methodology which addresses risk early and often






21. A document designed to periodically exercise specific action tasks and procedures to ensure viability in a real disaster or severe outage situation.






22. To be admissible in court they have to be made and collected in the normal course of business - not specially generated for a case in court. They can easily be considered hearsay if no firsthand proof of their accuracy and reliability exists






23. Dedicated fast memory located on the same board as the CPU






24. An exact bit-by-bit copy of the entire physical hard drive or floppy disk - including slack and unallocated space. Only forensic copy quality will hold up in court.






25. One of the most important first steps in the planning development. Qualitative and quantitative data needs to be gathered - analyzed - interpreted and presented to management






26. Narrow scope examination of a system






27. A codename that refers to the study and mitigation of information disclosure via electromagnetic emanations from electronic equipment.






28. To set the clearance of a subject or the classification of an object






29. A Denial of Service attack that exploits packet filter firewalls that only inspect the initial fragment of a fragmented packet.






30. Unsolicited commercial email






31. High level - pertaining to planning






32. Just enough access to do the job






33. The process of categorizing attack alerts produced from an IDS in order to distinguish false positives from actual attacks






34. Also known as regulatory laws - covers standards of performance or conduct expected by government agencies from companies - industries - and certain officials






35. Define the way in which the organization operates.






36. A electronic attestation of identity by a certificate authority






37. Transaction controls for a database - a return to a previous state






38. System of law based upon precedence - with major divisions of criminal - tort - and administrative






39. Scrambled form of the message or data






40. The process of identifying - accessing - reducing risk to an acceptable level - and implementing the right countermeasure to maintain that level of risk






41. Trading one for another






42. A process state - to be either be unable to run waiting for an external event or terminated






43. Use of a backup server(s) to protect information and essential processes in the event of a primary system failure.






44. OOP concept of an object at runtime






45. Power surge






46. A Denial of Service attack initiated by sending spoofed UDP echo request to IP broadcast addresses. (See Smurf)






47. Code breaking - practice of defeating the protective properties of cryptography.






48. Redundant component that provides failover capability in the event of failure or interruption of a primary component.






49. Consume resources to a point of exhaustion - loss of availability






50. Inference about encrypted communications