Test your basic knowledge |

CISSP Certified Information Systems Security Professional

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Third party processes used to organize the implementation of an architecture






2. Mitigation of spamming and other attacks by delaying incoming connections as long as possible.






3. Part of a transaction control for a database which informs the database of the last recorded transaction






4. An unintended communication path






5. Highly sensitive internal documents that could seriously damage the organization if such information were lost or made public.






6. A committee of decision makers - business owners - technology experts and continuity professionals - tasked with making strategic recovery and continuity planning decisions for the organization.






7. Effort/time needed to overcome a protective measure






8. A backup type - for databases at a point in time






9. Try a list of words in passwords or encryption keys






10. Small data files written to a user's hard drive by a web server.






11. A test conducted on one or more components of a plan under actual operating conditions.






12. A Denial of Service attack that exploits packet filter firewalls that only inspect the initial fragment of a fragmented packet.






13. A Trojan horse with the express underlying purpose of controlling host from a distance






14. Server optimized for providing file-based data storage to the network. Unlike a File Server - a NAS unit has no input or output devices - and the OS is dedicated for providing storage services.






15. To load the first piece of software that starts a computer.






16. A critical event - which - if not handled in an appropriate manner - may dramatically impact an organization's profitability - reputation - or ability to operate.






17. Slang for making (burning) a CD-ROM copy of data - whether it is music - software - or other data.






18. OOP concept of a taking attributes from the original or parent






19. Program instructions based upon the CPU's specific architecture






20. Recording activities at the keyboard level






21. The hardware and software mediator of all subject and object interactions which has as its primary goal security policy enforcement.






22. A specialized wireless receiver/ transmitter placed in orbit that facilitates long distance communication.






23. An application that is essential to the organization's ability to perform necessary business functions. Loss of the mission-critical application would have a negative impact on the business - as well as legal or regulatory impacts.






24. False memory reference






25. Maintenance procedures outline the process for the review and update of business continuity plans.






26. A cooperative collection of business processes and technologies used for the purpose of binding individuals to a digital certificate






27. Unauthorized access of information (e.g. Tapping - sniffing - unsecured wireless communication - emanations)






28. A physical enclosure for verifying identity before entry to a facility






29. The point in time to which systems and data must be recovered after an outage. (e.g. End of previous day's processing). Rpos are often used as the basis for the development of backup strategies.






30. Electronically forwarding backup data to an offsite server or storage facility. Vaulting eliminates the need for tape shipment and therefore significantly shortens the time required to move the data offsite.






31. Segmented memory addressing - encapsulation of objects - time multiplexing of shared resources - naming distinctions - and virtual mapping.






32. A comprehensive set of controls comprising best practices in information security and provides guidelines on how to set up and maintain security programs.






33. Fragmented data is live data that has been broken up and stored in various locations on a single hard drive or disk.






34. A codename that refers to the study and mitigation of information disclosure via electromagnetic emanations from electronic equipment.






35. A backup type which creates a complete copy






36. Information which has retained its importance - but which has been created or stored by software/hardware that has been rendered obsolete.






37. Individuals and departments responsible for the storage and safeguarding of computerized data.






38. A state where two subjects can access the same object without proper mediation






39. To be admissible in court they have to be made and collected in the normal course of business - not specially generated for a case in court. They can easily be considered hearsay if no firsthand proof of their accuracy and reliability exists






40. The component of Disaster Recovery which deals specifically with the relocation of a key function or department in the event of a disaster - including personnel - essential records - communication facilities - fax - mail services - etc.






41. Unchecked data which spills into another location in memory






42. Minimal Protection - and is used for systems that were evaluated but failed to meet the criteria for higher divisions






43. Security Policy - Personnel Controls - Supervisory Structure - Security Awareness Training - Testing






44. Collection of data on business functions which determines the strategy of resiliency






45. A protocol for the efficient transmission of voice over the Internet






46. The chronological sequence of recovery activities - or critical path - that must be followed to resume an acceptable level of operations following a business interruption.






47. Control category - more than one control on a single asset






48. An opportunity for a threat to cause loss. (terminology that encompasses many recent risk terms)






49. Mediates communication between un-trusted hosts on behalf of the hosts that it protects.






50. uropean standard for IT security criteria. Wasn't universally adopted. - Consists of four components:1. "Security Target" 2. "Target of Evaluation" or ToE. 3. Functional Levels. 4. Assurance Levels.