Test your basic knowledge |

CISSP Certified Information Systems Security Professional

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A practice execution of the plan takes place. A specific scenario is established - and the simulation continues up to the point of actual relocation to the alternate site.






2. Moving the alphabet intact a certain number spaces






3. Electronically forwarding backup data to an offsite server or storage facility. Vaulting eliminates the need for tape shipment and therefore significantly shortens the time required to move the data offsite.






4. Share security concerns with embedded devices - Often security has been scarified for richer user experience during low power - Prime target for data loss as they transmit and store information in ways that can't be controlled.






5. A unit of execution






6. Recovery alternative - everything needed for the business function - except people and last backup






7. The guardian of asset(s) - a maintenance activity






8. Any event - whether anticipated (i.e. - public service strike) or unanticipated (i.e. - blackout) which disrupts the normal course of business operations at an organization location.






9. Recovery alternative which includes cold site and some equipment and infrastructure is available






10. Fault tolerance for power






11. The point in time to which systems and data must be recovered after an outage. (e.g. End of previous day's processing). Rpos are often used as the basis for the development of backup strategies.






12. Uncheck data input which results in redirection






13. Requires two of the three user authentication attributes (knows - is or has) - e.g. you have an ATM card and enter a PIN






14. A program in the operating system responsible for maintaining the hierarchical storage relocation requirements for processes and data from RAM to hard drives






15. Control type- that is communication based - typically written or oral






16. A copy of transaction data - designed for querying and reporting






17. Must be legally permissible - meaning it was seized legally and the chain of custody was not broken. To be admissible in court - it needs to be relevant - sufficient - and reliable.






18. A device that provides the functions of both a bridge and a router.






19. Forgery of the sender's email address in an email header.






20. A group of hard drives working as one storage unit for the purpose of speed and fault tolerance






21. Attempts to assign real and meaningful numbers to all elements of the risk analysis process.






22. Someone who want to know how something works - typically by taking it apart






23. A system designed to prevent unauthorized access to or from a private network.






24. Owner directed mediation of access






25. An attack technique that exploits systems that do not perform input validation by embedding partial SQL queries inside input.






26. An access policy that uses a security label system. Users have clearances - and resources have security labels that contain data classifications. MAC compares these two attributes to determine access control capabilies - most commonly used in governm






27. An availability attack - to consume resources to the point of exhaustion






28. Converts a high level language into machine language






29. Motive - opportunity - and means; when looking for suspects it is important to consider these 3 things






30. High level - pertaining to planning






31. Process whereby data is removed from active files and other data storage structures






32. Policy or stated actions






33. Interception of a communication session by an attacker.






34. Specific format of technical and physical controls that support the chosen framework and the architecture






35. Power surge






36. A device that sequentially switches multiple analog inputs to the output.






37. Executive responsibilities of goal setting - delegation - and verification - based upon the mission.






38. System of law based upon precedence - with major divisions of criminal - tort - and administrative






39. An event that triggers an IDS to produce an alarm and react as though a real attack were in progress






40. Notification that a potential disaster situation exists or has occurred; direction for recipient to stand by for possible activation of disaster recovery plan.






41. Written step-by-step actions






42. A failure of an IDS to detect an actual attack






43. A Denial of Service attack that floods the target system with connection requests that are not finalized.






44. Agreement between two organizations (or two internal business groups) with basically the same equipment/same environment that allows each one to recover at each other's site.






45. A documented battle plan for coordinating response to incidents.






46. Object reuse protection and auditing






47. A plan of action to commence immediately to prevent the loss of life and minimize injury and property damage.






48. A comprehensive set of controls comprising best practices in information security and provides guidelines on how to set up and maintain security programs.






49. Review of data






50. Organization's prior arrangements made to maintain the functions and processes important to the existence of the organization