Test your basic knowledge |

Comptia Security +: Assessment And Risk Mgmt

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Daily goals focused on productivity and task-oriented activities






2. CISO






3. A process to ID assests and their value - ID vulnerabilities and threats - quantify probability and impact of threats - provide balance between impact and cost






4. __________ loss has a negative effect after a vulnerability is initially exploited






5. Made up of ten domains - a mechanism to describe security processes






6. Physical damage - human interaction - equip malfunction - misuse of data - loss of data - application error






7. Used to ID failures in a complex systems to understand underlying causes of threats






8. The likelihood of exploitation and the loss potential






9. NIST risk management methodology






10. OCTAVE






11. ____________ can discover network devices / application - check password strength - measure internal / external access - analyze vulnerabilities in NOS - test response to DOS attacks






12. Process of ID and assessing risk - reducing to acceptable level - implementing mechanisms to maintain.






13. The asset's value multiplied by the EF percentage - (SLE)






14. Assurance of accurancy and reliability of information and systems






15. This tool scans network devices listening for open ports - (i.e. Nmap - scanmetender - superscan - NHS nohack scanner)






16. Potential danger to information or systems






17. FMEA






18. Risk assessment that is scenario based - ranks threats and countermeasures - uses experience - judgment - intuition and opinion






19. Type of audit that checks procedures and policies for escalating issues to management






20. De facto standard of best practices for IT service mgmt






21. Establish - implement - control and improve the Information Security Managment System (based on BS7799 Part 2)






22. Controls that manage facility access - locking systems - media sanitation - intrusion monitoring - environmental






23. Provides good practice advice on ISMS (ISO 17799)(based on BS7799 Part 1)






24. Security policy - map business objectives to security - Security infrastructure - security officer - reviews - Assest classification/control - inventory - Personnel security - screening - training - roles - Physical security - Communication/operation






25. CSO






26. FRAP






27. Number of time the incident might occur annually - (ARO)






28. A log that can record outgoing requests - incoming traffic - and internet usage






29. Controls that implement access control - password mangement - identification and authentication methods - configuration






30. Type of audit that checks information classification and change control procedures






31. Focus on service level agreements between IT dept and internal customers






32. A tool that maps weaknesses of systems / networks by scanning for ports - checking for applications - determining OS and patch level - and attempting exploits






33. Ensures reliable timely access to data/resources to authorized individuals






34. Controls that include policies - standards - procedures -risk management - personnel screening - training - change control






35. Responsible for communicating to senior mgmt organizational risks and compliance regulations






36. Midterm goals






37. Strategic - tactical and operational planning






38. IT governance at the operational level






39. The following tools (Nessus - Qualys - Retina) are ______________ scanners






40. Ensures necessary level of secrecy and prevents unauthorized disclosure






41. Used to predict changes based on trends - detect deviations - and watch events across multiple system components






42. Possiblity of damage and the ramifications should it occur






43. An password cracker that uses dictionary and brute force attacks - rainbow tables - can test password strength and recover passwords - was originally free - but now a commercial product






44. COSO






45. Used in assurance risk mgmt - methodical way to ID major failure modes (not useful for complex failure modes)






46. This type of testing scans for vulnerabilities - attacks to determine extent - tests countermeasures by circumvention - and can be internal or external






47. Information security managment measurements






48. Event levels available for logging in a MS DNS server






49. Derived from the COSO framework






50. Risk mgmt method with much broader focus than IT security