SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Assessment And Risk Mgmt
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Provides good practice advice on ISMS (ISO 17799)(based on BS7799 Part 1)
ISO/IEC 27002
security officer
No events - Errors only - Errors and warnings - All events
tactical
2. Ensures managment security directives are fulfilled
risk analysis
COSO
ISO/IEC 27799
security officer
3. Strategic - tactical and operational planning
risk
planning horizon
Information Security Management
COSO
4. Used to ID failures in a complex systems to understand underlying causes of threats
SP 800-30
vulnerability
corporate security officer
fault tree analysis
5. Percentage of an asset's value that would be lost in a single incident - (EF)
vulnerability
exposure factor
fault tree analysis
vulnerability
6. Legal term used to determine liability - acting responsibly - have lower risk of liability due to security breach
blueprints
protocol analyzer
data owner
due care
7. FRAP
Facilitated Risk Analysis Process
security program
operational
vulnerability
8. IT governance at the operational level
CobiT
privilege
AS/NZS 4360
CISO
9. Internationally recognized Information Security Management standard - provides high level conceptual recomendations on enterprise security - brish standard
FMEA
port scanner
BS7799
CobiT
10. The likelihood of exploitation and the loss potential
risk
strategic
ISO/IEC 27002
exposure factor
11. Responsible for communicating to senior mgmt organizational risks and compliance regulations
CISO
network mapping
elcomsoft
planning horizon
12. Physical damage - human interaction - equip malfunction - misuse of data - loss of data - application error
risk catagories
delayed
performance monitor
ITIL
13. IRM
AS/NZS 4360
Information risk management
CISO
delayed
14. A process to ID assests and their value - ID vulnerabilities and threats - quantify probability and impact of threats - provide balance between impact and cost
vulnerability scanner
risk anlysis
network mapping
vulnerability
15. Assurance of accurancy and reliability of information and systems
risk catagories
ISO/IEC 27005
Operationally Critical Threat - Asset - and Vulnerability Evaluation
integrity
16. Controls that implement access control - password mangement - identification and authentication methods - configuration
vulnerability
FMEA
technical
SP 800-30
17. Number of time the incident might occur annually - (ARO)
annualized rate of occurrence
single loss expectancy
OCTAVE
countermeasure
18. Collection of controls an organization must have in place
BS7799
security program
Operationally Critical Threat - Asset - and Vulnerability Evaluation
exposure factor
19. Expected or predetermined performance level - developed from policy - performance - requirements
CobiT
protocol analyzer
performance baseline
due care
20. Plan and Organize - Acquire and Implement - Deliver and Support - Monitor and Evaluate
security officer
CobiT
usage
Control Objectives for Information and related Technology
21. FMEA
Committee of Sponsoring Organizations
fault tree analysis
risk analysis
Failure Modes and Effect Analysis
22. CobiT
Control Objectives for Information and related Technology
COSO
OCTAVE
risk analysis
23. _______________ can test IDS - detect network congestion - detect bad / failing equipment - detect high processor loads - must be NOS appropriate
risk
FMEA
vulnerability
network mapping
24. A quantative risk assesment process that allows for tests to be conducted to allow users to determine areas that require a risk analysis
privilege
FRAP
security governanace
Information Technology Infrastructure Library (ITIL)
25. Event levels available for logging in a MS DNS server
Committee of Sponsoring Organizations
No events - Errors only - Errors and warnings - All events
privilege
annualized rate of occurrence
26. A commercial password cracker that can test password strength and recover passwords; and perform dictionary and brute force attacks
countermeasure
port scanner
COSO
elcomsoft
27. Control environment - company culture - Risk assessment - manage change - Control activities - policies - procedures - practices - Information and communication - right people - info - time - Monitoring - detect and respond
COSO
qualitative
protocol analyzer
integrity
28. Daily goals focused on productivity and task-oriented activities
operational
network mapping
Committee of Sponsoring Organizations
tactical
29. Establish - implement - control and improve the Information Security Managment System (based on BS7799 Part 2)
confidentiality
technical
security governanace
ISO/IEC 27001
30. A method of ID vulnerabililties and threats and assessing possible impacts to determine where to implement security safeguards
operational
network mapping
risk analysis
planning horizon
31. __________ loss has a negative effect after a vulnerability is initially exploited
mappers
annualized rate of occurrence
delayed
COSO
32. Type of audit that checks that network resources - systems and software are used appropriately
FMEA
usage
ISO 17799
risk
33. An password cracker that uses dictionary and brute force attacks - rainbow tables - can test password strength and recover passwords - was originally free - but now a commercial product
L0phtCrack
Information Security Management
vulnerability
Facilitated Risk Analysis Process
34. Process of ID and assessing risk - reducing to acceptable level - implementing mechanisms to maintain.
FMEA
vulnerability
IRM
Failure Modes and Effect Analysis
35. Plan and Organize - Implement - Operate and Maintain - Monitor and Evaluate
Information Technology Infrastructure Library (ITIL)
countermeasure
security program
risk analysis
36. Focus on service level agreements between IT dept and internal customers
Operationally Critical Threat - Asset - and Vulnerability Evaluation
FMEA
qualitative
ITIL
37. NIST risk management methodology
Facilitated Risk Analysis Process
threat
SP 800-30
risk analysis
38. Provides a cost/benefit comparision
risk analysis
chief information security officer
FMEA
ISO/IEC 27004
39. The asset's value multiplied by the EF percentage - (SLE)
annualized loss expectancy
threat
ITIL
single loss expectancy
40. Method of ID functions and their failures - causes of failures their effect - originally designed for systems engineering
availability
Committee of Sponsoring Organizations
FMEA
risk catagories
41. Possiblity of damage and the ramifications should it occur
due care
risk
risk analysis
port scanner
42. SLE x ARO - (ALE)
CobiT
BS7799
physical
annualized loss expectancy
43. Derived from the COSO framework
security governanace
CobiT
blueprints
CISO
44. A tool that monitors network traffic - shows data and protocols in use - also known as a packet sniffer (i.e wireshark - TCPDump - Microsoft Network Monitor - Carnivore)
CobiT
Information Security Management
CobiT
protocol analyzer
45. The tools - personnel and business processes necessary to ensure that security meets needs
risk analysis
availability
security governanace
risk catagories
46. Potential danger to information or systems
operational
threat
performance monitor
ISO/IEC 27001
47. CSO
CobiT
vulnerability
ISO/IEC 27004
corporate security officer
48. Tools to ID - develop - and design security requirements for business needs
blueprints
countermeasure
ISO/IEC 27799
john the ripper
49. CISO
vulnerability
privilege
ISO/IEC 27002
chief information security officer
50. De facto standard of best practices for IT service mgmt
Information Technology Infrastructure Library (ITIL)
protocol analyzer
L0phtCrack
single loss expectancy