SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Assessment And Risk Mgmt
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Establish - implement - control and improve the Information Security Managment System (based on BS7799 Part 2)
ISO/IEC 27001
technical
firewall
confidentiality
2. A plan of action to deal with risks defined in the risk assessment - may remediate or transfer risk
Operationally Critical Threat - Asset - and Vulnerability Evaluation
CobiT
risk mitigation
confidentiality
3. Used in assurance risk mgmt - methodical way to ID major failure modes (not useful for complex failure modes)
vulnerability scanner
penetration
risk analysis
FMEA
4. Controls that implement access control - password mangement - identification and authentication methods - configuration
due care
risk
technical
usage
5. Guide to illustrate how to protect personal health information
risk catagories
penetration
ISO/IEC 27799
administrative
6. ____________ can discover network devices / application - check password strength - measure internal / external access - analyze vulnerabilities in NOS - test response to DOS attacks
network mapping
physical
SP 800-30
usage
7. Risk mgmt method with much broader focus than IT security
operational
CISO
risk
AS/NZS 4360
8. An instance of being exposed to losses from a threat
SP 800-30
exposure
tactical
ISO/IEC 27005
9. Used to ID failures in a complex systems to understand underlying causes of threats
escalation
fault tree analysis
Control Objectives for Information and related Technology
COSO
10. Hp OpenView - Nmap - Qualys - Solana Networks - SolarWinds are all network _____________
risk catagories
mappers
escalation
ISO 17799
11. Responsible for developing: security awareness program - budget for information security related activities; policies - procdures - and guidelines - a security compliance program - and metrics
penetration
Committee of Sponsoring Organizations
ISO/IEC 27004
CISO
12. Tools to ID - develop - and design security requirements for business needs
performance baseline
blueprints
security officer
data owner
13. CobiT
security program
chief information security officer
Control Objectives for Information and related Technology
countermeasure
14. Possiblity of damage and the ramifications should it occur
availability
risk
OCTAVE
administrative
15. This type of testing scans for vulnerabilities - attacks to determine extent - tests countermeasures by circumvention - and can be internal or external
ISO/IEC 27002
risk mitigation
vulnerability
penetration
16. Midterm goals
risk analysis
tactical
risk mitigation
chief information security officer
17. Type of audit that checks that accounts - groups and roles are correctly assigned
due care
privilege
corporate security officer
annualized rate of occurrence
18. De facto standard of best practices for IT service mgmt
Information Technology Infrastructure Library (ITIL)
integrity
IRM
port scanner
19. A method of ID vulnerabililties and threats and assessing possible impacts to determine where to implement security safeguards
risk analysis
network mapping
corporate security officer
security governanace
20. Potential danger to information or systems
CobiT
risk catagories
ISO/IEC 27005
threat
21. Physical damage - human interaction - equip malfunction - misuse of data - loss of data - application error
security program
performance baseline
vulnerability
risk catagories
22. A tool that monitors network traffic - shows data and protocols in use - also known as a packet sniffer (i.e wireshark - TCPDump - Microsoft Network Monitor - Carnivore)
john the ripper
CISO
escalation
protocol analyzer
23. Ensures reliable timely access to data/resources to authorized individuals
ISO 17799
availability
port scanner
risk mitigation
24. Risk assessment that is scenario based - ranks threats and countermeasures - uses experience - judgment - intuition and opinion
elcomsoft
qualitative
confidentiality
COSO
25. Controls that manage facility access - locking systems - media sanitation - intrusion monitoring - environmental
physical
strategic
escalation
OVAL
26. Port scanners - vulnerability scanners - protocol analyzers - password crackers - network mappers - open vulnerability and assessment language (OVAL) are all tool used in a ___________________ assessment
FRAP
vulnerability
network mapping
COSO
27. Made up of ten domains - a mechanism to describe security processes
ISO 17799
risk analysis
risk mitigation
operational
28. Type of audit that checks that network resources - systems and software are used appropriately
FMEA
security governanace
usage
port scanner
29. An open source password cracker that uses dictionary and brute force attacks - stores previously cracked passwords - uses unshadow to merge password /shadow files
confidentiality
john the ripper
ISO 17799
technical
30. Plan and Organize - Acquire and Implement - Deliver and Support - Monitor and Evaluate
delayed
CobiT
countermeasure
penetration
31. Collection of controls an organization must have in place
usage
performance monitor
security program
risk mitigation
32. A commercial password cracker that can test password strength and recover passwords; and perform dictionary and brute force attacks
elcomsoft
operational
risk
data owner
33. Framework/set of best practices that define goals for controls used to properly manage IT and to ensure IT maps to business needs
Information Technology Infrastructure Library (ITIL)
CobiT
protocol analyzer
security governanace
34. ISM Standard
ITIL
fault tree analysis
Information Security Management
confidentiality
35. OCTAVE
operational
FMEA
penetration
Operationally Critical Threat - Asset - and Vulnerability Evaluation
36. CISO
chief information security officer
FMEA
L0phtCrack
administrative
37. Risk mgmt method created by Carnegie Mellon University - people manage/direct the risk evaluation for IT security in a company
OCTAVE
availability
CobiT
IRM
38. An open language from mitre.org for determining vulnerabilities and problems on computer systems
Information Technology Infrastructure Library (ITIL)
confidentiality
exposure factor
OVAL
39. Strategic - tactical and operational planning
risk analysis
risk analysis
planning horizon
ISO/IEC 27004
40. Information security managment measurements
ISO/IEC 27002
ISO/IEC 27004
annualized rate of occurrence
CobiT
41. Used to predict changes based on trends - detect deviations - and watch events across multiple system components
due care
strategic
elcomsoft
performance monitor
42. Plan and Organize - Implement - Operate and Maintain - Monitor and Evaluate
ISO/IEC 27001
strategic
security program
security governanace
43. Guide assist in the implemenation of information security based on risk managent approach
risk analysis
ISO/IEC 27005
penetration
risk
44. Focus on service level agreements between IT dept and internal customers
chief information security officer
ITIL
Information risk management
COSO
45. __________ loss has a negative effect after a vulnerability is initially exploited
ISO 17799
annualized loss expectancy
risk
delayed
46. This tool scans network devices listening for open ports - (i.e. Nmap - scanmetender - superscan - NHS nohack scanner)
port scanner
ISO 17799
security officer
network mapping
47. Assurance of accurancy and reliability of information and systems
integrity
ISO 17799
confidentiality
exposure
48. Process of ID and assessing risk - reducing to acceptable level - implementing mechanisms to maintain.
due care
risk analysis
IRM
ITIL
49. A weakness (software - hardware - procedural - human) that can be exploited
vulnerability
single loss expectancy
performance baseline
risk anlysis
50. The likelihood of exploitation and the loss potential
risk
annualized rate of occurrence
ISO/IEC 27005
availability