SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Assessment And Risk Mgmt
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. OCTAVE
Control Objectives for Information and related Technology
security program
Operationally Critical Threat - Asset - and Vulnerability Evaluation
annualized rate of occurrence
2. COSO
No events - Errors only - Errors and warnings - All events
tactical
ISO/IEC 27001
Committee of Sponsoring Organizations
3. __________ loss has a negative effect after a vulnerability is initially exploited
network mapping
john the ripper
CobiT
delayed
4. Type of audit that checks that network resources - systems and software are used appropriately
ISO/IEC 27799
usage
Committee of Sponsoring Organizations
Failure Modes and Effect Analysis
5. Focus on service level agreements between IT dept and internal customers
ITIL
Failure Modes and Effect Analysis
annualized rate of occurrence
FMEA
6. Used in assurance risk mgmt - methodical way to ID major failure modes (not useful for complex failure modes)
FMEA
Information Security Management
network mapping
OCTAVE
7. Used to predict changes based on trends - detect deviations - and watch events across multiple system components
integrity
fault tree analysis
data owner
performance monitor
8. SLE x ARO - (ALE)
annualized loss expectancy
CobiT
qualitative
ISO/IEC 27799
9. Controls that implement access control - password mangement - identification and authentication methods - configuration
risk
technical
delayed
protocol analyzer
10. An open source password cracker that uses dictionary and brute force attacks - stores previously cracked passwords - uses unshadow to merge password /shadow files
CobiT
john the ripper
usage
administrative
11. A commercial password cracker that can test password strength and recover passwords; and perform dictionary and brute force attacks
john the ripper
integrity
elcomsoft
security officer
12. Method of ID functions and their failures - causes of failures their effect - originally designed for systems engineering
FMEA
COSO
chief information security officer
usage
13. Guide to illustrate how to protect personal health information
exposure factor
ISO 17799
ISO/IEC 27799
CobiT
14. FRAP
annualized rate of occurrence
Facilitated Risk Analysis Process
IRM
CISO
15. Ensures necessary level of secrecy and prevents unauthorized disclosure
security officer
confidentiality
vulnerability
OVAL
16. Strategic - tactical and operational planning
Failure Modes and Effect Analysis
FRAP
planning horizon
risk
17. Long-term goals focused on risk managment - compliance - security responsiblities - continual improvement - using security to attract customers
Failure Modes and Effect Analysis
privilege
strategic
network mapping
18. De facto standard of best practices for IT service mgmt
performance monitor
Information Technology Infrastructure Library (ITIL)
IRM
administrative
19. Plan and Organize - Implement - Operate and Maintain - Monitor and Evaluate
vulnerability
security program
physical
CobiT
20. Type of audit that checks information classification and change control procedures
administrative
annualized loss expectancy
single loss expectancy
threat
21. Physical damage - human interaction - equip malfunction - misuse of data - loss of data - application error
No events - Errors only - Errors and warnings - All events
risk catagories
elcomsoft
ISO/IEC 27002
22. Control environment - company culture - Risk assessment - manage change - Control activities - policies - procedures - practices - Information and communication - right people - info - time - Monitoring - detect and respond
FMEA
COSO
risk
annualized rate of occurrence
23. Midterm goals
performance baseline
Facilitated Risk Analysis Process
security program
tactical
24. Corporate governance at the strategic level
risk analysis
strategic
COSO
privilege
25. Framework/set of best practices that define goals for controls used to properly manage IT and to ensure IT maps to business needs
escalation
CobiT
risk anlysis
vulnerability
26. FMEA
Information Technology Infrastructure Library (ITIL)
Failure Modes and Effect Analysis
ITIL
security governanace
27. Process of ID and assessing risk - reducing to acceptable level - implementing mechanisms to maintain.
penetration
ISO/IEC 27004
COSO
IRM
28. A tool that maps weaknesses of systems / networks by scanning for ports - checking for applications - determining OS and patch level - and attempting exploits
john the ripper
Operationally Critical Threat - Asset - and Vulnerability Evaluation
COSO
vulnerability scanner
29. An password cracker that uses dictionary and brute force attacks - rainbow tables - can test password strength and recover passwords - was originally free - but now a commercial product
vulnerability
L0phtCrack
risk analysis
qualitative
30. Controls that include policies - standards - procedures -risk management - personnel screening - training - change control
AS/NZS 4360
administrative
ISO 17799
ISO/IEC 27799
31. Used to ID failures in a complex systems to understand underlying causes of threats
privilege
fault tree analysis
security program
Information Security Management
32. Derived from the COSO framework
COSO
single loss expectancy
chief information security officer
CobiT
33. Guide assist in the implemenation of information security based on risk managent approach
COSO
firewall
administrative
ISO/IEC 27005
34. ____________ can discover network devices / application - check password strength - measure internal / external access - analyze vulnerabilities in NOS - test response to DOS attacks
network mapping
availability
Operationally Critical Threat - Asset - and Vulnerability Evaluation
FMEA
35. A method of ID vulnerabililties and threats and assessing possible impacts to determine where to implement security safeguards
risk analysis
SP 800-30
integrity
Information Security Management
36. The asset's value multiplied by the EF percentage - (SLE)
single loss expectancy
mappers
escalation
No events - Errors only - Errors and warnings - All events
37. CSO
port scanner
corporate security officer
ISO 17799
administrative
38. Provides good practice advice on ISMS (ISO 17799)(based on BS7799 Part 1)
vulnerability
countermeasure
ISO/IEC 27002
firewall
39. Establish - implement - control and improve the Information Security Managment System (based on BS7799 Part 2)
chief information security officer
ISO/IEC 27001
fault tree analysis
IRM
40. Plan and Organize - Acquire and Implement - Deliver and Support - Monitor and Evaluate
planning horizon
exposure factor
annualized rate of occurrence
CobiT
41. Type of audit that checks procedures and policies for escalating issues to management
port scanner
risk mitigation
network mapping
escalation
42. Percentage of an asset's value that would be lost in a single incident - (EF)
exposure factor
availability
FMEA
due care
43. Ensures reliable timely access to data/resources to authorized individuals
chief information security officer
availability
annualized loss expectancy
Control Objectives for Information and related Technology
44. A process to ID assests and their value - ID vulnerabilities and threats - quantify probability and impact of threats - provide balance between impact and cost
FMEA
risk anlysis
port scanner
due care
45. Mitigates a potential risk
countermeasure
vulnerability
No events - Errors only - Errors and warnings - All events
availability
46. Risk mgmt method with much broader focus than IT security
data owner
chief information security officer
risk mitigation
AS/NZS 4360
47. Provides a cost/benefit comparision
risk analysis
operational
firewall
Information Technology Infrastructure Library (ITIL)
48. The tools - personnel and business processes necessary to ensure that security meets needs
CobiT
security governanace
corporate security officer
technical
49. Hp OpenView - Nmap - Qualys - Solana Networks - SolarWinds are all network _____________
mappers
FMEA
annualized rate of occurrence
usage
50. Internationally recognized Information Security Management standard - provides high level conceptual recomendations on enterprise security - brish standard
BS7799
IRM
security officer
physical