KILL-04

更新时间：试题数量：购买人数：提供作者：

有效期：个月

章节介绍：共有个章节

收藏

我的练习

我的错题
(0道)

我的收藏
(0道)

我的斩题
(0道)

我的笔记
(0道)

专项练习

顺序练习 练习进度 0 / 0

随机练习 自定义设置练习量

模拟考试 仿真模拟

题型练习 按题型分类练习

易错题 精选高频易错题

学习资料 考试学习相关信息

搜索

题库预览

An effective information security policy should not have which of the following characteristic? 一个有效的信息安全策略不应该具有以下哪一个特征？

What can be described as a measure of the magnitude of loss or impact on the value of an asset? 什么可以被描述为对资产价值损失或影响程度的度量？

Who of the following is responsible for ensuring that proper controls are in place to address integrity, confidentiality, and availability of IT systems and data? 以下谁负责确保适当的控制措施到位，以解决IT系统和数据的完整性、机密性和可用性问题？

Related to information security, integrity is the opposite of which of the following? 与信息安全相关，完整性与以下哪项相反？

Which property ensures that only the intended recipient can access the data and nobody else? 哪种属性确保只有预期的收件人可以访问数据，而其他人不能访问？

Which of the following would be the best criterion to consider in determining the classification of an information asset? 下列哪项是确定信息资产分类时考虑的最佳标准？

The Widget company decided to take their company public and while they were in the process of doing so had an externa auditor come and look at their company. As part of the external audit they brought in an technology expert, who incidentally was a new CISSP. The auditor's expert asked to see their last risk analysis from the technology manager. The technology manager did not get back to him for a few days and then the Chief Financial Officer gave the auditors a 2 page risk assesment that was signed by both the Chief Financial Officer and the Technology Manager. While reviewing it, the auditor noticed that only parts of their financial data were being backed up on site and no where else; the Chief Financial Officer accepted the risk of only partial financial data being backed up with no off-site copies available. Who owns the risk with regards to the data that is being backed up and where it is stored? Widget公司决定将其公司上市，在上市过程中，一名externa审计员来检查他们的公司。作为外部审计的一部分，他们请来了一位技术专家，顺便说一句，他是一位新的CISSP。审计专家要求技术经理查看他们最后的风险分析。技术经理有几天没有回复他，然后首席财务官给了审计员一份两页的风险评估报告，由首席财务官和技术经理签字。审核时，审计人员注意到，只有部分财务数据在现场备份，其他地方没有备份；首席财务官接受了只备份部分财务数据而没有场外副本的风险。谁负责备份的数据及其存储位置的风险？

Within the realm of IT security, which of the following combinations best defines risk? 在IT安全领域，以下哪种组合最能定义风险？

Which answer BEST describes information access permissions where, unless the user is specifically given access to certain data they are denied any access by default? 哪一个答案最能描述信息访问权限，除非用户被特别授予访问特定数据的权限，否则默认情况下，他们将被拒绝任何访问权限？

What is called an event or activity that has the potential to cause harm to the information systems or networks? 什么是可能对信息系统或网络造成危害的事件或活动？

How is Annualized Loss Expectancy （ALE） derived from a threat? 年度预期损失（ALE）是如何从威胁中得出的？

Within the context of the CBK, which of the following provides a MINIMUM level of security ACCEPTABLE for an environment? 在CBK环境中，以下哪项提供了环境可接受的最低安全级别？

Which of the following is BEST defined as a physical control? 以下哪项最适合定义为物理控制？

What is the highest amount a company should spend annually on countermeasures for protecting an asset valued at $1,000,000 from a threat that has an annualized rate of occurrence （ARO） of once every five years and an exposure factor （EF） %?为保护价值为1000000美元的资产免受年化发生率（ARO）为每五年一次且暴露系数（EF）%的威胁，公司每年应在应对措施上花费的最高金额是多少？

A deviation from an organization-wide security policy requires which of the following? 偏离组织范围的安全策略需要以下哪项？

What would be the Annualized Rate of Occurrence （ARO） of the threat "user input error", in the case where a company employs 100 data entry clerks and every one of them makes one input error each month? 如果一家公司雇佣了100名数据录入员，每个人每月都会出现一次输入错误，那么“用户输入错误”威胁的年发生率（ARO）是多少？

What are the four domains that make up CobiT?

Which of the following is not one of the three goals of Integrity addressed by the Clark Wilson model? 以下哪一项不是克拉克·威尔逊模型提出的三个诚信目标之一？

Risk mitigation and risk reduction controls for providing information security are classified within three main categories, which of the following are being used? 提供信息安全的风险缓解和风险降低控制分为三大类，分别使用以下哪一类？

Which type of security control is also known as "Logical" control? 哪种类型的安全控制也称为“逻辑”控制？

1 10 11 12 13 14 16