Free practice exams for the CISSP, CISA, SSCP, GSEC

Select your quiz options:

Select language:

Select main study area:

Select all desired domains:
(use Shift or Ctrl for multiple select)

Select all desired topics:
(use Shift or Ctrl for multiple select)

Include sub-topics in selection:

Maximum difficulty level:

Rookie

Easy

Medium

Hard

Pro

Include questions that are:

loosely related

moderately related

closely related

Shuffle answers in questions:

Review only incorrect answers:

How many questions:

Activate timer:

CISSP and SSCP OSG Quizzer engine © Copyright 2003–2007 Clément Dupuis. All questions property of their authors and cccure.org. All rights reserved. No unauthorized use or duplication without explicit written permission of author and of cccure.org.

Quiz engine user interface revised by eLearning Corner.

CISSP CBK - Access Control
CISSP CBK - Telecommunications and Network Security
CISSP CBK - Information Security and Risk Management
CISSP CBK - Application Security
CISSP CBK - Cryptography
CISSP CBK - Security Architecture and Design
CISSP CBK - Operations Security
CISSP CBK - BCP and DRP
CISSP CBK - Legal, Regulations, Compliance and Investigations
CISSP CBK - Physical (Environmental) Security

Access control administration
Access control attacks and countermeasures
Access control matrix
Access control methodologies and implementation
Access control objectives
Access control techniques
Access controls lists (ACLs)
Access matrix model
Account administration
Account, log and journal monitoring
Active and passive attacks
Add-on security
Address Resolution Protocol (ARP and RARP)
Address space and addressing
Administrative physical security controls
Advanced Encryption Standard (AES)
Alternate processes
Alternate sites
Application and system development attacks and countermeasures
Application layer security protocols
Application security
Application system controls
Assurance
Asynchronous Transfer Mode (ATM)
Attacker types, profiles and motivations
Attributability
Audit trails
Authentication
Backups and offsite storage
Badges
BCP/DRP controls
BCP/DRP Events
Bell-LaPadula access control model
Biba access control model
Biometrics
Brute force (exhaustive) attacks
Buffer overflows
Business continuity plan testing
Business Continuity Planning (BCP)
Business continuity scope and planning
Business Impact Assessment (BIA)
Callback systems
Canadian Trusted Computer Product Evaluation Criteria (CTCPEC)
Capability tables
Centralized/remote authentication access controls
Certificate revocation list (CRL)
Certification and accreditation
Certification authorities (CA)
Chain of custody of evidence
Challenge Handshake Authentication Protocol (CHAP)
Change and configuration control/management
Cipher types
Clark and Wilson access control model
Client/server environments
Clipper Chip
Clipping level
Closed Circuit Television (CCTV)
Cohesion and coupling
Common computer and network organizations, architectures and designs
Common Criteria
Common security models, architectures, and evaluation criteria
Communication services
Communications and networks attacks and countermeasures
Communications security
Compartmented security mode
Computer crime
Computer crime evidence
Computer crime types
Computer laws
Confidentiality, integrity and availability
Configuration management
Contigency planning testing
Control types
Controlled (partitioned) security mode
Covert channels
Critical path analysis
Cryptographic Codes
Cryptography attacks and countermeasures
Cryptography history
Cryptography implementations
Cryptography issues
Cryptography weaknesses
Damage assessment
Data classification
Data Encryption Standard (DES)
Data hiding
Data remanence and object reuse protection
Database management systems
Database security
Database views
Databases and data warehousing
Defense Information Technology Security Certification and Accreditation Process (DITSCAP)
Demilitarized zones (DMZ) and Bastion hosts
Denial of service attacks
DHCP
Dictionary attacks
Digital signatures
Disaster recovery planning
Discretionary access control
Distributed environments
Domain Name System (DNS)
Dual control
Due care and due diligence
E-mail security
Elements of contingency planning
Elliptic Curve Cryptosystems (ECC)
Emergency Response
Employment policies and practices
Encryption and decryption
End-user involvement in BCP/DRP
Entrapment and enticement
Equipment reliability
Ethernet
Evidence collection and preservation
Evidence types and admissibility
External communications
Facility Requirements
Facsimile security
Fault tolerance
Federal Information Processing Standards (FIPS)
File and data owners, custodians, and users
Fire and smoke detection and suppression systems
Firewall implementations
Firewall rules
Firewalls and packet filters
Flooding attacks
Frame Relay
Generally Accepted Systems Security Principles (GASSP)
Hacker tools
Hardware and software cryptographic modules
HIPAA
Hiring and termination practices
Honeypots
Host-based intrusion detection
Humidity and environmental controls
HVAC considerations
Hybrid cryptography
IAB guidelines (RFC1087)
Identification and authentication techniques
Illegal and inappropriate activities
Import/export laws
Incident handling and response
Individual accountability
Inference and Aggregation
Information and asset valuation
Information labels
Initialization and failure states
Input and parameter checking
Input controls
Insurance
Integrity checkers
Intellectual property
Inter-networking devices and connectivity hardware
Internet, Intranets and Extranets
Intrusion response
Investigations
IP v6
IPSec
ISC2 code of Ethics
ISO/OSI model and layers
ITSEC classes and required assurance and functionality
Job rotation
Kerberos
Key distribution and management
Key escrow and key recovery
Key lengths and strengths
Knowledge-based systems
LAN Transmission methods
LAN transmission protocols
Lattice-based access control
Layer 2 Tunnelling Protocol (L2TP)
Layered security
Legal liability
Link encryption
Local area networks (LANs)
Major categories and types of laws
Malicious code
Management involvement in BCP/DRP
Mandatory access control
Masquerading attacks
Maximum tolerable downtime
Media access methods
Message digests and hash functions
Mirroring
Mobile, wireless and satellite technologies and security
Monitoring and intrusion detection systems (IDS)
Monitoring tools and techniques
Motion detectors, sensors, and alarms
Multi-factor authentication
Multi-level security
Multi-level security mode
National Information Assurance Certification and Accreditation Process (NIACAP)
Network Address Translation (NAT)
Network and communication protocols
Network availability
Network monitors and packet sniffers
Network ports and monitoring
Network security
Network Services
Network sniffing
Network topologies
Network-based intrusion detection
Networks and communications security techniques
Networks and telecommunications management
Non-discretionary access control
Non-interference model
Non-repudiation
Objects and subjects
Occupant emergency plan
One-time pads
One-time passwords
One-way cryptography
Operations controls
Operations security threats and Countermeasures
Orange Book (TCSEC) classes and required functionality
Output controls
Packet switching
Passphrases
Password guessing
Password management
Passwords
Penetration testing (ethical hacking)
Physical media characteristics
Physical security controls
Physical security threats (prevention, detection and suppression)
PIN Codes
PKCS Standards
Point to point Protocol (PPP)
Point-to-point tunnelling protocol (PPTP)
Policies, standards, guidelines and procedures
Polyinstanciation
Power considerations
Pretty Good Privacy (PGP)
Principle of least privilege/Need to know
Problem management
Process isolation
Programming languages, techniques and tools
Project planning
Protection domains
Protection of personal information
Protection rings
Proxies
Public (Asymmetric) Key Cryptography
Public Key Algorithms
Public key infrastructure (PKI)
Public vs secret cryptography
Qualitative and quantitative risk assessment
RAID Technology
Rainbow Series
Recovery and redundancy techniques
Recovery plan maintenance
Recovery point and recovery time objectives
Recovery strategy
Reference monitors and security kernels
Relocation to primary site
Remote access and telecommuting
Remote Authentication Dial-In Service (RADIUS)
Remote Procedure Call and Secure-RPC protocols
Replay attacks
Resource misuse and abuse
Risk assessment
Risk assessment tools and techniques
Risk management
Risk mitigation
Rivest Shamir Adleman (RSA)
Role-based access control
Roles and responsibilities
Routing protocols
Rule-based access control
Secret (Symmetric) Key Cryptography
Secret Key Algorithms
Secure Electronic Transactions (SET) Protocol
Secure HTTP
Secure Shell (SSH)
Secure Sockets Layer (SSL)
Security audits
Security awareness, training and education
Security controls
Security design and control architecture
Security domains
Security guards, guns, dogs
Security management practices and planning
Security models
Security models controls
Security modes
Security perimeter and DMZ
Security policies
Sensitive information and media handling
Sensitivity labels
Separation of duties and responsibilities
Serial Line Internet Protocol (SLIP)
Service level agreements (SLAs)
SESAME
Session hijacking
Signature-based intrusion detection systems
Simple Key Management for Internet Protocols (SKIP)
Single Sign-On (SSO)
Site Selection, Facility Design, and Configuration
Smart cards and memory cards
Social engineering
Software capability maturity model (SCMM)
Software controls
Software development models
Software licensing
Software prototyping and CASE tools
Spoofing attacks
Statistical intrusion detection
Steganography
Storage types
Stream ciphers and block ciphers
Structured Query Language (SQL)
Symmetric vs. asymmetric encryption
Synchronous vs asynchronous communications
System accountability
System and application testing
System assurance
System development life cycle
System protection mechanisms
System recovery
System-high security mode
TACACS
Take-Grant access control model
TCP and UDP
TCP/IP addressing
TCP/IP characteristics and vulnerabilities
TCP/IP model and layers
Technical physical security controls
Telecommunication infrastructures
Telecommunications continuity
Telephone fraud
Threats and vulnerabilites
Tokens
Trade secrets
Traffic analysis
Transport layer security protocols
Trap doors
Trojan horses
Trusted Computing Base (TCB)
Trusted facility management
Trusted Network Interpretation (Red Book-TNI)
Trusted recovery
Trusted systems
Two-man control
UNIX Security
User involvment
User monitoring
Uses of cryptography
Virtual Private Networks (VPNs)
Viruses
Vulnerability assessment
Wardialing
Wide Area Networks (WANs)
X.509 Digital certificates
xDSL