Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISA 1.0 - ISACA > 2.5 Roles of various function of IT (Doshi) > Flashcards

2.5 Roles of various function of IT (Doshi) Flashcards

1
Q

Role of the Board of Directors:

A

Primarily responsible for IT governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Role of the Strategy Committee:

A

(1) Advise board on IT initiative.

(2) Strategy committee generally consists of board members and specialized non-board members

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Role of the Steering Committee:

A

The IT steering committee monitors and facilitates deployment of IT resources for specific projects in support of business plans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

PRIMARY objective of the Steering Committee:

A

The role of an IT steering committee is to ensure that the IS department is in harmony with the organization’s mission and objectives. To ensure this, the committee must determine whether IS processes support the business requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

IT Processes and Business Requirements:

A

For IS department to be in in harmony with the organization’s mission and objectives, the Steering committee must determine whether IS processes support the business requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Role of the Project Steering Committee:

A

(1) The project steering committee is ultimately responsible for all costs and timetables of the project.
(2) The function of the steering committee is to ensure the success of the project.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Composition of the Project Steering Committee:

A

(1) A project steering committee usually consists of a senior representative from each function that will be affected by the new system.
(2) They provide overall direction and monitors costs and project schedules and timetables.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

User Management:

A

(1) Assumes ownership of the project and the resulting system.
(2) They review and approve deliverable as they are defined and accomplished.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

System Development Management:

A

System development management provides technical support for the hardware and software environments by developing, installing and operating the requested system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Project Sponsor:

A

(1) The Project Sponsor is the manager in charge of the business function,
(2) the owner of the data and the owner of the system under development.
(3) Provides functional specifications through functional users is the responsibility of the project sponsor.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Project Sponsor

A

(1) Assumes ownership of project and resulting systems.

(2) Provides functional requirements to review and approve deliverable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

System development management:

A

provides technical support for hardware and software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A project steering committee usually consists of

A

a senior representative from each function that will be affected by the new system. They provide overall direction and monitors costs and project schedules & timetables.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The project steering committee is ultimately responsible for

A

all costs and timetables of the project.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The function of the steering committee is to ensure

A

the success of the project. If there are factors or issues that potentially could affect planned results, the steering committee should escalate them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Sourcing Practices

A
  • Sourcing practices relate to the way an organization obtains the IS function required to support the business
  • Organizations can perform all IS functions in- house or outsource all functions across the globe
  • Sourcing strategy should consider each IS function and determine which approach allows the IS function to meet the organization’s goals
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The IS auditor can assist an organization in moving IS functions offsite or offshore by ensuring that IS management considers the following:

A 
– Legal, regulatory and tax issues
 – Continuity of operations
– Personnel
– Telecommunication issues
– Cross-border and cross-cultural issues
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Governance in outsourcing

A
  • Mechanism that allows organizations to transfer the delivery of services to third parties
  • Accountability remains with the management of the client organization
  • Transparency and ownership of the decision- making process must reside within the purview of the client
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Third-party service delivery management

A

Every organization using the services of third parties should have a service delivery management system in place to implement and maintain the appropriate level of information security and service delivery in line with third-party service delivery agreements

• The organization should check the implementation of agreements, monitor compliance with the agreements and manage changes to ensure that the services delivered meet all requirements agreed to with the third party.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

The MOST important responsibility of a data security officer in an organization is:

A. recommending and monitoring data security policies.
B. promoting security awareness within the organization.
C. establishing procedures for IT security policies.
D. administering physical and logical access controls.

A

c?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is considered the MOST critical element for the successful implementation of an information security (IS) program?

A. An effective enterprise risk management (ERM) framework
B. Senior management commitment
C. An adequate budgeting process
D. Meticulous program planning

A

B?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Five ways to use performance measures:

A
  • Measure products/services
  • Manage products/services
  • Assure accountability
  • Make budget decisions • Optimize performance
23
Q

An IS auditor should ensure that IT governance performance measures:

A. evaluate the activities of IT oversight committees.
B. provide strategic IT drivers.
C. adhere to regulatory reporting standards and definitions.
D. evaluate the IT department.

A

M

24
Q

Segregation of Duties Within IS

A
  • Avoids possibility of errors or misappropriations • Discourages fraudulent acts
  • Limits access to data
25
Q

Which of the following tasks may be performed by the same person in a well-controlled information processing computer center?

A. Security administration and change management
B. Computer operations and system development
C. System development and change management
D. System development and systems maintenance

A

?

26
Q

Which of the following is the MOST critical control over database administration?

A. Approval of DBA activities
B. Segregation of duties
C. Review of access logs and activities
D. Review of the use of database tools

A

?

27
Q

Control measures to enforce segregation of duties include:

A 
• Transaction authorization
• Custody of assets
• Access to data
– Authorization forms
– User authorization tables
28
Q

Compensating controls for lack of segregation of duties include:

A
  • Audit trails
  • Reconciliation
  • Exception reporting
  • Transaction logs
  • Supervisory reviews • Independent reviews
29
Q

When a complete segregation of duties cannot be achieved in an online system environment, which of the following functions should be separated from the others?

A. Origination
B. Authorization
C. Recording
D. Correction

A

B. Authorization

30
Q

Indicators of potential problems include:

A
  • Unfavorable end-user attitudes
  • Excessivecosts
  • Budget overruns
  • Late projects
  • Highstaffturnover
  • Inexperienced staff
  • Frequent hardware/software errors
31
Q

The following documents should be reviewed:

A 
IT strategies, plans and budgets
• Security policy documentation
• Organization/functional charts
• Job descriptions
• Steering committee reports
• System development and program change procedures
• Operations procedures
• Human resource manuals
• Quality assurance procedures
32
Q

There are various phases to computer hardware, software and IS service contracts, including:

A
  • Development of contract requirements and service levels
  • Contract bidding process
  • Contract selection process
  • Contract acceptance
  • Contract maintenance
  • Contract compliance
33
Q

Business continuity planning (BCP)

A

is a process designed to reduce the organization’s business risk
• A BCP is much more than just a plan for the information systems

34
Q

Corporate risks could cause an organization to suffer

A
  • Inability to maintain critical customer services
  • Damage to market share, reputation or brand
  • Failure to protect the company assets including intellectual properties and personnel
  • Business control failure
  • Failure to meet legal or regulatory requirements
35
Q

Business Continuity Policy

A

Defines the extent and scope of business continuity for both internal and external stakeholders
• Should be proactive

36
Q

All types of incidents should be categorized

A

Negligible
• Minor
• Major
• Crisis

37
Q

Business Impact Analysis

A

• Critical step in developing the business continuity plan
• Three main questions to consider during BIA phase:
– What are the different business processes?
– What are the critical information resources related to an organization’s critical business processes?
– What is the critical recovery time period for information resources in which business processing must be resumed before significant or unacceptable losses are suffered?

38
Q

What is the system’s risk ranking?

A
  • Critical
  • Vital
  • Sensitive
  • Non-sensitive
39
Q

Factors to consider when developing the BC plans:

A
  • Predisaster readiness covering incident response management to address all relevant incidents affecting business processes
  • Evacuation procedures
  • Procedures for declaring a disaster (escalation procedures)
  • Circumstances under which a disaster should be declared.
  • The clear identification of the responsibilities in the plan
  • The clear identification of the persons responsible for each function in the plan
  • The clear identification of contract information
  • The step-by-step explanation of the recovery process
  • The clear identification of the various resources required for recovery and continued operation of the organization
40
Q

Other Issues in BC Plan Development

A

• Management and user involvement is vital to the success of BCP
– Essential to the identification of critical systems, recovery times and resources
– Involvement from support services, business operations and information processing support
• Entire organization needs to be considered for BCP

41
Q

A business continuity plan may consist of more than one plan document

A
  • Continuity of operations plan (COOP)
  • Disaster recovery plan (DRP)
  • Business resumption plan
  • Continuity of support plan / IT contingency plan
  • Crisis communications plan
  • Incident response plan
  • Transportation plan
  • Occupant emergency plan (OEP)
  • Evacuation and emergency relocation plan
42
Q

Components of the plan

A

Key decision-making personnel
• Backup of required supplies
• Insurance

43
Q

Insurance

A 
– IS equipment and facilities
– Media (software) reconstruction 
– Extra expense
– Business interruption
– Valuable papers and records
– Errors and omissions
– Fidelity coverage
– Media transportation
44
Q

BC Plan Testing

A

• Schedule testing at a time that will minimize disruptions to normal operations
• Test must simulate actual processing conditions
• Test execution:
– Documentation of results
– Results analysis
– Recovery / continuity plan maintenance

45
Q

Business continuity plan must:

A

– Be based on the long-range IT plan

– Comply with the overall business continuity strategy

46
Q

Process for developing and maintaining the BCP/DRP

A

– Conduct risk assessment
– Prepare business impact analysis
– Choose appropriate controls and measures for recovering IT components to support the critical business processes
– Develop the detailed plan for recovering IS facilities (DRP).
– Develop a detailed plan for the critical business functions to continue to operate at an acceptable level (BCP).
– Test the plans
– Maintain the plans as the business changes and systems develop.

47
Q

Auditing Business Continuity

A
  • Understand and evaluate business continuity strategy
  • Evaluate plans for accuracy and adequacy
  • Verify plan effectiveness
  • Evaluateoffsitestorage
  • Evaluate ability of IS and user personnel to respond effectively
  • Ensure plan maintenance is in place
  • Evaluate readability of business continuity manuals and procedures
48
Q

IS auditors should verify that basic elements of a well-developed plan are evident including:

A
  • Currency of documents
  • Effectivenessofdocuments
  • Interview personnel for appropriateness and completeness
49
Q

IS auditors must review the test results to:

A
  • Determine whether corrective actions are in the plan
  • Evaluate thoroughness and accuracy
  • Determine problem trends and resolution of problems
50
Q

An IS auditor must evaluate of Offsite Storage by

A
  • Evaluate presence, synchronization and currency of media and documentation
  • Perform a detailed inventory review • Review all documentation
  • Evaluate availability of facility
51
Q

An IS auditor must Interview Key Personnel

A
  • Key personnel must have an understanding of their responsibilities
  • Current detailed documentation must be kept
52
Q

An IS auditor must Evaluation of Security at Offsite Facility

A
  • Evaluate the physical and environmental access controls

* Examine the equipment for current inspection and calibration tags

53
Q

Reviewing Alternative Processing Contract

A

• An IS auditor should obtain a copy of the contract with the vendor
• The contract should be reviewed against a number of guidelines
– Contract is clear and understandable
– Organization’s agreement with the rules

54
Q

Reviewing Insurance Coverage

A

• Insurance coverage must reflect actual cost of recovery
• Coverage of the following must be reviewed for adequacy
– Media damage
– Business interruption
– Equipment replacement
– Business continuity processing

CISA 1.0 - ISACA (51 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions