Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Data+ > Chapter 8 - Data Governance > Flashcards

Chapter 8 - Data Governance Flashcards

1
Q

what umbrella term is a business function that is the set of policies, procedures and controls that an organization develops to safeguard its information while making it useful and accessible

A

Data Governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What two things are vital for any data governance program?

A

1) Strong Executive/Management support
2) All levels of the org must understand the important of well-governed data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what term describes the act of devloping the POLICIES and PROCEDURES for looking after an organizations data quality, security, privacy and regulatory compliance?

A

Data Stewardship

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which role is RESPONSIBLE for data stewardship?

A

Data Stewards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which role forms the link between technical and non-technical divisions within an organization and works with data owners to establish policies?

A

Data Steward

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A data owner is usually a ____ business _____ with overall ___________ for a specific data _________

A

A data owner is usually a SENIOR business LEADER with overall RESPOSIBILITY for a specific data DOMAIN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

WHAT contains data about a particular operational division?

A

data domain or data subject area

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which two data roles work with each other to establish policies and procedures for their domain?

A

The DATA OWNER works with the DATA STEWARD to establish/define policies and procedures for their domain?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

if the data owner and data steward establish policies and procedures, which two roles work together to implement those data governance policies?

A

The SUBJECT AREA DATA STEWARD works with the DATA CUSTODIAN to IMPLEMENT the data governance policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which role does the actual implementing or operation of the technical controls execute data governance policies?

A

The DATA CUSTODIAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

which tool is used in data governance to define data categories, descriptions and disclosure implications for data?

A

The DATA CLASSIFICATION MATRIX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what is vital to consider about the data when developing access requirements to ensure proper data stewardship?

A

data classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

the broad classifications of data are agreed between who?

A

The Data Steward and the Data Owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

which two roles work to develop the procedures for granting access to information?

A

The Data Steward and the Subject Area Data Steward

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

a role-based access approach facilitates maintenance of __________ and improves _________. I

A

a role-based access approach facilitates maintenance of PERMISSIONS and improves CONSISTENCY.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

An org chart can help inform how you develop what in regards to data?

A

roles for role-based access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what policy describes the access requirements data subject area and access type, including reading, creating, updating and deleting?

A

Access Control Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

before sharing data with an outside party, what should you establish with them?

A

A Data Use Agreement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Regarding sharing data with another company, what must you implement if sharing information regarding research on human subjects?

A

An Institutional Review Board

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

body that reviews and approves sharing of data regarding research using human subjects.

A

institutional review board

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is essential to understand when drafting a Data Use Agreement?

A

The Data Classification for each piece of data to shared

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

The Data Usage Agreement provides details governing what 3 things about the data?

A

The Transfer
The Usage
And Disclosure Protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

what are the two most common locations for data-at-rest?

A

Databases and flat files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What do Oracle and Microsoft use to encrypt data and LOG FILES?

A

TDE (Transparent Data Encryption)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Johnny is entering data into a web-form, what should he check before he enters it?

A

Should check for a padlock icon in the browser.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What encryption protocols should you use to encrypt the copying of data between transactional and analytical system in an ETL process?

A

SFTP or SCP (Secure Copy Protocol)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Tilly wants load data into a training data base. She doesn’t have any test data and only has production data. She needs to ensure she doesn’t copy over sensitive information. What could she do to ensure it doesn’t get copied across?

A

She can implement Data Masking Strategy to ensure sensitive data isn’t revealed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Fran is sharing data with an external 3rd party. Some of the data is sensitive. She decides she will de-identify the data to prevent identification. Is this enough?

A

No. She must consider the re-identification possibilities and remove absolutely every variable that is not needed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What considering storage environment requirements and on a shared drive in particular, what’s the safest way to manage share drive permissions to control access to data?

A

Identifying user groups and create roles for those groups and assigning users to them.

as opposed to file based/individual permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What’s the risk around using cloud-based collaboration by design like Google Docs? What should you considered as a mitigation?

A

The ability to share documents resides with the individual who created the documents that are collaborated on. You need to ensure there is suitable administrative controls to combat this.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

When storing data in the cloud, how can you minimize the risk that only authorized people have access to your data (and not the cloud provider!)?

A

By use of a customer-managed encryption key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Regarding data retention. Bob fires Alice for poor performance. How long is he legally obliged to store her employment data for?

A

1 year from termination date

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Regarding data retention, how long are US companies legally obliged to store tax data?

A

7 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What requirements define how to collect, process, use, store, retain and remove data?

A

Use Requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Regarding data retention, apart from legal obligations of retaining data, what other reason would you store data?

A

You’d store data if it had a particular organizational significant and then use that for statistical trending

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which policy describes acceptable locations for storing proprietary information, what do to when data loss occurs, and methods of disposal?

A

Acceptable Use Policy

37
Q

Freya has recently joined a company and needs to understand what her responsibilities are around accessing and using data. Which policy or document should she be familiar with?

A

The Acceptable Use Policy

38
Q

which other document would you typically need when crafting an acceptable use policy? Why?

A

The Data Classification Matrix
So you can describe what how the data in each classification should be handled

39
Q

You’re creating entity relationship diagrams. Thinking about good data governance, what should you ensure?

A

That foreign keys are used to implement data constraints

40
Q

Clive is conducting a review of data governance. What diagrams should he check in relation to database design? What should he check for?

A

Entity Relationship Diagrams

He should check for (duplicate data) record linkage and create a linking table to associate the duplicate data to a master record

41
Q

Which 3 standards mentioned in the book simplyify, and help guide you on data classification process?

A

NIST definitions of Personally Identifiable Information

Protected Health Information defined under HIPAA

Card Holder Data and Sensitive Authentication Data under PCI

42
Q

Associated the following data elements with either linked or linkable PII

passport number
state
gender
full name
email address
login credentials and passwords
race

A

passport number - linked
state - linkable
gender - linkable
full name - linked
email address - linked
login credentials and passwords - linked
race - linkable

43
Q

How many data elements does HIPAA define as PHI?

A

18

44
Q

Regarding PHI, the first 3 digits of a zip code are not considered PHI, but when would this change?

A

If the city in which the zip code applies contains fewer than 20,000 people, it becomes PHI

45
Q

Describe the two provisions in HIPAA for when you need to share patient data without their consent

A

Expert Determination

Safe Harbour

46
Q

Regarding PHI, what is the name of the guidance that HIPAA describes on how digital records of patient data should be handled?

A

The Security Rule

47
Q

The PHI provisions in HIPAA only apply to what? And what are they?

A

They only apply to COVERED ENTITIES
Covered entities are:
most medical facilities

48
Q

What are the implications for a health insurance company if any of the below are processed electronically?

Payment and remittance
Claims Status
Enrollment
Referrals
Premium payment

A

They are all e-HPI. The company becomes a COVERED ENTITY and need to implement the Security Rule which applies to e-HPI

49
Q

Medical companies that process patient data may need to work with business partners, for instance to store data. What must they ensure and how is this done?

A

They must ensure that the provisions set out in HIPAA extend to the business partner. This is done by arranging a Business Associate Agreement.

50
Q

What does a Business Associate Agreement do?

A

It ensures that any business partner of a company that handles PHI also must abide by HIPAA standard.

51
Q

which three data elements about an individual are not considered PHI by HIPAA?

A

Employment records
Student educations covered by FERPA
Deidentified data

52
Q

If you’re a data analyst working in a healthcare environment, which two rules do you need to be aware of? What do they define?

A

The Security Rule - defines how e-PHI data should be handled
The Privacy Rule - defines how patient privacy (all other PHI data) should be protected

53
Q

Joni is an analysis working for a medical company and is handling PHI. She’s unsure about the rules. Who should she work with to ensure she isn’t breaking any rules?

A

the legal department of the company who specialise in privacy

54
Q

What are the two primary categories of data according to PCI DSS?

A

CHD (Cardholder Data)
SAD (Sensitive Authentication Data)

55
Q

Of the below elements of card data, match the element (cardholder data or sensitive authentication data) to the card data category

cardholder name
PIN
complete track data
account number
expiration
CCV
service code

A

cardholder name - cardholder data
PIN - sensitive authentication data
complete track data - sensitive authentication data
account number - cardholder data
expiration - cardholder data
CCV - sensitive authentication data
service code - cardholder data

56
Q

when thinking through regulatory and legal compliance data governance, what 4 categories around this must you consider about the jurisdiction within which your company operates?

A

Criminal Law
Civil Law
Administrative Law
Regulations

57
Q
  1. VERIFY
  2. STOP
  3. ASSESS (impact)
  4. NOTIFY (parties)
  5. CORRECT
  6. REVIEW

What are these steps for?

A

Steps that need to be taken following a data breach

58
Q

If a breach notification is triggered in the United states for PHI, what’s the rule called and who does list notification requirements for?

A

It’s called the Breach Notification Rule.

59
Q

In the European Union, how long is the breach time notification specified by GDPR?

A

72 hours.

60
Q

What is the name of the discipline who’s goal it is to ensure there’s only a single source of truth for SHARED data assets in an organization?

A

Master Data Management

61
Q

which document that contains information about data structures is essential for MDM to work effectively?

A

Data Dictionary

62
Q

What are all these drivers for?

The need to have consistent information
Need to streamline data access
Reducing compliance costs
Reducing complexity in Mergers and acquisitions

A

MDM adoption

63
Q

What are the two key MDM processes mentioned in the book?

A

Translation process (to map external data to your internal structure)

Maintaining a data dictionary

64
Q

one of the drivers for MDM is streamlining data access. What was one method mentioned in the book?

A

The implementation of APIs to access single source of data

65
Q

why does a role-based access control approach make auditing of permissions easier?

A

Auditors can focus on role assignments instead of individial user permissions

66
Q

term used to describe when you duplicate data in multiple systems

A

Record Linkage

67
Q

TAble maintained by the MDM system that maps records from multiple systems to a master ID?

A

Record Linkage Table

68
Q

type of data that balances utility and privacy when handling PII and allows aggragation of data without compromising individual privacy

A

Linkable data

69
Q

One of two provision in HIPAA when you need to share patient data:

involves use of statistical/scientific methods to minimize risk of identifying an individual

A

Expert Determination

70
Q

One of two provision in HIPAA when you need to share patient data:

involves de-identifying a data set by removing any PHI data elements.

A

SAFE HARBOUR

71
Q

Document that defines an individual’s responsibilities when accessing, using, sharing and removing data

A

Acceptable Usage Policy

72
Q

CCV
Complete Track Data
PIN

Types of data in PCI - DSS

A

Sensitive Authentication Data

73
Q

Which regulatory notification regarding data privacy states requirements for the below people to follow?

individuals
the media
the Secretary of Health
and Human Services

A

HIPPA’s Breach Notification Rule

74
Q
A
75
Q

Storage costs is one aspected of determining what?

A

What data should be stored

certmaster q. I disagree, It should the org value of the data

76
Q

type of object - permissions are specific to users in that group regardless of the role

A

User Group

77
Q

aggregated data by group, is a technique used to de-identify data.

A

BANDING

78
Q
A
79
Q

Agreement - defines the conditions under which an entity (such as a person or supplier) cannot disclose information to outside parties.

cm

A

Non-disclosure agreement

80
Q

involves hiding that type of field by showing something else in its place, like an asterisk.

A

MASKING

81
Q

what should a data scientist pay attention to as data passes through the data life cycle?

CM

A

Accountability

Accountability means these policies are being followed, and there are accountability measures in place to ensure the policies are followed.

82
Q

KPI percentage target for critical data

cm

A

95%

83
Q

KPI percentage for data that is important but not critical

cm

A

80%

84
Q

KPI percentage for non-critical data

cm

A

70%

85
Q

MDM data management helps ??? data from multiple systems

cm

A

Consolidate

86
Q

Anotehr word for linking data sets together

cm

A

Consolidation

87
Q

Regarding projects, refining business questions is important to avoid what?

A

Scope Creep

88
Q

defines how to accomplish the desired state through the development of a project

A

Scoping

scope includes measurable tasks

89
Q

report for Occupational Safety and Health Administration (OSHA) standards.

What type of report is this? Select all that apply
Compliance
Safety
Health
Finance

A

Compliance

Safety

CompTIA Data+ (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions