Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ISACA CISA Online Review > DM2: IT Governance > Flashcards

DM2: IT Governance Flashcards

1
Q

involves practices by which an enterprise is directed and controlled, including ethical issues, decision making, and overall practices within the organization

A

corporate governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

leadership and organizational structures and processes that ensure enterprise IT sustains and extends strategies and objectives

A

IT governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

System comprised of stakeholders, Board members, senior mgmt, customer, and other departments that participate in IT decision making processes

A

Enterprise governance of information and technology (EGIT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Guides the development and management of a comprehensive and cost-effective information security program

A

information security framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Who is responsible for information security governance?

A

CEO and Board of Directors through management and resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

information security strategy to measure, monitor, and report on information security processes to ensure objectives are met.

A

Performance management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

information security strategy to use information security knowledge and infrastructure wisely.

A

Resource management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

information security strategy to combine different assurance processes as one complete process

A

Process Integration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

who are the main contributors of IT Strategic Plans?

A

IT Dept. Management, IT Steering Committee, and Strategy Committee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The IT Strategic Plan should consider:

A

1) Functional fit of IT infrastructure and key support processes
2) ROI of existing IT and legacy systems
3) maintenance cost of existing systems and costs of new initiatives/systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

IT Strategic plans should be synchronized with overall business strategy.

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Operation and business development plans should be considered in IT Strategy.

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Business goals should be considered when updating and communicating IT Strategy.

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is needed to deliver effective Business Intelligence?

A

A data governance architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the two components of a data architecture?

A

enterprise data flow architecture (EDFA) and logical data architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Data flow layer where end users directly deal with information and includes desktop tools like spreadsheets, querying tools, reporting suites, and other applications.

A

Presentation Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Data flow layer where enterprise information is stored from sources like operational data, external data, and nonoperational data.

A

Data source layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

where all (or most) of organizational data is captured and organized to assisted with reporting and analysis.

A

Core Data Warehouse (CDW)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Data flow layer where multiple subsets of information from data warehouse are selected and organized to meet needs of a specific business unit. Ex. OLAP

A

Data mart layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Data flow layer responsible for data copying, transformation into
DW format and quality control.

A

Data staging and quality layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Data flow layer used to connect the data storage and quality layer with data stores in the data source layer and, in the process, avoiding the need to know exactly how these data stores are organized.

A

Data access layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Data flow layer that is concerned with the assembly and preparation of data for loading into data marts.

A

Data preparation layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Data flow layer that includes “data about data”

A

Metadata Repository Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Data flow layer that is used to schedule tasks necessary to build and maintain the data warehouse and populate data marts

A

Warehouse Management Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Data flow layer concerned with transporting information between
the various layers. In addition to business data, this layer encompasses generation, storage and targeted communication of control messages.

A

Application messaging layer

26
Q

Data flow layer concerned with basic data communication. Included here are browser-based user interfaces and TCP/IP networking.

A

Internet/Intranet layer

27
Q

Data diagram model used to deconstruct and visualize business processes

A

Swim-lane diagrams

28
Q

Data diagram model used to outline major processes of an organization and the external parties with which the business interacts

A

Context diagrams

29
Q

EGIT framework that ensures:
-IT is aligned with the business
-IT enables the business and maximizes benefits
-IT resources are used responsibly
-IT risks are managed appropriately

A

COBIT

30
Q

EGIT framework that is a set of best practices to guide organizations in implementing and maintainig information security programs.

A

ISO/IEC 27000

31
Q

EGIT framework focused on service management and how to achieve successful operational service management of IT and deliver business value

A

ITIL

32
Q

Maturity model that focuses on security

A

O-ISM3

33
Q

EGIT framework providing guiding principles on the effective, efficient, and acceptable use of IT within an organization.

A

ISO/IEC 38500:2015

34
Q

EGIT framework that is a specification for service management and includes specific requirements for service management improvement and guidance for application

A

ISO/IEC 20000

35
Q

practices intended to keep products and services reliable and effective; they prescribe how to accomplish something

A

standards

36
Q

What should an information security policy include?

A

-organization’s definition of information security, objectives, and scope
-management goals and strategies
-framework for setting objectives and controls (risk assessment/management)
-explanation of policies, standards, and compliance requirements
-definitions of responsibility of information security maangement
-documentation references to policies

37
Q

The information security policy should be communicated in an accessible and understandable manner.

A

TRUE

38
Q

high-level policy that includes statements on confidentiality, integrity, and availability.

A

Information management policy

39
Q

policy that generally includes information for all information resources and describes the permissions for the usage of IT and IT related resources

A

acceptable use policy

40
Q

policy that describes method for defining and granting users the access to IT resources

A

access control policy

41
Q

policy that describes the classification of data, levels of control of each classification, and the responsibilities and ownership of users

A

data classification policy

42
Q

policy that describes the parameters of and usage of desktop, mobile computing, and other tools (ex. remote work)

A

end-user computing policy

43
Q

When should information security policies be updated?

A

1) at least annually
2) after significant changes in enterprise operations
3) when new security risk is identified

44
Q

What are some things that should be considered when management performs reviews of the information security policy?

A
  • stakeholder feedback
  • results from other independent and management reviews
  • status of current actions
  • use of outsourcing
  • current trends
  • reported security incidents
  • recommendations from relevant authorities
45
Q

Board of Directors should ensure that the organization follows laws, behaves ethically, and uses resources effectively

A

TRUE

46
Q

Board of Directors should be aware of information assets and their criticality to the business

A

TRUE

47
Q

Board of Directors should periodically review comprehensive risk assessments and business impact analysis

A

TRUE

48
Q

Board of Directors should conduct business dependency assessments of information resources

A

TRUE

49
Q

What is the role of an Information Security Steering Committee?

A

1) facilitate consensus on priorities and trade-offs
2) communicate effectively across the organization
3) confirm that security and business objectives are aligned
4) encourage desired organizational behaviors

50
Q

What is the IT Steering Committee?

A

committee that verifies if the IT department is aligned with corporate mission and objectives;

51
Q

What is the role of an IT Steering Committee?

A

1) review long/short term plans of the IT dept. to ensure they align with corporate objectives
2) review/approve major IT acquisitions
3) approve/monitor projects and budgets
4) review/approve resource strategies (in-/outsourcing)
5) determine centralization level of IT
6) develop/support information security management program
7) report to the Board of Directors the above activities

52
Q

IT position responsible for programmers and analyst who implement raw systems and maintain existing systems

A

Systems Development Manager

53
Q

Lack of segregation of duties can lead to:

A

1) misappropriation of assets
2) misstated financial statements
3) inaccurate reporting
4) improper use of funds
5) unauthorized changes to data/programs

54
Q

What are some compensating controls for lack of segregation of duties?

A

audit trails, reconciliation, exception reporting, transaction logs, supervisory reviews, independent reviews

55
Q

What are some of the documents that should be reviewed by an IS auditor for governance?

A

IT strategies, security policy documentation, org charts, job descriptions, IT steering committee reports, change program documents, operational procedures, HR manuals, QA procedures

56
Q

Documenting of an organizations IT assets in a structured manner to facilitate understanding, management, and planning for IT investments

A

Enterprise Architecture (EA)

57
Q

Enterprise architecture that attempts to clarify the complex technology choices faced by modern organizations.

A

Technology-driven EA

58
Q

Enterprise architecture that attempts to understand an organization in terms of its core value-adding and supporting processes.

A

business-driven EA

59
Q

What activity involves identifying vulnerabilities and threats to the information resources of an organization and deciding the safeguards to reduce the risk to an acceptable level?

A

Risk management

60
Q

What is the first step for creating a risk management program?

A

establishing the purpose of the program and define KPI’s to evaluate effectiveness of the program

61
Q

What is the second step for creating a risk management program?

A

Designating individuals or team to develop and implement the risk management program

62
Q
A

ISACA CISA Online Review (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions