Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ISACA CISA Online Review > DM4: IS Business Resilience and Maintenance Management > Flashcards

DM4: IS Business Resilience and Maintenance Management Flashcards

1
Q

What is the purpose of using separate conduits for data and electrical cables?

A

To reduce data corruption due to magnetics fields created by electrical currents.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the primary operating system access control functions?

A

log user activities and log events (think Event Viewer on PC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which types of cabling are insecure?

A

Coaxial and copper wire

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which type of cabling is most secure?

A

Fiber optic cable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the risks involved in spooling printed reports for offline printing?

A

Additional report copies can be printed by unauthorized individuals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a common gateway interface (CGI)?

A

it’s the standard way for a web server to pass a user’s request to an application and move data back and forth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the common types of enterprise back-end devices?

A

print servers, file servers, application servers, web servers, proxy servers, database servers, and appliances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are enterprise appliances (specialized devices)?

A

devices that provide a specific services such as firewalls, IDS’s, IPS’s, switches, routers, VPNs, and load balancers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the purpose of a proxy server?

A

the provide a link between users and resources and access resources on behalf of the user, sometimes providing more secure and faster response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the common risks related to USBs?

A

viruses and malicious software;
data thefts;
data/media loss;
corruption of data;
loss of confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are some security controls for use of USBs?

A

encryption;
granular control;
security personnel education;
locked desktop policies;
antivirus policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are areas to review when auditing a hardware maitenance program?

A

hardware acquisition plan;
actual acquisition;
IT asset management;
capacity management;
preventative maintenance schedule;
problem logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What information do you need for each asset in an IT asset management system?

A

Owner, designated custodian, ID of asset, value of asset, loss implication/priority, location, security classification, asset group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What does a job scheduling software provide?

A

control over scheduling jobs, tape backups, and other maintenance activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What should be done for high-priority jobs in a job scheduler?

A

they should be given optimal resources and be performed in nonpeak times

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

In regards to system interfaces, what is a critical area that should be verified?

A

data residing on sending systems are precisely the same data being recorded in the receiving system; encryption is being used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the goal of data governance?

A

stakeholder needs can be managed;
direction for data management;
performance management;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the three types of data quality?

A

intrinsic, contextual, and security/accessibility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is intrinsic data quality?

A

the extent to which data values are in conformance with actual or true values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is contextual data quality?

A

the extent to which information is applicable to the task of the information user and is presented in an intelligible and clear manner, recognizing that information quality depends on the context of use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is accessibility data quality?

A

the extent to which information is available or obtainable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the five phases of the data life cycle?

A
  1. Plan
  2. Design
  3. Build/Acquire
  4. Use/Operate
  5. Monitor
  6. Dispose
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the FIRST 3 phases of the data life cycle and their purpose?

A
  1. Plan - creation, acquisition, and use of the information resource is prepared. (E.g., understanding information, value of information, identifying objectives)

2 - Design - how the information will look and how the systems processing the information will have to work (e.g., standards, data definitions)

  1. Build/acquire - when the information resource is actually acquired (e.g., creation of data, purchase of data, loading of data)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the LAST 3 phases of the data life cycle and their purpose?

A
  1. Use/operate - storing/sharing/use of information resources
  2. Monitor - ensuring that information resources continue to work properly
  3. Dispose - information is transferred or retained for a specified period, destroyed, or archived
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the significance of Operating System (OS) integrity?

A

protects itself from deliberate and inadvertent modification;
ensures that privileged programs cannot be interfered with by user programs;
provides process isolation to ensure that concurrent processes wont interfere with each other and least privilege is enforced for processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is one way to protect system logs from being altered by intruders?

A

Using a security information and event management (SIEM) software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the three components of a data communication system?

A
  1. transmitter (source)
  2. transmission patch (channel or line)
  3. receiver
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a utility program?

A

system software used to perform maintenance and routines that frequently are required during normal processing operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the primary functional uses of a utility programs?

A

understanding application systems; assessing or testing data quality; testing a programs ability to function correctly; assisting in faster program development; improving operational efficiency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are the two types of licensing?

A

free and paid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are example of free licensing?

A

open source, freeware, shareware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are examples of paid licensing?

A

licensing per: CPU, seat, concurrent user, utilization, workstation, enterprise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

If reviewing licensing for an organization, what should an IS auditor look for?

A

list of all standard, used, and licensed software;
all contracts;
network scans of software;
compare contracts to installed software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is capacity management?

A

the planning and monitoring of computing and network resources to ensure that the available resources are used efficiently and effectively

35
Q

What are the benefits and drawbacks of application stacking?

A

benefits:
allows the organization to make better use of resources as apps are consolidated to large servers

drawbacks:
increases the impact of a server outage and affects more applications when a server needs to be shut down

36
Q

What is the first step of a capacity management plan?

A

understanding of current and future requirements for IT resources

37
Q

What is the difference between problem and incident management?

A

problem management focuses on resolving issuing through investigation and analysis of a major incident or several incidents that a similar to find a root cause; incident management focuses on providing increased continuity of service by reducing disturbances to IT services

38
Q

What is an essential step of incident handling?

A

determining impact and urgency then prioritizing based on these values

39
Q

What is the goal of service-level management?

A

maintain and improve customer satisfaction and to imporve the service delivered

40
Q

What are major considerations for SLA delivery?

A

accuracy, completeness, timeliness, security

41
Q

Why is a data definition language (DDL) implemented in on a DBMS?

A

creates a schema representation used to interpret and respond to users request.

42
Q

What is a data dictionary/directory system (DD/DS) used for?

A

to define and store source and object forms of all data definitions for external schemas, conceptual schemas, the internal schema, and all associated mappings

43
Q

What functions does a data dictionary/directory system (DD/DS) serve?

A

data definition language (DDL) processor;
validation of defintions;
prevention of unauthorized access to metadata;
interrogation and reporting facilities for DBAs

44
Q

What are the three types of DBMS structures?

A

network, hierarchical, relational

45
Q

What is a network DBMS structure?

A

data modeling is based on “sets” created by owner and member record types.

46
Q

What is a hierarchical DBMS structure?

A

data is structured in parent and child segments and typically 1:N relationships. child segments can have only one parent segment so duplication is necessary for multiple relationships

47
Q

What is a relational DBMS structure?

A

you know what a relational DBMS is… tables, views, keys, etc.

48
Q

What does normalization of a relational DBMS accomplish?

A

minimizes the amount of information needed in tables to satisfy queries

49
Q

What is the most important thing to consider when reviewing databases?

A

integrity

50
Q

What are the main considerations of when performing a BIA?

A

the importance and criticality of each process;
what are the critical information resources;
what is the critical recovery time period

51
Q

What are the four classifications of systems in a BIA?

A

critical, vital, sensitive, noncritical

52
Q

What is the difference between the four classifications of systems?

A

Critical - functions cant be performed unless completely replaced (non-manual methods). Very low interruption tolerance and very high cost of interruption.

Vital - functions that can be performed manually but only for a short period. High tolerance to interruption and lower costs of interruption if corrected within 5 days.

Sensitive - can be performed manually at a tolerable cost for an extended period of time, though may be difficult.

Nonsensitive - can be interrupted for an extended period of time at little to no cost

53
Q

What is a cluster (clustering)?

A

protects from single point of failure; type of software/agent that is installed on every server/node in which the application runs and includes management software that permits control of and tuning the cluster behavior,

54
Q

What is an active-active cluster?

A

The application runs on every node in a cluster and information processing is coordinated between all the nodes, providing load balancing and concurrent data access.

This also has impacts on network latency

55
Q

What is an active-passive cluster?

A

The application runs on only one node and other nodes are used if the application fails on the active node and is viable for application availability

56
Q

What is alternate routing?

A

method of routing information via an alternate medium using different networks, circuits, and end points in case the primary network is not available

57
Q

What is diverse routing?

A

method of routing traffic through split cable facilities or duplicate cable facilities, either in separate or the same conduits.

58
Q

What are the four types of disk-based backup systems?

A

virtual tape libraries; host-based replication; disk-array-based replication; snapshots

59
Q

How do virtual tape libraries (VTL) function?

A

Consist of disk storage and software that control backup and recovery data sets. Data is stored on a disk array and VTL disks are replicated from a primary site to a backup site using hardware based replication

60
Q

How does host-based replication work?

A

executed at the server level, this replication occurs in real-time or with some delay. Data is not written to the primary site until confirmation is received that the data was successfully written to the backup site

61
Q

What is the first step of preparing a BCP?

A

identifying the business processes of strategic importance

62
Q

What is the first step of the risk management process?

A

a risk assessment

63
Q

What should a risk assessment consider?

A

resources (HR, data, infrastructure); potential vulnerabilities; existing risk mitigation controls; probability of impact

64
Q

What should be considered when establishing a BCP?

A

critical operations for the survival of an organization;
human/material resources needed to support them

65
Q

In a BCP, the value of an application is proportional to what?

A

the role of the system in supporting the strategy of the organization

66
Q

Steps should always be taken to reduce the likelihood of disruption, what are possible methods of doing this?

A

considering location (environmental risks); use resilient network topographies (alternative routing, etc.)

67
Q

What is one KEY output of a risk assessment when examining an organization with multiple systems?

A

a dependencies map of critical business processes and applications with documented threats and vulnerabilities to these dependencies

68
Q

Why is a business continuity POLICY important?

A

it is a communication to internal stakeholders regarding the efforts and expectations;
its a communication to external stakeholders to show the organization is taking it seriously;
it states and empowers those who have responsibility;
includes guiding principles

69
Q

What are the four levels of incidents?

A

negligible, minor, major, crisis

70
Q

What plan documents SHOULD a BCP include?

A

continuity of operations plan;
disaster recovery plan;
business resumption plan

71
Q

What plan documents MIGHT, though dependent on the organization, a BCP include?

A

continuity of support plan;
IT contingency plan;
incident response plan;
transportation plan;
occupant emergency plan;
evacuation plan;
relocation plan

72
Q

When test a BCP, what should be accomplished?

A

verify the completeness and precision of BCP;
evaluate the performance of the personnel in the test;
evaluate training and awareness of employees not on BCP team

73
Q

What should be done following the completion of a BCP test?

A

Results analysis; considering elapsed time, amount of work, total vital records secured, and accuracy

74
Q

Who is responsible for maintaining a BCP?

A

BCP coordinator (most often)

75
Q

What are some of the responsibilities of a BCP coordinator when maintaining a BCP?

A

scheduling periodic reviews,
call for revisions;
coordinate tests;
develop training;
maintain records of training

76
Q

When reviewing the BCP, what are the major steps an IS Auditor should take?

A
  1. review the document
  2. review the applications covered by the plan
  3. review the established teams
  4. review plan testing procedures
  5. evaluate prior results
  6. evaluate offsite storage and offsite security
77
Q

What should be considered when evaluating an organizations offsite storage facility?

A

the presence, synchronization, and curreny of critical media and documentation (e.g., data files, application software, application documentation, operations documentation)

78
Q

What should an IS auditor look for when reviewing the contract with the alternative processing facility?

A

to ensure reliability and that all agreeements are documented; ensure that insurance covers aligns with disaster expenses; ensure that tests are done at hot sites regularly; recourse of breach of contract

79
Q

What is an RTO and what is it used for?

A

Recovery time objectives (RTO) are used to determine the acceptable downtime of a system and is the earliest point in time in which operations must resume

80
Q

What is an RPO and what is it used for?

A

Recovery point objectives (RPO) are used to determine the acceptable data loss and is the earliest point in time in which data can be recovered

81
Q

If an application has a low RPO, what type of recovery strategy would be useful? A high RPO?

A

LOW - means that it cannot handle much data loss and needs near real-time data strategy (e.g., mirroring, replication, disk backups, snapshots)

HIGH: means it can accept loss of data. tape backups, log shipping

82
Q

If an application has a low RTO, what type of recovery strategy would be useful? A high RTO?

A

LOW - means that is must be re-initialized quickly (e.g., active-active clusters, active-passive clusters,, hot standby)

HIGH - less quick recovery (e.g., cold standby)

83
Q

What are some examples of incidents where a DRP may need to be invoked?

A

loss of network connection;
loss of key IT system;
loss of a processing site;
loss of critical data;
loss of an office;
loss of key service provider

84
Q
A

ISACA CISA Online Review (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions