Domain 2: Governance and Management of IT Part 2A Flashcards
After an organization completed a threat and vulnerability analysis as part of a risk assessment, the final report suggested that an intrusion prevention system (IPS) should be installed at the main Internet gateways and that all business units should be separated via a proxy firewall. Which of the following is the BEST method to determine whether the controls should be implemented?
A cost-benefit analysis
After the merger of two organizations, multiple self-developed legacy applications from both organizations are to be replaced by a new common platform. Which of the following is the GREATEST risk?
The replacement effort consists of several independent projects without integrating the resource allocation in a portfolio management approach.
As a driver of IT governance, transparency of IT’s cost, value and risk is primarily achieved through:
performance measurement.
As an outcome of information security governance, strategic alignment provides:
security requirements driven by enterprise requirements.
As result of profitability pressure, senior management of an enterprise decided to keep investments in information security at an inadequate level, which of the following is the BEST recommendation of an IS auditor?
Request that senior management accept the risk.
Assessing IT risk is BEST achieved by:
evaluating threats and vulnerabilities associated with existing IT assets and IT projects.
A benefit of open system architecture is that it:
facilitates interoperability within different systems.
A business unit has selected a new accounting application and did not consult with IT early in the selection process. The PRIMARY risk is that:
the application technology may be inconsistent with the enterprise architecture.
By evaluating application development projects against the capability maturity model (CMM), an IS auditor should be able to verify that:
predictable software processes are followed.
A comprehensive and effective email policy should address the issues of email structure, policy enforcement, monitoring and:
retention.
Corporate IT policy for a call center requires that all users be assigned unique user accounts. On discovering that this is not the case for all current users, what is the MOST appropriate recommendation?
Implement individual user accounts for all staff.
During an audit, an IS auditor notices that the IT department of a medium-sized organization has no separate risk management function, and the organization’s operational risk documentation only contains a few broadly described types of IT risk. What is the MOST appropriate recommendation in this situation?
Establish regular IT risk management meetings to identify and assess risk and create a mitigation plan as input to the organization’s risk management.
During an audit, the IS auditor discovers that the human resources (HR) department uses a cloud-based application to manage employee records. The HR department engaged in a contract outside of the normal vendor management process and manages the application on its own. Which of the following is of GREATEST concern?
During an audit, the IS auditor discovers that the human resources (HR) department uses a cloud-based application to manage employee records. The HR department engaged in a contract outside of the normal vendor management process and manages the application on its own. Which of the following is of GREATEST concern?
Effective IT governance ensures that the IT plan is consistent with the organization’s:
business plan.
Effective IT governance requires organizational structures and processes to ensure that:
the IT strategy extends the organization’s strategies and objectives.
An enterprise’s risk appetite is BEST established by:
the steering committee.
Errors in audit procedures PRIMARILY impact which of the following risk types?
Detection risk
Establishing the level of acceptable risk is the responsibility of:
senior business management.
A financial enterprise has had difficulties establishing clear responsibilities between its IT strategy committee and its IT steering committee. Which of the following responsibilities would MOST likely be assigned to its IT steering committee?
Approving IT project plans and budgets
A financial services enterprise has a small IT department, and individuals perform more than one role. Which of the following practices represents the GREATEST risk?
The developers promote code into the production environment.
Forahealthcareorganization,whichone of the following reasons MOST likely indicates that the patient benefit data warehouse should remain in-house rather than be outsourced to an offshore operation?
Thereare regulations regarding data privacy.
From a control perspective, the key element in job descriptions is that they:
establish responsibility and accountability for the employee’s actions.
From an IT governance perspective, what is the PRIMARY responsibility of the board of directors? To ensure that the IT strategy:
is aligned with the business strategy.
The initial step in establishing an information security program is the:
adoption of a corporate information security policy statement.
In the context of effective information security governance, the primary objective of value delivery is to:
optimize security investments in support of business objectives.
Involvement of senior management is MOST important in the development of:
strategic plans.
An IS audit department is planning to minimize the risk of short-term employees. Activities contributing to this objective are documented procedures, knowledge sharing, cross-training and:
succession planning.
An IS auditor discovers several IT- based projects were implemented and not approved by the steering committee. What is the GREATEST concern for the IS auditor?
The IT department may not be working toward a common goal.
An IS auditor finds that not all employees are aware of the enterprise’s information security policy. The IS auditor should conclude that:
this lack of knowledge may lead to unintentional disclosure of sensitive information.
An IS auditor found that the enterprise architecture (EA) recently adopted by an organization has an adequate current-state representation. However, the organization has started a separate project to develop a future-state representation. The IS auditor should:
report this issue as a finding in the audit report.
An IS auditor has been assigned to review an organization’s information security policy. Which of the following issues represents the HIGHEST potential risk?
The policy is approved by the security administrator.
An IS auditor identifies that reports on product profitability produced by an organization’s finance and marketing departments give different results. Further investigation reveals that the product definition being used by the two departments is different. What should the IS auditor recommend?
Organizational data governance practices are put in place
An IS auditor is evaluating a newly developed IT policy for an organization. Which of the following factors does the IS auditor consider MOST important to facilitate compliance with the policy upon its implementation?
Existing IT mechanisms enabling compliance
An IS auditor is evaluating management’s risk assessment of information systems. The IS auditor should FIRST review:
threats/vulnerabilities affecting the assets.
An IS auditor is evaluating the IT governance framework of an organization. Which of the following is the GREATEST concern?
Senior management has limited involvement.
An IS auditor is performing a review of an organization’s governance model. Which of the following should be of MOST concern to the auditor?
The information security policy is not periodically reviewed by senior management.
An IS auditor is performing a review of the software quality management process in an organization. The FIRST step should be to:
request all standards adopted by the organization.
An IS auditor is reviewing an IT security risk management program. Measures of security risk should:
consider the entire IT environment.
An IS auditor is reviewing the risk management process. Which of the following is the MOST important consideration during this review?
IT risk is presented in business terms.
An IS auditor is verifying IT policies and finds that some of the policies have not been approved by management (as required by policy), but the employees strictly follow the policies. What should the IS auditor do FIRST?
Report the absence of documented approval.
An IS auditor of a large organization is reviewing the roles and responsibilities of the IT function and finds some individuals serving multiple roles. Which one of the following combinations of roles should be of GREATEST concern for the IS auditor?
System administrators are application programmers.
An IS auditor reviewing the IT organization is MOST concerned if the IT steering committee:
is responsible for determining business goals.
An IS auditor reviews an organizational chart PRIMARILY for:
understanding the responsibilities and authority of individuals.
An IS auditor was hired to review e- business security. The IS auditor’s first task was to examine each existing e-business application, looking for vulnerabilities. What is the next task?
Identify threats and the likelihood of occurrence.
