Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISA > Domain 2: Governance & Management of IT > Flashcards

Domain 2: Governance & Management of IT Flashcards

1
Q

What is the difference between Governance and Management?

A

Governance aims to provide a strategy to obtain business objectives. Managment aims to implement procedures to achieve the business objectives set by the governance body.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the primary reason an IS auditor should reviw the organisational chart?

A

To understand the structure of the organisation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Who has the final responsibility for IT governance?

A

Board of directors / CEO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What should IT departments do in order to achieve the organisations objectives?

A

The IT department should have long and short-term plans that are consistent with the organisation’s buisness objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a greatest concern with respect to an organisations governance model?

A

Senior mangement does not review information security policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Having approved suppliers for the company’s products is related to what?

A

Strategic planning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Who is responsible for IT governance?

A

The board of directors. They are required to ensure that IT activities are moving in the desired direction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

An IT strategic plan should contain?

A

The IT strategic plan must contain a clear statement regarding the mission and vision of IT.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the main objective of IT governance?

A

Ensuring the optimal use of technology resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the primary purpose of corporate governance?

A

Corporate governance provides a strategic direction to the organisation as a whole.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is COBIT?

A

The Control Objective for Information Technology is an EGIT framework that ensures IT is aligned with business objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is ISO27001?

A

ISO 27000 is a set of best practices for information security programs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is ITIL?

A

The Information Technology Infrastructure Library is a detailed framework for the operational service management of IT.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is O-ISM3?

A

The Open Information Security Management Maturity Model is a process-based ISM maturity model for security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is an IT standard?

A

An IT standard is a mandatory requirement to be followed in order to comply with a given framework or certification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a policy?

A

A policy is a set of ideas or strategies that are used as a basis for decision making. They are the high-level statements of direction by management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a procedure?

A

Procedures are detailed steps and action that help support the policy objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are guidelines?

A

Guidelines are additional details to help execute procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What should the Information security policy contain?

A

This should contain the managements commitment for the safeguarding of information assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When should the information security policy be reviewed?

A

At least annually or when there is a significant change to the envrionment of the business.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What should be the first step for the auditor after discovering that IT policies are not approved by management?

A

Report the findings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How can policy compliance be ensured?

A

Existing IT systems should be able to enable compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What should the Information security policy include?

A

This should include something about access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the most important factor for successful implementation of a security policy?

A

That it is delivered and acknowledged by all users

25
Q

What is the most important concern while reviewing the information security policy?

A

That the IT department’s objectives drive the policy and are not alligned with the organisations overall objectives.

26
Q

What is the most important factor in determining the appropiate level of protection?

A

The outcome of a risk assessment because it considers risks on the basis of probability and impact.

27
Q

What is the first point of reference for an IS auditor conducting an audit?

A

Approved policies.

28
Q

What is the most important factor when developing an information security policy?

A

Risk appetite as some risks will have to be accepted by the business to meet business objectives.

29
Q

Who is apart of the Strategy Committee?

A

This committee consits of members of the board and specialist non-members of the board.

30
Q

What is the overall job of the IT strategy committee?

A

To advise the board on the IT strategy.

31
Q

What is the overall job of the IT steering committee?

A

Responsible for the implementation and monitoring

32
Q

Who does ownership lie with in regards to the system development project?

A

User management

33
Q

Who does accountability for ensuring relevant controls over IS resources rest with?

A

The resource owner

34
Q

Who is ultimately responsible for internal control?

A

Senior Management

35
Q

Who has overall responsibility for system development projects?

A

The project steering committee

36
Q

Who is the most suitable person to be appointed as chair of the steering committee?

A

An executive-level officer

37
Q

What is the main advantage of EA?

A

Enterprise Architecture is to help with technology selection and adoption

38
Q

What is the best level of control when customised software is developed by a third-party vendor?

A

An escrow agreement

39
Q

What is one of the most valuable factors regarding technology transition rate?

A

Change control includes the application and execution of good change management systems

40
Q

What are all of the risk management process steps?

A

Asset identification, the identification of threat and vulnerabilites, evaluation of impact, calculation of risk and risk response

41
Q

What are all of the risk management process steps?

A

Asset identification, the identification of threat and vulnerabilites, evaluation of impact, calculation of risk and risk response

42
Q

What are the risk analysis methods?

A

Qualitative, Semi-quantitative and quantitative

43
Q

What are some risk treatment options?

A

Mitigate, Accept, Avoid, Transfer

44
Q

What is the first step when implementing a risk management program?

A

Asset identification followed by determining threats and vulnerabilites

45
Q

When auditing a organisations risk management procedure, what should be reviewed first?

A

Threats and vulnerabilities affecting the assets should be reviewed first.

46
Q

When establishing the level of acceptable risk, who does the responsibility lie with?

A

Senior business management

47
Q

What is fidelity coverage?

A

Fidelity insurance is used by an employer to protect against losses caused by a dishonest or disgruntled employee

48
Q

What is a major factor to consider in relation to offshore data storage/transfer?

A

privacy laws

49
Q

What is a concern surrounding the use of cloud services?

A

Compliance with laws and regulations

50
Q

When it is not possible to implement segregation of duties, what compensation control should be put in place?

A

Reviewing transaction and application logs will help to deter employees from misusing their powers

51
Q

What is a risk that an auditor should be aware of when reviewing a company that uses cross-training practices?

A

If all parts of a sytem are known to only one person, that person may abuse their powers

52
Q

What is the most important consideration when reviewing an approved software product list?

A

IT products should be reviewed periodcally to ensure new or emerging risks are identifed and addressed

53
Q

What clause in an outsourcing contract will help improve the level of service and reduce costs?

A

Performance bonuses as it provdes the service provider with incentives to perform

54
Q

What clause is most important when reviewing and floating a Request for Proposal?

A

References from other customers

55
Q

What is a major concern when reviewing a system development approach?

A

The lack of a quality plan in the contract

56
Q

What is the BEST control to monitor the service provision of a 3rd party?

A

Conduct periodic audit reviews

57
Q

What is the first factor to be considered when reviewing the SLA?

A

Whether the contractual warranties support the requirements of the organisation.

58
Q

What is an idemnity clause?

A

An indemnity clause is a provision in a contract that requires one party to compensate the other party for any losses or damages that they may incur as a result of the contract

CISA (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions