Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IS3110 RISK MANAGEMENT > IS3110 CHAP 3 > Flashcards

IS3110 CHAP 3 Flashcards

1
Q

FISMA requires federal agencies to protect IT systems and data. How often should compliance be audited by an external organization?

  1. Never
  2. Quarterly
  3. Annually
  4. Every three years
A

Annually

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What law applies to organizations handling health care information?

  1. SOX
  2. GLBA
  3. FISMA
  4. HIPAA
A

HIPAA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

CEO’s and CFO’s can go to jail if financial statements are inaccurate. What law is this from?

  1. SOX
  2. GLBA
  3. FISMA
  4. HIPAA
A

HIPAA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What law requires schools and libraries to limit offensive content on their computers?

  1. FERPA
  2. HIPAA
  3. CIPA
  4. SSCP
A

CIPA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Employees in some companies are often required to take an annual vacation of at least five days. The purpose is to reduce fraud and embezzlement. What is this called?

  1. Job rotation
  2. Mandatory vacation
  3. Separation of duties
  4. Due diligence
A

Mandatory vacation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Fiduciary refers to a relationship of trust.

TRUE OR FALSE

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Merchants that handle credit cards are expected to implement data security. What standard should they follow?

  1. GAISP
  2. CMMI
  3. COBIT
  4. PCI DSS
A

PCI DSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The National Institute of Standards and Technology published Special Publication 800-30. What does this cover?

  1. Risk management
  2. Maturity levels
  3. A framework of good practices
  4. Certification and accreditation
A

Risk management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The COBIT framework is organized into four IT domains and 34 IT processes. Which one covers strategy and tactics?

  1. Plan and Organize
  2. Acquire and Implement
  3. Deliver and Support
  4. Monitor and Evaluate
A

Plan and Organize

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A basic principle of this standard is summarized with four sentences: Business requirements drive investments in IT resources. IT resources are used by IT processes. IT processes deliver enterprise information. Enterprise information responds to business requirements. What is this standard?

  1. COBIT
  2. ITIL
  3. GAISP
  4. CMMI
A

COBIT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which of the following ISO standards can be used to verify that an organization meets certain requirements? Part I identifies objectives and controls. Part II is used for certification.

  1. ISO 73 Risk Management – Vocabulary
  2. ISO 27002 Information Technology Security Techniques
  3. ISO 31000 Risk Management Principles and Guidelines
  4. IEC 31010 Risk Management – Risk Assessment Techniques
A

SO 27002 Information Technology Security Techniques

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which of the following ISO documents provides generic guidance on risk management?

  1. ISO 73 Risk Management – Vocabulary
  2. ISO 27002 Information Technology Security Techniques
  3. ISO 31000 Risk Management Principles and Guidelines
  4. IEC 31010 Risk Management – Risk Assessment Techniques
A

ISO 31000 Risk Management Principles and Guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

ITIL is a group of five books developed by the United Kingdom’s Office of Government Commerce.
TRUE OR FALSE

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In the CMMI, which level indicates the highest level of maturity?

  1. 0-6 Level
  2. 1-4 Level
  3. 0-4 Level
  4. 0-5 Level
A

0-5 Level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The DIACAP is a risk management process applied to IT systems. What happens after a system is accredited?

  1. It is certified
  3. It is decommissioned
  4. It is validated. It receives authority to operate
A

It is validated. It receives authority to operate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A policy that informs employees what is considered acceptable use for IT systems and data. Banners and logon screens are sometimes used to remind personnel of the policy.

A

AUP-Acceptable use policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A state position. A state AG represents that estate in all legal matters.

A

AG-Attorney General

18
Q

A process improvement approach to management. It includes six levels from 0 to 5. Level 0 indicates a process doesn’t exist. Level 5 indicates the process is very mature and effective.

A

CMMI-Capability Maturity Model Integration

19
Q

A US law passed in 2000. It requires schools and libraries receiving E-Rate funds to filter some Internet content. The primary purpose is to protect minors from obscene or harmful images.

A

CIPA- Children’s Internet Protection Act

20
Q

When an organization is complying with relevant laws and regulations. it is said to be in compliance. Many organizations have programs in place to ensure that they remain in compliance.

A

Compliance

21
Q

A framework of good practices for IT management. It is well respected and frequently used. It is organized into four domains. They are 1) Plan and Organize. 2) Acquire and Implement. 3) Deliver and Support, and 4) Monitor and Evaluate.

A

COBIT-Control Objectives for Information and related Technology

22
Q

A risk management process applied to US DoD systems. It is fully documented in DoD instruction 8 5 1 0.1. Systems must go through a formal certification and accreditation process before being authorized to operate.

A

DIACAP-Department of Defense Information Assurance Certification and Accreditation Process

23
Q

Taking reasonable steps to protect against risks.

A

DUE CARE

24
Q

Taking a reasonable amount of time and effort to identify risks. The person or organization conducting due diligence investigates risks in order to understand them.

A

Due diligence

25
Q

A federal agency created in 1933. It provides insurance for depositor funds in FDIC banks. The goal is to promote confidence in US banks.

A

FDIC - Federal Deposit Insurance Corporation

26
Q

A US law passed in 1974. It mandates the protection of student records. This includes any records with education or health data. Any institution receiving federal funds for education is covered by this law.

A

FERPA - Family Education Rights and Privacy Act

27
Q

A US law passed in 2002 and requires federal agencies to protect IT systems and data. Additionally, agencies must have annual inspections. These provide independent evaluations of security programs.

A

FISMA - Federal Information Security Management Act

28
Q

A federal agency created in 1914. Its primary goal is to promote consumer protection. It also works to prevent unfair methods of competition.

A

FTC - Federal Trade Commission

29
Q

A relationship of trust between two entities. A fiduciary could be a person who is trusted. The fiduciary has a responsibility to uphold this trust.

A

Fiduciary responsibility

30
Q

A law passed in 1999. It applies to financial institutions. The financial privacy rule and the safeguards rule apply to IT security. Companies need to tell customers how customer data is used. Additionally, the companies need to take steps to protect financial data.

A

GLBA - Gramm-Leach-Bliley Act

31
Q

A law passed in 1999. It mandates the protection of health information. Any organization handling any type of health information must comply with this law. This includes health care providers. It also includes employers offering health plans.

A

HIPAA - Health Insurance Portability and Accountability Act

32
Q

A group of books developed by the United Kingdom’s Office of Government Commerce. These books document good practices that can be used in IT networks.

A

ITIL - Information Technology Infrastructure Library

33
Q

An international standards organization. It focuses on electrical, electronic, and related technologies. The IEC works with the ISO on some standards. The IEC published IEC 3 1 0 1 0 Risk Management – Risk Assessment Techniques.

A

IEC - International Electrotechnical Commission

34
Q

An international standards organization. Three risk-related documents that ISO published are ISO 27002, ISO 31000, and ISO 7 3.

A

ISO - International Organization for Standardization

35
Q

Rotating employees through different jobs. This results in additional oversight for past transactions. It can help prevent or reduce fraudulent activity such as collusion. It can also increase technical expertise on specific systems.

A

Job rotation

36
Q

Requiring employees to take an annual vacation of at least five consecutive days. While the employee is on vacation, someone else must perform the job. This increased the likelihood that illegal activities will be discovered.

A

Mandatory vacation

37
Q

An international standard used to protect credit card data. These requirements are set by the PCI Security Council. Merchants are required to comply with the standards.

A

PCI DSS - Payment Card Industry Data Security Standard

38
Q

A US law passed in 2002. It applies to any publicly traded company. Senior officers and board members are directly responsible for the accuracy of data. If data is misreported they can be fined and go to jail.

A

SOX - Sarbanes-Oxley Act

39
Q

A federal agency that regulates the securities industry. Securities include stacks, options, and other securities. Any publicly traded company or company that trades securities needs to comply with SEC rules.

A

SEC - Securities and Exchange Commission

40
Q

A federal position who is the head of the US Department of Justice.

A

USAG - US Attorney General

IS3110 RISK MANAGEMENT (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions