Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISA 2018 Exam Prep > IT Governance and Compliance > Flashcards

IT Governance and Compliance Flashcards

1
Q

Data classification - what are the 4 classifications

A
  • top secret
  • secret
  • sensitive
  • public
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 4 principles and activities in an Information Security Policy

A

Roles and responsibilities

Risk management

Security processes - defined by security policy: vulnerability and incident mngt, swft dev, hiring, vendor mngt

Acceptable use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Security policy and security mngt should be separate from what 2 items?

A

IT mngt and IT policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Data classification policy sets levels of sys security that correspond to —————

A

Data classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Who correctly classifies a document or data’s classification policy?

A

Data owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Site classification policy, dimensions to set levels of phys security:

(5)

A

Criticality of staff there

Criticality of business perf there

Value of assets

Sensitivity of data

Siting risk of location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

3 social media policy dimensions

A

Personal

Professional

Disclosure of company info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

3 other tech policies

A

Equipment control and use

Data destruction

Moonlighting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Processes and procedures (sop)
The “how”

3Ds and R contained in a procedure document:

A

Document/process owner

Doc revisions

Reviews and approvals

Dependencies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Standards

Which is not valid?
Tech standards
Protocol standards
Controls standards
Supplier standards
Methodology 
Configure
Architecture
A

Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Methodology standards?

A

Including:

software dev,

sys administration

Network engineering

End user support

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Laws and regulations: what do you evaluate to gauge impact? 4

A

Enterprise architecture

Controls

Processes

Personnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the standard for storage and transmission of credit card data?

A

PCI-DSS

Payment card industry data security standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Risk mngt

4 risk actions (treatments)

A

Accept

Mitigate or reduce

Share or transfer

Avoid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Risk mngt program

Examples of objectives

A

Reduce network penetrations

Reduce incidents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Risk mngt program

1- Example of scope

2- What is authority

3- Example of resources

4- What is the remaining dimension needed?

A

1- What business units are involved?

2 - who said to establish the program? What is their support?

3- budget, software, staff

4- policies, procedures and records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Risk mngt lifecycle

What comes after asset identification?

A

Risk analysis

18
Q

Risk IT Framework has 3 components:

Risk G——-

Risk E——-

Risk R——-

A

Risk governance
Risk evaluation
Risk response

19
Q

Risk IT Framework has 3 things

Risk g
Risk e
Risk r

A

Governance
Evaluation
Response

20
Q

Sources of asset data for risk management

Financial systems a——- I——

A

Financial system asset inventory

21
Q

Other sources of asset data

A

Interviews
IT systems portfolio (is what?)

Docs around major applications.

Online data

Asset management system

22
Q

Risk analysis formula

What is FAIR?

A

Risk = probability x impact

Factor analysis of information risk

23
Q

Threat analysis is to ID all possible/reasonable threats.

Natural

Man made

A 
Severe storms
Flooding
Fire
Labor issues
Power outage
Criminal
Errors
24
Q

What is a logical threat analysis?

A

Malware

All that aren’t physical

25
Q

Vulnerability IDentification

A

Missing or broken antivirus
Weak passwords
Missing audit logs
Building entrance that permits tailgating

26
Q

Probability analysis that a threat will actually be realized

Impact analysis is …

A

A realized threat will have some effect on org. Must know how an asset impacts business processes. Must have a h m l rating

27
Q

Imagine act analysis must also have what?

Statement ——-//

A

If impact

28
Q

Qualitative risk analysis

In scope assets, threat vulnerability (and ——-/) and statement of —

A

And severity

Statement of impact

29
Q

Quantitative risk analysis

Risk are expressed with financial measure

Standard quantitative risk analysis requires values for

A—-
E——
S—expectancy
ARO
ALE
A

Asset Value

Exposure Factor: AV-salvage

Single loss expectancy: AVxEF

Annualized rate of occurrence: times per year

Annualized loss expectancy: SLE x ARO

30
Q

ALEs

A

Can be added together for identification

But separated for treatments

31
Q

How do you transfer risk?

A

With insurance policy

Avoidance by remote bing asset or practice

32
Q

Residual risk formula

A

Original risk -mitigated risk-transferred risk = residual risk

33
Q

PCI-DSS

A

Payment Card Industry - Data Security Standards

34
Q

Ofac

A

Office of Foreign Asset Control

35
Q

Offsite local

Offsite remote

A

Personnel are near the office in community

Personnel are in another community but in country

36
Q

ITIL

A

Information Technology Infrastructure Library

37
Q

Risk with outsourcing

A 
Errors and omission - data breaches?
Higher than expected costs
Poor quality and performance 
Loss of control
Lowered employee morale
Audit and compliance right to audit 
Time zone difference
38
Q

Leverage for outsourcing

A

Money

Bad/good reviews

39
Q

Mitigating outsourcing risks

A

SLA

Security policy and controls -right to audit
Quality - error rates
Vet backgrounds
Who owns intellectual property
Schedule
Regulations
Warranty
Dispute resolution
Payments
40
Q

Outsourcing governance

A

Can’t outsource accountability

Contracts and work orders

Sow contains details

Change management

Security - they must have security controls

Quality standards
Metrics

Audits

41
Q

ITIL 5 volumes

A 
See strat
Serb design
Serb transition
Service operation
Continual service improvement

CISA 2018 Exam Prep (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions