Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISA > Memorize Me! > Flashcards

Memorize Me! Flashcards

1
Q

Sampling for compliance test

A

Attribute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Sampling for substantive test

A

Variable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Sampling for fraud

A

Discovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Sampling for objective of probability of error, and what does it minimize?

A

Statistical. Minimizes detection risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Who approves charter?

A

Board of directors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Who approves policies?

A

Board of directors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Who is primarily responsible for IT Governance?

A

Board of Directors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does the strategy committee do?

A

Advise board on IT initiatives

Develop standards/define and set objectives and controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does the steering committee do?

A

Keep BOD informed

Resourcing/general review board for major IT projects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what are the 3 indicators of IT BSC?

A
  • Customer satisfaction
  • Internal processes
  • Ability to innovate
  • note – financial performance is not part of IT BSC*
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Identify transcription/transposition errors

A

Check Digit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Ensure accuracy

A

Check Digit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Identify transmission error

A

CRC>Checksum>Parity Bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Ensure completeness

A

CRC>Checksum>Parity Bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Ensure integrity

A

CRC>Checksum>Parity Bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Detect and correct transmission error

A

FEC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

ACID principle

A

Atomicity
Consistency
Isolation
Durability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What online audit technique to use if requires audit trail

A

Snapshot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What online audit technique to use if requires early detection of error or irregularities

A

Audit hook

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What online audit technique to use if requires audit trail identify transactions as per pre-defined criteria

A

Continuous and intermittent simulation (CIS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What online audit technique to use if requires fictitious entity created in live prod

A

ITF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What online audit technique to use if regular processing cannot be interrupted

A

SCARF EAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Not beneficial to use test data

A

ITF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

PM - estimate project timelines or duration

A

PERT>CPM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Monitor progress of project

A

GANTT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

EVA?

A

PM - calculate budget to date, actual spending to date, estimate to complete, estimate at completion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Estimate size of sw development efforts

A

FPA or SLOC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Prevent cost overruns and delivery delays

A

time-box management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the primary function of QoS?

A

The main function of QoS is to optimize network performance by assigning priority to business applications and end users through the allocation of dedicated parts of the bandwidth to specific traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are the pros and cons of agile development methods?

A

Quick building of functionality
Reliance on tacit knowledge – faster – lessons learned to identify for next use

Lack of documentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the pros and cons of prototyping?

A

Significant time and cost savings

Pressure to implement early prototype
Leads to functions or extras that were not included in initial requirements doc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are the pros and cons of rapid app dev?

A

Quick development and reduces dev costs using well defined techniques.

Rigid time limits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the pros and cons of object oriented development methods?

A

Manage unrestricted variety of data types
Model complex relationships
Capacity to meet demands of changing environment
Re-use objects

none

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are the pros and cons of component based development methods?

A

Ability to buy proven, tested software from commercial developers.

Need for software integration of components

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What are the pros and cons of web based development methods?

A

Tries to solve/avoid need to perform redundant computing tasks with the inherent need for redundant code

Exploitation over internet use
App development risk
Business risk
Tech vulnerabilities
Change control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are the pros and cons of software re-engineering?

A

None listed

None listed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are the pros and cons of reverse engineering?

A

Faster dev and reduced SDLC duration
Introducing improvements by overcoming the reverse-engineered drawbacks

  • SW license agreements prohibit this so trade secrets or programming techniques are not compromised
  • de-compilers are new tools that depend on specific comps, OS’s and
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Alpha/Beta/Pilot

A

System in stages, alpha proto to users within the org developing sw, and beta to limited users.
Pilot – prelim test focusing on specific aspects. Proof of concept are early pilots.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

White box

A

Assess effectiveness of sw program logic/log paths.

Unit and integration testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Black box

A

Integrity test

UA and Integration Test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Function/validation testing

A

Functionality of system against detailed requirements to ensure traceability to customer requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Regression

A

Rerunning portion of test scenario to ensure changes have not introduced new errors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Parallel

A

Feeding data into two systems and comparing

44
Q

Sociability testing

A

Confirm that new or modded system can operate in its target environment without impacting other systems. Should cover all processes.

45
Q

EDI

A

Transaction authorization is the BIGGEST RISK TO EDI – electronic = no inherent authentication.

46
Q

E-Commerce

A

Security architecture (firewalls, PKI, encryption, certificates, password management) and SSL

47
Q

E-mail

A
  • Man in the middle, phishing, spear phishing, flaws in config, denial of service (DOS), sensitive info, altered email, viruses, inappropriate email in corp.
  • Digital sigs are good method of securing emails.
    Outgoing email
  • Simple Mail Transport Protocol (SMTP): can only be used to send emails, not to receive them
    Incoming email
  • Post Office Protocol (POP)
  • Internet Message Access Protocol (IMAP)
  • Hypertext Transfer Protocol (HTTP)—also called “web-based email”
  • Messaging Application Programming Interface (MAPI)—used with Outlook in conjunction with a Microsoft Exchange Server mail server; very close to IMAP but has extended features to interact with other applications
48
Q

E-banking

A

Strategic, reputational, operational, including security – sometimes called transactional risk, and legal risk. Credit, price, foreign exchange, interest rate, and liquidity.

Control: SOD, Security (IAAA, non-repudiation, confidentiality)
Board & management oversight

49
Q

Industrial Control systems

A

Physical access restriction and redundancy

50
Q

EFT (and ATMs)

A

Access security and authorization of processing are important controls. Central bank requirements should be reviewed for application in these processes.

51
Q

Recovery for low RTO

A

Mirror or Hot Site

52
Q

Recovery for low RPO

A

Mirror imaging or real-time replication for data backup

53
Q

Recovery for zero RPO

A

Synchronous data backup

54
Q

RTO/RPO for critical systems/critical data

A

Zero or near zero

55
Q

Speed of recovery rankings

A

Slowest to fastest

Cold, Warm, Hot, Mirrored

56
Q

Most secure media transfer

A

Fibre-optic cables because of low transmission loss and not effected by EMI.
Preferred for high volumes and long-distance calls

57
Q

Transmission error that can occur in wired and wireless communication

A

Attenuation:

  • Weakening of signals during transmission
  • Length of wire impacts severity
58
Q

Electro-magnetic Interference (EMI)

A
  • Disturbance generated by external source that affects electrical circuit
  • Can degrade circuit performance
    o For data paths can range from increase in error rate to total loss of data
  • Caused by electrical storms or noisy electrical equipment
59
Q

Alternate Routing

A

Method of routing information via an alternative medium, such as copper cable or fiber optics.
Two types:
Last mile circuit protection: redundancy for local communication loop.
Long haul network diversity: redundancy for long distance availability.

60
Q

Diverse Routing:

A

Method of routing traffic through split-cable facilities or duplicate-cable facilities.

61
Q

What are the OSI Layer, Address, and functionality of a LAN repeater?

A

Physical Layer (1)

N/A

Extend transmissions further or to other side of obstruction

62
Q

What are the OSI Layer, Address, and functionality of a LAN Hub?

A

Physical (1)

N/A

Broadcast message to all connected devices

63
Q

What are the OSI Layer, Address, and functionality of a LAN Layer 2 Switch?

A

Data Link (2)

MAC

Send message to only required devices

64
Q

What are the OSI Layer, Address, and functionality of a LAN Bridge?

A

Data Link (2)

MAC

Similar to switch, has capacity to store frames and act as a store and forward device.

65
Q

What are the OSI Layer, Address, and functionality of a LAN Router?

A

Data Link (2)

IP

Examines IP address to make decision to forward packet to destination

66
Q

Backup Time & Media Storage

A

Full (slow/large) – Differential – Incremental

67
Q

Restoration time

A

Incremental (slow) - Differential - Full (fast restore)

68
Q

PKI Confidentiality

A

Encrypt using receivers public key

69
Q

PKI Authentication of message

A

Encrypt user sender’s private key

70
Q

PKI Integrity

A

Create hash of message and encrypt hash using sender’s private key

71
Q

PKI Confidentiality and Authentication of message

A

HASH-encrypt using sender’s private key

MESSAGE – encrypt using receiver’s public key

72
Q

PKI Confidentiality and Authentication and Integrity of message

A

HASH-encrypt using sender’s private key

MESSAGE – encrypt using receiver’s public key

73
Q

Layer: MAC address

A

Data link layer

74
Q

Layer: IP Address/Routing

A

Network layer

75
Q

Layer: Electric signal/hardware devices

A

Physical layer

76
Q

Layer: Reliable delivery or connection/congestion control/order of sequence

A

Transport layer

77
Q

Layer: Establishing connection

A

Session layer

78
Q

Layer: Acceptable format

A

Presentation layer

79
Q

Layer: End user

A

Application layer

80
Q

What are the environmental, personal, and other risks of water based fire suppression systems?

A

none

none

Pipe leaks

81
Q

What are the environmental, personal, and other risks of dry pipe fire suppression systems?

A

none

none

Comparatively less reliable than water based

82
Q

What are the environmental, personal, and other risks of halon fire suppression systems?

A

Bad for environment

Lethal to humans

No good?

83
Q

What are the environmental, personal, and other risks of FM 200 fire suppression systems?

A

none

none

Best gas?

84
Q

What are the environmental, personal, and other risks of Argonite fire suppression systems?

A

Okay for environment

Suffocates people

No good?

85
Q

What are the environmental, personal, and other risks of CO2 fire suppression systems?

A

None

Lethal to humans

Illegal in most countries if there is any chance of humans around

86
Q

Application firewalls

A

Application – 7th layer

Highest security option

The application gateway is similar to a circuit gateway, but it has specific proxies for each service. To handle web services, it has a Hypertext Transmission Protocol (HTTP) proxy that acts as an intermediary between externals and internals, but is specifically for HTTP. This means that it not only checks the packet IP addresses (layer 3) and the ports it is directed to (in this case port 80, or layer 4), it also checks every HTTP command (layers 5 and 7). Therefore, it works in a more detailed (granularity) way than the other choices.

87
Q

Circuit firewalls

A

Session – 5th layer

Based on a proxy or program that acts as an intermediary between external and internal accesses. This means that during an external access, instead of opening a single connection to the internal server, two connections are established

88
Q

Stateful inspection

A

Network – 3rd layer

89
Q

Packet filtering/screening router

A

Network – 3rd layer

No granular control

90
Q

What are the characteristics of dual homed firewalls?

A

(i) One Packet Filtering Router

ii) One bastion host with two NIC (Network Interface Card

91
Q

What are the characteristics of screened host firewalls?

A

(i) One Packet Filtering Router

(ii) One Bastion Host

92
Q

What are the characteristics of Screened subnet (demilitarized zone) firewalls?

A

(i) Two Packet Filtering Router
(ii) One Bastion Host
(2) Out of all types of firewall implementation structures, Screened Subnet Firewall (DMZ) provides greatest security environment (as it implements 2 packet filtering router and 1 bastion host).

MOST SECURE

93
Q

MAC Address filtering

A

Access to router allowed or rejected by unique identifier

94
Q

SSID

A

Wireless network name broadcast by a router. Disable this for securiity .

95
Q

WPA-2

A

Encrypted, strongest standard to date for wireless connection.

96
Q

What is the prime objective of logical access control?

A

Ensure access has been assigned per organizations

97
Q

SSL

A

SSL (Secure Sockets Layer) is the standard security technology for establishing an encrypted link between a web server and a browser.

98
Q

DHCP

A

Client/server protocol that automatically provides an Internet Protocol (IP) host with its IP address and other related configuration information such as the subnet mask and default gateway. Beneficial for laptop users, but should be disabled for good wireless security.

99
Q

Global System for Mobile Comms (GSM)

A

Super safe mobile technology, encrypts but should require an encrypted session (vpn)

100
Q

5 steps for classification of information assets

A

1) inventory
2) establish ownership
3) classify IS resources
4) label IS resources
5) create access control list

101
Q

Greatest benefit of well-defined data?

A

Reduce cost of control

102
Q

What is the main objective of library control software?

A

Authorized changes

103
Q

When is a Check Sum used?

A

A checksum or digital signature is commonly used to validate the integrity of a downloaded program or other transferred data.

104
Q

When is CRC used?

A

The accuracy of blocks of data transfers, such as data transfer from hard disks, is validated by a cyclic redundancy check (CRC).

105
Q

What is shadow file processing?

A

Exact duplicates of files are maintained at the same site or at a remote site. The two files are processed concurrently – used for critical data files such as airline booking systems.

Careful if the answer is hard disk mirroring – this just means redundancy on the same server in case one of the disks fails, it’s not a mirror site data storage.

CISA (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions