Personal Topics Flashcards
Missed MCQs
What are the components of the governance system under COBIT 2019?
processes,
org structures
principles, policies & frameworks
information
culture & ethics,
people, skills & competencies
services, infrastructure & applications
HIPPA Violations ($)?
Tier 3 is willful neglect
$10K min per violation
$50K max per violation
$1.5M annual cap for identical violations
System backup methods (full, incremental, differential) - which takes the least amount of downtime to create the backup file?
Greatest to least:
Full > differential > incremental
What is RPO?
RPO = recovery point objective
RPO = the maximum amount of some metric that is intolerable (ex: a company can tolerate losing 1,000 units per day due to a power outage)
What is “WHERE” used for in SQL?
to filter records based on certain criteria (ex: find values exceeding $1,000)
What is the asterik “*” used for in SQL?
- is used to select every single value
When do you reference complementary user entity controls (CUECs) in the SOC1 audit report?
- Required to reference in the opinion section of the SOC1 report when the controls are necessary to meet standard control objectives of the service org in conjunction with the controls of the service org
What should be included in the SOC 2 Type 2 Report in the ‘Description of Test of Controls’ section?
- the controls tested
- whether the items tested represent all or a selection of items in the population
- nature of tests performed so that users can determine the effect on their risk assessments
- number of items tested only if there are deviations. do not mention if no exceptions are noted.
What is the carve-out method?
- for complementary subservice org controls
- less extensive
- service org management should exclude complementary subservice org controls from the description of the service org’s system
What is the inclusive method?
- for complementary subservice org controls
- most extensive
- required to have written representations from subservice & the service org’s managements
What are differential backups?
- Backup all data since the last full backup
- fastest to restore
What is the purpose of an AUP (org vs mobile device)?
- Organizational: broader in scope; regulates and protects technology resources by assigning varying levels of responsibilities to job roles, listing acceptable behavior by users
- Mobile devices: limited in scope; defined policies for how mobile devices may be used
Which common criteria and which additional specific criteria related to the trust services criteria must a service auditor address?
- the common criteria for all trust services categories
- address additional specific criteria for all but security (only for confidentiality, processing integrity, privacy and availability)
If a virus infects a business network, who would be affected?
- vendor’s systems can get infected
- partner orgs may reallocate resources to help thereby disrupting operations
- customers’ ordering systems may be infected
Note: an employee trying to log onto the orgs website to log time would not be affected (us trying to log into PayCom-we wouldn’t be affected)
What is recovery time objective (RTO)?
The maximum amount of targeted time to restore a company to its usual operations
Should orgs have separate risk management strategies from their CSP’s?
No - they should integrate for a cohesive way to manage risk
SQL: join vs left join
In what type of report do you test operating effectiveness of controls?
- SOC type 2; when the service org uses the inclusive method to present its services and controls, tests of operating effectiveness of controls would extend to the relevant controls of a sub service org
What is the service auditor’s responsibility vs service org management’s responsibility in an SOC engagement?
- Service auditor: responsible for ensuring appropriate controls are in place and that internal employees are aware of how to appropriately report incidents
- Service org management: design, implement, and maintain internal controls; ensure that incidents are remediated timely; ensure that any incidents or control deviations are identified; make assertions about the system’s design, operation, and effectiveness
What do routers do?
- hardware or software devices
- manage network traffic by connecting devices
- assign IP addresses
What do gateways do?
- convert protocols so networks can communicate
- act as intermediaries
What do servers do?
- execute commands and provide computing power for other machines on the network
- coordinate data, programs, and computers so the network can operate
Open Systems Interconnection (OSI) Model
- a construct used to explain how different protocols work in a network by breaking network functions into seven layers
- 7 layers
Are causative factors optional or required in SOC reports?
- causative factors are optional
- if included, they go in the Description of Tests of Controls section
