Policy and Compliance 25% Flashcards by Host Mom

Which of the following tables are in the GRC: Policy and Compliance scope? (Select all that apply)

a. Issue
b. Control
c. Risk
d. Citation

b. Control

d. Citation

How well did you know this?

Not at all

Perfectly

Can you nest or stack Policy records?

a. True
b. False

a. True

How well did you know this?

Not at all

Perfectly

Can you nest or stack Control Objectives?

a. True
b. False

b. True

How well did you know this?

Not at all

Perfectly

GRC Knowledge articles are used by employees to understand the company policies. What GRC record generates the Knowledge article once it is approved?

a. Authority document
b. Citation
c. Policy
d. Control Objective
e. Risk
f. Risk statement / Risk template

c. Policy

How well did you know this?

Not at all

Perfectly

If an Entity record is inactivated, which of the following happens?

a. Entity records are deleted
b. Controls associated with the Entity are deleted
c. Controls associated with the Entity are retired
d. There is no change to Test Plans
e. There is no change to Risks

c. Controls associated with the Entity are retired

How well did you know this?

Not at all

Perfectly

Which of the following is not a table in the Policy and Compliance scope?

a. Policy
b. Authority Document
c. Issue
d. Control

c. Issue

How well did you know this?

Not at all

Perfectly

Multiple Citations can be satisfied and measured once by relating multiple citations to what Table/record?

a. Controls
b. Policy
c. Control Objective

c. Control objective

How well did you know this?

Not at all

Perfectly

What table does not have a state lifecycle?

a. Policy
b. Control Objective
c. Policy Exception
d. Control

b. Control objective

How well did you know this?

Not at all

Perfectly

What is the name of the Control Objective table?

a. sn_compliance_control_objective
b. sn_compliance_statement
c. sn_compliance_policy_statement
d. sn_grc_policy_statement

c. sn_compliance_policy_statement

How well did you know this?

Not at all

Perfectly

Service Level Agreements can easily be set up against all the major tables in the GRC applications.

a. True
b. False

d. False

How well did you know this?

Not at all

Perfectly

Which of the following Roles can move a policy from Review into Awaiting Approval? Select all that apply.

a. Policy Owner
b. Compliance Manager
c. Named Reviewer
d. Admin

a. Policy Owner

c. Named Reviewer

How well did you know this?

Not at all

Perfectly

Which of the following records has a life cycle? Select all that apply.

a. Policy Exception
b. Policy
c. Policy Acknowledgement
d. Control
e. Control Objective
f. Issue

a. Policy Exception
b. Policy
c. Policy Acknowledgement
d. Control
f. Issue

How well did you know this?

Not at all

Perfectly

When is attestation is completed, the Control remains in Review until a compliance officer reviews the attestation results.

a. Yes
b. No

a. Yes

How well did you know this?

Not at all

Perfectly

If a Control is set back to Draft, the attestation is canceled

a. Yes
b. No

a. Yes

How well did you know this?

Not at all

Perfectly

Issues can be related to which of the following? Select all that apply.

a. Entities
b. Entity Types
c. Controls
d. Control Objectives
e. Risk Statements
f. Controls
g. Risks

a. Entities
c. Controls
d. Control Objectives
e. Risk Statements
f. Controls
g. Risks

Does not apply to Entity Types

How well did you know this?

Not at all

Perfectly

Any GRC user can move an Issue into the Analyze state

a. Yes
b. No

a. Yes

Which of the following triggers Issue creation? Select all that apply.

a. Indicator Results
b. Attestations
c. Control Tests
d. Manual
e. Continuous Monitoring

All of the above:

a. Indicator Results - Failed or Not Passed
b. Attestations - if result is Not Implemented
c. Control Tests - if Ineffective
d. Manual - created by any compliance risk, or audit user
e. Continuous Monitoring - based on Configuration Test scanning

Which of the following has a lifecycle that does not use buttons to move from one state to the next. The user selects states from a dropdown list instead.

a. Policy Exception
b. Policy
c. Control Objective
d. Issue
e. Policy Exception

d. Issue

Which of the following is a child of the parent Document table? Select all that apply.

a. Risk Statement
b. Control Objective
c. Authority Document
d. Risk
e. Control
f. Citation
g. Risk Framework
h. Policy

c. Authority Document
g. Risk Framework
h. Policy

Which of the following is a child of the parent Content table? Select all that apply.

a. Risk Statement
b. Control Objective
c. Authority Document
d. Risk
e. Control
f. Citation
g. Risk Framework
h. Policy

a. Risk Statement
b. Control Objective
f. Citation

Which of the following is a child of the parent Item table? Select all that apply.

a. Risk Statement
b. Control Objective
c. Authority Document
d. Risk
e. Control
f. Citation
g. Risk Framework
h. Policy

d. Risk

e. Control

A single Control Objective can be related to multiple policies.

a. Yes
b. No

a. Yes

United Compliance Framework (UCF) can be used as a Policy and Compliance Management Integration. Which of the following can be imported from UCF using transform maps:

a. Control Objectives
b. Policies
c. Citations
d. Controls
e. Authority Documents

a. Control Objectives
c. Citations
e. Authority Documents

Service Level Agreements (SLA) can be used with Attestations.

a. Yes
b. No

b. No

SLAs cannot be used with Attestations or Assessments because these tables don’t extend from a Task. Creation of a workflow is required.

Attestations capture the answer to the question, " Have you implemented a process/procedure that can be used to measure this control?" a. Yes b. No

a. Yes

Which of the following is correct regarding Compliance Scores? Select all that apply. a. If a Control Objective has no children (downstream controls) then the score is the total number of compliant controls divided by the total number of controls. b. By default all controls have an equal weight of 10 c. The weight of a control can be changed in the Monitor state d. Scores above 75 are displayed in green e. The weight of a control is only used on the compliance side

a. If a Control Objective has no children (downstream controls) then the score is the total number of compliant controls divided by the total number of controls. b. By default all controls have an equal weight of 10 Explanations: c. Control weights can only be changed in the Review state d. Scores about 80 are green, between 50 and 80 are yellow, below 50 are red e. The weight of a control is used in two separate calculations: compliance percentage and Risk Score in Risk Management

The compliance score can be calculated at various levels including the following? Select all that apply. a. Policies b. Policy Exceptions c. Entities d. Entity Types e. Controls f. Control Objectives g. Authority Documents

a. Policies c. Entities d. Entity Types f. Control Objectives g. Authority Documents NOT Policy Exceptions or Controls The Compliance Score is calculated at various levels, including Authority Documents, Policies, Control Objective, Entity Types, and Entities

Indicators are not weighted. a. Yes b. No

a. Yes

An Indicator is a filter created by the customer that looks at a table for evidence. a. Yes b. No

a. Yes

The difference between Workflow editor and Flow Designer is that the Workflow editor is used to create and modify workflows by arranging and connecting activities while the Flow Designer enables process owners to automate approvals, tasks, notifications with natural language without having to use code or Workflow a. Yes b. No

a. Yes

Entity Owners are defined at the Entity Type level. a. Yes b. No

b. No Entity Owners are defined at the Entity level.

* SLA definitions extend from the Issue table. a. Yes b. No

b. No. SLA definitions extend from the Task table. An SLA is a record that specifies the time within service must be provided.

* SLA can be applied to all tables in Service Now. a. Yes b. No

b. No

* Which of the following are actions to begin a GRC implementation? Select as many as apply. a. Allocate time for training after deployment b. Uncover siloed areas that have Policies, Controls, and Risks to include. c. Consider what existing data can be entered as Policies, Controls, and Risks d. Understand how the customer is currently organizing their GRC processes and procedures e. All of the above

e. All of the above