Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IRM > Quizlet GRC > Flashcards

Quizlet GRC Flashcards

1
Q

Profile/Entity

A

Records that aggregate GRC information related to a specific item

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Authority Document

A

The regulations, certifications, frameworks, standards, and best practices for compliance with regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Citations

A

Records with the specific requirements cited by an Authority Document

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Policy

A

internal practice ensure compliance and reduce Risk exposure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Control Objective

A

specific details that a process follows within a Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Unified Compliance Framework (UCF)

A

Compliance database serving for managing IT compliance requirements from around the world

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Risk Criteria

A

Quantitative or Qualitative values against which level of Risk is evaluated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Residual Score

A

The score of the Risk after any response strategy is implemented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Risk Roles

A

Risk Admin, Risk Manager, Risk User, Risk Reader, Survey Reader

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

An entity can belong to more than one Entity Class?

A

false

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A Profile can be related to one or more multiple profile types?

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Issue

A

A GRC task that allows end users to document Control and Risk Issues and track the response to remediate or accept the issue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Indicator

A

A metric used to collect data to monitor Controls and Risks, and collect audit evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Risk Framework

A

A formalized process for managing Risk on an explicit basis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Control

A

The actual control activities that are to be performed by an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Risk Statement

A

A defined consequence that can occur if a threat exploits a vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Risk Register

A

A repository of the key attributes of potential and known Risk issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Risk

A

Any threat or vulnerability that could adversely affect an organization’s business objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Calculated Score

A

Derived from the inherent score and the residual score as an overall outcome

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Inherent Likelihood

A

the likelihood of the identified Risk occurring before any response strategy is implemented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Inherent Risk

A

The level of risk before any actions and Controls are in place

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Inherent Score

A

The score of the risk before any response strategy is implemented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Qualitative Impact

A

Calculated by Impact x likelihood

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Quantitative Impact

A

Calculated by Single Loss Expectancy (SLE) x Annualized Rate of Occurrence (ARO) = Annualized Loss Expectancy (ALE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Residual Likelihood

A

The likelihood of the identified Risk occurring after any response strategy is implemented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Residual Risk

A

The level of Risk after actions and Controls are in place

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Compliance Roles

A

Compliance Developer, Compliance Admin, Compliance Manager, Compliance User, Compliance Reader, Survey Reader

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

GRC Roles

A

Legacy roles - do not use (GRC Developer, GRC Admin, GRC Manager, GRC User, GRC Reader)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What tables extend the Document table (sn_grc_document)?

A

Risk Framework, Policy, Authority Document

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What tables extend the Content table (sn_grc_content)?

A

Risk Statement, Policy Statement, Citation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What tables extend the Item table (sn_grc_item)?

A

Risk, Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Any component (Business Rules, Client Scripts, ACL, etc.) that is defined for the parent table applies to any tables extended from it

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Can a Profile belong to one or more multiple Profile Types?

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What roles can create Profile Classes, Profile Types, and Profiles?

A

Compliance Manager, Risk Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What role can create Issues, Indicators, Remediation Tasks, and Policy Exceptions?

A

Compliance Manager, Risk Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What roles can view Authority Documents and Citations?

A

Compliance Managers, Compliance Users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What roles can create Policies, Policy Statements, Policy Exceptions, Controls, Authority Documents, and Citations?

A

Compliance Managers, Compliance Users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What roles can view Risk Frameworks, Risk Statements, Assessments, and Risk Response tasks?

A

Risk Managers, Risk Users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What roles can create Risks, Risk Frameworks, and Risk Statements?

A

Risk Managers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What roles can create Risks?

A

Risk Managers, Risk Users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Where can the SOX Content pack be found?

A

ServiceNow Store

42
Q

What are the 5 states of the Policy Lifecycle?

A

Draft, Review, Awaiting Approval, Published, Retired

43
Q

What are the 5 states of the Control Lifecycle?

A

Draft, Attest, Review, Monitor, Retired

44
Q

What are the 5 states of the Issue Lifecycle?

A

New, Analyze, Respond, Review, Closed

45
Q

What are the 7 states of the Policy Exception Lifecycle?

A

New, Analyze, Risk Assessment, Review, Awaiting Approval, Approved, Closed

46
Q

Can a Compliance Manager move the Policy from Review to the next state?

A

False - only the reviewer can move it from the review state to the next

47
Q

While a Policy is in the ___________ state, Approvers receive a ServiceNow Approval task.

A

Awaiting Approval

48
Q

True/False - If there are no approvers listed on a Policy, the Policy will go straight to the Published state after the review is complete

A

true

49
Q

________ state indicates that a Control is no longer implemented

A

Retired

50
Q

Controls automatically move to ——- from the attestation state

A

Review

51
Q

Issues can get automatically created for what 4 reasons?

A
  1. Indicator fails
  2. attestation results are Not Implemented
  3. Control Test effectiveness is Ineffective and state of test is closed
  4. continuous monitoring results
52
Q

Policy Exceptions can be created from what 4 locations?

A

Policy Exception module, Issues, Policy Statement, Policy

53
Q

True/False - Risk Assessment and Review states will be skipped if a Risk Assessment has been selected

A

false

54
Q

True/False - Issues are automatically closed when a control test result failure is remediated

A

true

55
Q

What are the 2 Risk Scoring Methods?

A

Quantitative and Qualitative

56
Q

SLE x ARO = ALE

A

Quantitative calculation

57
Q

Control Failure Factor is ________

A

the impact of Control Failures on the Calculated score of risks

58
Q

Indicator Failure Factors is _________

A

the impact or risk indicator failures on the calculated score of risks

59
Q

Calculated Risk Factor is __________

A

the average impact factor that is actually used to compute the calculated score of risks

60
Q

Calculated ALE formula is ________

A

(Residual ALE) + {(Inherent ALE - Residual ALE) * [Calculated Risk Factor/100]}

61
Q

How to restrict risk record fields such as risk scoring fields?

A

Option 1: create a form view with ACLs on the view

Option 2: create READ ACL at the record level or on individual fields

62
Q

True/False - Risk Managers use Profile Types and Profiles to monitor Risk Exposure and perform Risk Assessments

A

true

63
Q

True/False - Policy and Compliance Managers use EntityTypes and Entities to create a system of internal Controls and monitor compliance

A

true

64
Q

What are the 6 scoped applications in GRC?

A

GRC Profiles, GRC: Workbench, Policy and Compliance, Risk, UCF Compliance, GRC: Performance Analytics Integrations

65
Q

How mature are 80% of the customers in GRC?

A

Between Manual and Basic, starting with Spreadsheets to Semi-automated GRC Processes

66
Q

What are some of the Security Regulations/Framework?

A

ISO 27001, NIST, PCI DSS

67
Q

How to access all risks?

A

Risk Register -> All Risks

68
Q

What are the 3 types of packaging available for IRM?

A

IRM Standard, IRM Professional, IRM Enterprise

69
Q

Which is a standalone application in GRC?

A

Vendor Risk Management

70
Q

Which GRC Store applications have system plugin dependencies?

A

Policy and Compliance Management, Risk Management, Audit Management and Vendor Risk Management

71
Q

Which roles can create GRC Attestation metric type?

A

Attestation Creator

72
Q

Which roles can create GRC Risk Assessment Metric Type?

A

Risk Assessment Creator

73
Q

What does the Document field reference to?

A

Risk Framework/Policy/Authority Document

74
Q

What does the Content field reference to?

A

Risk Statement/Control Objective/Citation

75
Q

What does the Item field reference to?

A

Risk/Control

76
Q

Who are the customers eligible for Use case accelerators?

A

Professional and Enterprise Package customers

77
Q

__________________ provides correlation across authority documents and regulations and provide a single consolidated list of Controls into a scalable and efficient compliance framework.

A

UCF

78
Q

________________ integrates with Policy and Compliance and Risk applications in ServiceNow to provide real time metrics which affect an organizations risk and compliance posture.

A

Vendor Risk Management

79
Q

_________________ provides pre-packaged reports and widgets organized in GRC dashboards to compliment baseline functionality.

A

Performance Analytics

80
Q

______________ ensures the data used by Risk and Compliance related applications is maintained properly.

A

Data Certification

81
Q

Which plugin is important to enable configuration tests?

A

Configuration Compliance

82
Q

What plugins are needed for Policy & Compliance and Risk Management?

A

GRC: Policy and Compliance Management (com.sn_compliance)
GRC: Risk Management (com.sn_risk)

83
Q

Data does not get tracked on update sets? True/False

A

true

84
Q

Which resources should be on a GRC Implementation?

A

ServiceNow platform Experts
Risk and Compliance Experts
ServiceNow developer
CMDB developer
UI Design team
Org Change Management

85
Q

Table that stores relationships for Entities?

A

sn_grc_m2m_profile_profile_type

86
Q

Script Includes that play a vital role in GRC: Profiles

A

GRCUtilsBase, IssueUtilsBase, GRCAssessmentUtilsBase

87
Q

Who can move a control to Monitor state?

A

Compliance Manager, Compliance Admin

88
Q

What is the default state of the Issue record?

A

new

89
Q

How can you automate Profile Owner Group Membership?

A

By using Flow Designer

90
Q

If Risk Statement is reactivated, what state does the risk go to?

A

draft

91
Q

What is the relationship table that relates Risks to controls?

A

sn_risk_m2m_risk_control

92
Q

GRC in an “old work’ model with unstructured workflows and processes is too inefficient. The Departments are too ______ and they all work independently of each other

A

siloed

93
Q

Companies looking to implement a GRC program are looking for what 3 results?

A

Integrated reporting, workflow driven processes, transparency, efficiency

94
Q

What is Governance?

A

The Policies and oversight necessary to ensure sustainability of internal goals and objectives while understanding inherent risk and adhering to external laws and regulations

95
Q

What is the table name that holds the relationships of risk framework to Profiles?

A

sn_risk_m2m_framework_profile_type

96
Q

What is the table name that holds the relationships of risk statements to Profiles?

A

sn_risk_m2m_risk_definition_profile_type

97
Q

What is the table name that holds the relationships of Policies to Profiles?

A

sn_compliance_m2m_policy_profile_type

98
Q

What is the table name that holds the relationships of Policy Statements to Profiles?

A

sn_compliance_m2m_statement_profile_type

99
Q

True/False - A Profile can be related to one or more multiple profile classes?

A

false

100
Q

True/False - SLA’s are used to help monitor and report on agreed service levels

A

true

101
Q

SLE (quantitative) is the same as _________ (qualitative)?

A

Impact

102
Q

ARO (quantitative) is the same as _________ (qualitative)?

A

Likelihood

IRM (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions