Karteikarten
SCIA 370 Chapter 1
Karten in diesem Stapel (19)
- 1___________________ is the act of protecting information and the systems that store and process it. A. Information Systems Audit and Control Association (ISACA) B. Control Objectives for Information and related Technology (COBIT) C. Business as Usual (BAU) D. Business process reengineering (BPR)B. Control Objectives for Information and related Technology (COBIT)
- 2Which of the following is not one of the four domains that collectively represents a conceptual information systems security management life cycle? A. Align, Plan, and Organize B. Build, Acquire, and Implement C. Deliver, Service, and Support D. Evaluate, Assess, and PerformD. Evaluate, Assess, and Perform
- 3The COBIT Align, Plan, and Organize domain includes basic details of an organization’s requirements and goals; this domain answers which of the following questions? A. What are the areas of vulnerability? B. Where is there room to build? C. What are the processes for quality assurance? D. What do you want to do?D. What do you want to do?
- 4When writing a ____________________, one could state how often a supplier will provide a service or how quickly a firm will respond. For managed services, this document often covers system availability and acceptable performance measures. A. contract B. Policy C. Service Level Agreement D. StandardC. Service Level Agreement
- 5A ____________ would be a misconfiguration of a system that allows the hacker to gain unauthorized access, whereas a______________ is a combination of the likelihood that such a misconfiguration could happen, a hacker’s exploitation of it, and the impact if the event occurred. A. vulnerability, risk B. risk, vulnerability C. threat, risk D. risk, threatA. vulnerability, risk
- 6Generally, regardless of threat or vulnerability, there will ____________ be a chance a threat can exploit a vulnerability. A. Never B. Occasionally C. Always D. SeldomC. Always
- 7Which of the following domains addresses schedules and deliverables? A. Plan, Organize, and Perform B. Build, Acquire, and Implement C. Deliver, Service, and Support D. Evaluate, Assess, and ReviewB. Build, Acquire, and Implement
- 8In the Build, Acquire, and Implement domain, the ability to manage change is very important. Thus, there are often ___________________ set to avoid disrupting current services while new services are added. A. authentications B. entitlements C. upgrades D. guidelinesC. Upgrades
- 9The COBIT Monitor, Evaluate, and Assess domain looks at specific business requirements and strategic direction, and determines if the system still meets these objectives. To ensure requirements are being met, independent assessments known as________________ take place. A. Audits B. quality controls C. quality assurance D. information assurancesA. Audits
- 10Which of the following is not one of the “five pillars of the IA model” A. Confidentiality B. Integrity C. Availability D. AssuranceD. Assurance
- 11In the ______________ principle adopted by many organizations, you gain access only to the systems and data you need to perform your job. A. confidentiality B. integrity C. don’t ask, don’t tell D. need to knowD. need to know
- 12Which of the following situations best illustrates the process of authentication? A. A Web site sets users’ passwords to expire every 90 days B. Using an electronic signature on official documentation C. When an application sets a limit on the amount of payment a user can approve D. When a service is made unavailable to a user due to a server crashA. A Web site sets users’ passwords to expire every 90 days
- 13________________ functions as a preventive control designed to prevent mistakes from happening. ________________ functions as a detective control intended to improve the quality over time by affording opportunities to learn from past mistakes. A. Quality control; Quality assurance B. Governance; Nonrepudiation C. Quality assurance; Quality control D. Quality control; Business as usualC. Quality assurance; Quality control
- 14A__________________ communicates general rules that cut across the entire organization. A. procedure B. policy principles document C. guideline D. policy definitions documentB. policy principles document
- 15Which statement most clearly contrasts the difference between policies and procedures? A. Policies are requirements placed on processes, whereas procedures are the technical steps taken to achieve those policy goals. B. Policies implement controls on a system to make it compliant to a standard, whereas procedures influence the creation of policies. C. Policies set the parameters within which a procedure can be used, whereas procedures influence the creation of policies. D. Policies are often approved by lower-level management responsible for the implementation of policies, whereas procedures are often approved by the most senior levels of management.A. Policies are requirements placed on processes, whereas procedures are the technical steps taken to achieve those policy goals.
- 16ISS policies ensure the consistent protection of information flowing through the entire system. Which of the following is not one of the foundational reasons for using and enforcing security policies? A. protecting systems from the insider threat B. protecting information at rest and in transit C. controlling change to IT infrastructure D. compliance controls for legal mandatesD. compliance controls for legal mandates
- 17When an organization lacks policies, its operations become less predictable. Which of the following is a challenge you can expect without policies? A. lower costs B. increased regulatory compliance C. customer dissatisfaction D. low retention rates for employeesC. customer dissatisfaction
- 18As employees find new ways to improve a system or process, it is important to have a way to capture their ideas. ________________________ can be understood as finding a better way or as a lesson learned. A. Business process reengineering B. Continuous improvement C. Policy implementation D. Change managementB. Continuous improvement
- 19There are many barriers to policy acceptance and enforcement. Which of the following is not one the challenges to policy acceptance? A. organizational support at all levels B. giving employees a stake C. policy awareness and understanding D. disciplinary action for employees who fail to accept policiesD. disciplinary action for employees who fail to accept policies