Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISA > Domain 2: Governance & Management of IT > Flashcards

Domain 2: Governance & Management of IT Flashcards

(58 cards)

Start Studying
1
Q

What is the difference between Governance and Management?

A

Governance aims to provide a strategy to obtain business objectives. Managment aims to implement procedures to achieve the business objectives set by the governance body.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the primary reason an IS auditor should reviw the organisational chart?

A

To understand the structure of the organisation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Who has the final responsibility for IT governance?

A

Board of directors / CEO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What should IT departments do in order to achieve the organisations objectives?

A

The IT department should have long and short-term plans that are consistent with the organisation’s buisness objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a greatest concern with respect to an organisations governance model?

A

Senior mangement does not review information security policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Having approved suppliers for the company’s products is related to what?

A

Strategic planning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Who is responsible for IT governance?

A

The board of directors. They are required to ensure that IT activities are moving in the desired direction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

An IT strategic plan should contain?

A

The IT strategic plan must contain a clear statement regarding the mission and vision of IT.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the main objective of IT governance?

A

Ensuring the optimal use of technology resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the primary purpose of corporate governance?

A

Corporate governance provides a strategic direction to the organisation as a whole.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is COBIT?

A

The Control Objective for Information Technology is an EGIT framework that ensures IT is aligned with business objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is ISO27001?

A

ISO 27000 is a set of best practices for information security programs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is ITIL?

A

The Information Technology Infrastructure Library is a detailed framework for the operational service management of IT.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is O-ISM3?

A

The Open Information Security Management Maturity Model is a process-based ISM maturity model for security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is an IT standard?

A

An IT standard is a mandatory requirement to be followed in order to comply with a given framework or certification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a policy?

A

A policy is a set of ideas or strategies that are used as a basis for decision making. They are the high-level statements of direction by management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a procedure?

A

Procedures are detailed steps and action that help support the policy objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are guidelines?

A

Guidelines are additional details to help execute procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What should the Information security policy contain?

A

This should contain the managements commitment for the safeguarding of information assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When should the information security policy be reviewed?

A

At least annually or when there is a significant change to the envrionment of the business.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What should be the first step for the auditor after discovering that IT policies are not approved by management?

A

Report the findings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How can policy compliance be ensured?

A

Existing IT systems should be able to enable compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What should the Information security policy include?

A

This should include something about access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the most important factor for successful implementation of a security policy?

Study These Flashcards
A

That it is delivered and acknowledged by all users

25
What is the most important concern while reviewing the information security policy?
That the IT department's objectives drive the policy and are not alligned with the organisations overall objectives.
26
What is the most important factor in determining the appropiate level of protection?
The outcome of a risk assessment because it considers risks on the basis of probability and impact.
27
What is the first point of reference for an IS auditor conducting an audit?
Approved policies.
28
What is the most important factor when developing an information security policy?
Risk appetite as some risks will have to be accepted by the business to meet business objectives.
29
Who is apart of the Strategy Committee?
This committee consits of members of the board and specialist non-members of the board.
30
What is the overall job of the IT strategy committee?
To advise the board on the IT strategy.
31
What is the overall job of the IT steering committee?
Responsible for the implementation and monitoring
32
Who does ownership lie with in regards to the system development project?
User management
33
Who does accountability for ensuring relevant controls over IS resources rest with?
The resource owner
34
Who is ultimately responsible for internal control?
Senior Management
35
Who has overall responsibility for system development projects?
The project steering committee
36
Who is the most suitable person to be appointed as chair of the steering committee?
An executive-level officer
37
What is the main advantage of EA?
Enterprise Architecture is to help with technology selection and adoption
38
What is the best level of control when customised software is developed by a third-party vendor?
An escrow agreement
39
What is one of the most valuable factors regarding technology transition rate?
Change control includes the application and execution of good change management systems
40
What are all of the risk management process steps?
Asset identification, the identification of threat and vulnerabilites, evaluation of impact, calculation of risk and risk response
41
What are all of the risk management process steps?
Asset identification, the identification of threat and vulnerabilites, evaluation of impact, calculation of risk and risk response
42
What are the risk analysis methods?
Qualitative, Semi-quantitative and quantitative
43
What are some risk treatment options?
Mitigate, Accept, Avoid, Transfer
44
What is the first step when implementing a risk management program?
Asset identification followed by determining threats and vulnerabilites
45
When auditing a organisations risk management procedure, what should be reviewed first?
Threats and vulnerabilities affecting the assets should be reviewed first.
46
When establishing the level of acceptable risk, who does the responsibility lie with?
Senior business management
47
What is fidelity coverage?
Fidelity insurance is used by an employer to protect against losses caused by a dishonest or disgruntled employee
48
What is a major factor to consider in relation to offshore data storage/transfer?
privacy laws
49
What is a concern surrounding the use of cloud services?
Compliance with laws and regulations
50
When it is not possible to implement segregation of duties, what compensation control should be put in place?
Reviewing transaction and application logs will help to deter employees from misusing their powers
51
What is a risk that an auditor should be aware of when reviewing a company that uses cross-training practices?
If all parts of a sytem are known to only one person, that person may abuse their powers
52
What is the most important consideration when reviewing an approved software product list?
IT products should be reviewed periodcally to ensure new or emerging risks are identifed and addressed
53
What clause in an outsourcing contract will help improve the level of service and reduce costs?
Performance bonuses as it provdes the service provider with incentives to perform
54
What clause is most important when reviewing and floating a Request for Proposal?
References from other customers
55
What is a major concern when reviewing a system development approach?
The lack of a quality plan in the contract
56
What is the BEST control to monitor the service provision of a 3rd party?
Conduct periodic audit reviews
57
What is the first factor to be considered when reviewing the SLA?
Whether the contractual warranties support the requirements of the organisation.
58
What is an idemnity clause?
An indemnity clause is a provision in a contract that requires one party to compensate the other party for any losses or damages that they may incur as a result of the contract

CISA (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions