Domain 2 - Governance & Mngmt Of IT

Question 1

What does IT governance do

Answer 1

Ensures optimal use of IT resources and thereby supporting the business strategy.

Question 2

Who must be involved in IT governance

Answer 2

Senior management/stakeholders

Question 3

Who approves IT security policy

Answer 3

BOD

Question 4

2 steps in developing a risk management program

Answer 4

1) establish the purpose of the RM program
2) assign responsibility for the RM program

Question 5

Information security standards committee (ISSC) determines if:

Answer 5

controls & practices are suitable around the operating systems and databases
(Senior management and C-Level executive management)

Question 6

IT steering committee

Answer 6

Responsible for:
-implementation
-approving project plans & budget
-projects meet requirements
-efficient use of IT resources
-monitors

Question 7

Enterprise architecture

Answer 7

Defines the structure and operations of an org; ensures technology initiatives are compatible with IT framework
- must include both current and future state outcomes to be complete

Question 8

Enterprise risk management (ERM) steps

Answer 8

1. Asset identification
2. Determine the threat/vulnerability
3. Evaluation of the impact
4. Calculation of risk
5. Evaluation of/response to risk

Question 9

Capability maturity model

Answer 9

Helps determine maturity level of the risk management process; constant improvement; performance based

Question 10

Maturity models identify -

Answer 10

Gaps between current and desired state

Question 11

IT Balance Scorecard (BSC)

Answer 11

• objective is to optimize performance
  -KPIs are required
  -measures success of IT investment & strategy

Question 12

First 2 steps in reviewing the software quality management process

Answer 12

1. Review standards/policies adopted by org
2. Review controls in place

Question 13

Recovery point objective (RPO)

Answer 13

Determined based in acceptable data loss in the case of disruption of operations; defined point in time

Question 14

Who is essential in identifying critical business functions, recovery times, and resources needed in a BCP

Answer 14

Process owners

Question 15

(BIA) business impact analysis

Answer 15

-presented to BOD
-Determines acceptable downtime
-BCP first step is identifying critical business processes and determining priority for recovery

Question 16

BCP predetermined criteria

Answer 16

Duration of an outage
-BCP should be based on the max time a business can function with disruption before it threatened achievement of organizations objectives

Question 17

BCP tests - Table top

Answer 17

Involves all or some of crisis team members and is focused more on coordination and communication issues than on technical process details

Question 18

BCP tests - Functional

Answer 18

Involves mobilization or personnel and resources at various geographic sites. In-deprh

Question 19

BCP Tests - Full-scale

Answer 19

Involves enterprise wide participation and full involvement of external organizations- plan is actually exercised

Question 20

Most important consideration when reviewing the risk management process

Answer 20

IT risk is presented in business terms

Question 21

Disaster recovery plan (DRP) addresses the:

Answer 21

Technological aspect of business continuity planning (BCP)
-focuses on IT systems and operations

Question 22

The first step in preparing a DRP

Answer 22

Perform a business impact analysis (BIA)

-BIA identifies critical business processes and supporting systems

Question 23

Once the BIA is completed, the next phase in BCP development is

Answer 23

Identify various recovery strategies and select most appropriate one

Question 24

Pilot test

Answer 24

Used for implementing a new process or technology (not appropriate for a BCP)

Question 25

Paper test (desk check)

Answer 25

Walk through part of or entire BCP

Question 26

Unit test

Answer 26

Used to test new software components (not app for BCP)

Question 27

System test

Answer 27

Used to test a new IT system (not app for BCP)

Question 28

An effective BCP involves:

Answer 28

All user departments

Question 29

What will ensure compliance to security policies from an outsourced service provider?

Answer 29

An indemnity clause (included in service provider contract)

Question 30

CMM ensures -

Answer 30

A stable software development process