Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

ISC > Information Systems and Data Management > Flashcards

Information Systems and Data Management Flashcards

(60 cards)

Start Studying
1
Q

What is in the IT Infrastructure

A

Operating systems
Servers
Network Infrastructure
End-user devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Operating Systems (OS)

A

A software that manages computer
hardware and provides services for computer programs. It
acts as an intermediary between the computer hardware and
the computer user, making it possible for software applications to function.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Examples of Operating Systems (OS)

A

● Windows 10
● macOS Big Sur
● Linux distributions such as Ubuntu
● Mobile OSs like Android and iOS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Servers

A

Are computers designed to process requests and deliver data to another computer over the internet or a local network. They’re the backbone of any IT infrastructure, providing centralized data storage, processing, and management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Examples of Servers

A

● Web Servers: Host websites. E.g., Apache or Nginx.
● Database Servers: Store and manage databases. E.g.,
MySQL, PostgreSQL.
● File Servers: Store and manage files within a network.
E.g., Network Attached Storage (NAS) devices.
● Mail Servers: Manage and store emails. E.g., Microsoft
Exchange.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Network Infrastructure

A

Consists of the hardware and software
components used to connect computers and devices to communicate and share resources. It ensures the integrity and security of data transmission.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Examples of Network Infrastructure

A

Switches: Devices that connect devices within a network, operating at the data link layer. E.g., Cisco Catalyst switches.
● Routers: Devices that connect different networks together, directing data traffic. E.g., Netgear routers.
● Firewalls: Devices or software that monitor and control incoming and outgoing network traffic, establishing a barrier between a trusted and an untrusted network. E.g., Fortinet firewalls.
● Wireless Access Points: Devices that allow wireless devices to connect to the wired network. E.g., Ubiquiti UniFi APs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

End-user Devices

A

Are the devices that end-users employ to access, input, and interact with data. They’re the primary interface between users and the IT infrastructure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Examples of End-user Devices

A

● Desktops: Workstation computers like the Dell OptiPlex series.
● Laptops: Portable computers like Apple’s MacBook Pro or Lenovo’s ThinkPad.
● Tablets: Touchscreen devices such as the Apple iPad or Samsung Galaxy Tab.
● Smartphones: Mobile phones with advanced capabilities like the iPhone or Google Pixel.
● Thin clients: Lightweight computers that rely on a server for the heavy lifting, often used in centralized IT environments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Cloud Computing

A

Refers to the on-demand delivery of computing resources over the internet, often on a pay-as-you-go basis. Instead of owning and maintaining physical servers, businesses
can rent access to a range of services from a cloud service provider. This can lead to cost savings, increased scalability, and flexibility.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

List the Cloud Computing Models

A

Infrastructure as a Service (IaaS)
Platform as a Service (PaaS)
Software as a Service (SaaS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Infrastructure as a Service (IaaS)

A

Provides users with virtualized computing
resources over the internet. IaaS is like renting space on a physical server or renting that server itself. Users get the raw infrastructure and have to manage the OS, applications, and data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Examples of Infrastructure as a Service (IaaS)

A

● Amazon EC2 (Elastic Compute Cloud)
● Google Compute Engine
● Microsoft Azure VMs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Platform as a Service (PaaS)

A

Provides users with a platform and environment to directly develop, run, and manage applications without dealing with the complexity of building and maintaining the infrastructure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Examples of Platform as a Service (PaaS)

A

● Google App Engine
● Microsoft Azure App Service
● Heroku

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Software as a Service (SaaS)

A

Delivers software applications over the internet, on-demand, and typically on a subscription basis. Users access the software through a web browser.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Examples of Software as a Service (SaaS)

A

● Google Workspace (formerly G Suite)
● Microsoft 365
● Salesforce
● Dropbox

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Deployment Models

A

Public Cloud
Private Cloud
Hybrid Cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Public Cloud

A

Owned and managed by third-party cloud
service providers, which deliver computing resources such as servers and storage over the internet. Multiple users or tenants share the same infrastructure pool.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Benefits of a Public Cloud

A

Economies of scale
reduced costs
easy scalability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Examples of a Public Cloud

A

Amazon Web Services (AWS)
Google
Cloud Platform (GCP)
Microsoft Azure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Private Cloud

A

Used exclusively by a single organization.
It can be hosted on-premises or by a third party, but the infrastructure is not shared.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Benefits of a Private Cloud

A

Greater control and security
data sovereignty
customization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Examples of a Private Cloud

A

VMware vCloud
OpenStack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Hybrid Cloud
Combines public and private clouds, allowing data and applications to be shared between them. Organizations can move workloads as needs and costs change, harnessing greater flexibility and more deployment options.
26
Benefits of a Hybrid Cloud
Flexibility scalability security cost-efficiency
27
Examples of a Hybrid Cloud
Using AWS and on-premises data centers together, or Azure with a private cloud setup.
28
What is the availability formula?
(Agreed Service Time- Downtime/Agreed Service Time) x 100
29
What are the backup types?
Full Backup Incremental Backup Differential Backup
30
Steps to Detect Deficiencies
1. Review Documentation 2. Conduct Interviews 3. Test Controls 4. Monitor System Performance Metrics 5. Examine Incident Logs 6. Compare Against Benchmarks
31
What is the role of Cloud Service Providers? (CSPs)
CSPs offer cloud computing services that allow businesses to access and use computing resources over the internet on a pay-as-you-go or subscription basis.
32
What are the key responsibilities of CSPs? *Remember IPSSSSTII* "I Put So So So So Much Transparency In Integration"
Infrastructure Maintenance Platform & Software Updates Security & Compliance Service Availability & Reliability Scalability & Performance Optimization Support & Customer Service Transparent Billing & Cost Management Integration & Compatibility Innovation & Feature Development
33
What is COSO Internal Control - Integrated Framework (ICIF)?
The ICIF emphasizes effective internal controls within an organization. With the shift towards cloud computing, businesses need to ensure that their internal controls extend to the cloud environment.
34
How does COSO Internal Control-Integrated Framework apply? (ICIF)
1. Control Environment: This relates to the organization's stance on governance and risk management. 2. Risk Assessment: Cloud computing introduces new risks, like potential data breaches or loss of data. 3. Control Activities: With cloud computing, control activities could involve ensuring the proper configuration of cloud services. 4. Information & Communication: Communication is vital when using cloud services. 5. Monitoring: Organizations must continuously monitor cloud services to ensure they adhere to the set internal controls.
35
What is the COSO Enterprise Risk Management (ERM) Framework?
The ERM framework deals more with identifying and responding to risks in a strategic context. In terms of cloud computing: 1. Governance and Culture 2. Strategy and Objective-Setting 3. Performance 4. Review and Revision 5. Information, Communication, and Reporting.
36
Sections in Availability
1. Business Reiliency, Distaster Recovery ,Business Continuity Plan 2. Objective of mirroring & Replication 3. Steps in a business impact analysis 4. Measures of sytems availabilty 5. Appropiatness of organizations data backup 6. Detecting deficencies in controls related to availability using the TSC
37
Business Resiliency
Strategies to ensure a organization can continue operations during & after a disruptive event Purpose- Make possible to rebound quickly or continue operations during challenges. Sets up measures to be proactive, reactive, and adaptive
38
Data Lifecycle Phases
Creation/Collection- How types of data are created and gathered from various sources Use- how data is used Storage- retaining data on various devices for future use Disposal- archiving, deleting, and destroying data
39
Trust Services Criteria (TSC)
Suitable criteria for measuring or evaluating controls 5 TSC -Security -Availability -Processing Integrity -Confidentiality -Privacy All SOC exams must include security, the others are optional
40
NIST Privacy Framework
Seeks to reduce privacy incidents that may cause issues for individual data subjects 5 functions Identify- develop an understanding of privacy risks from data processing Govern- Develop and implement a structure that allows understanding of privacy risk management priorities Control- Control activities that respond to privacy risks Communicate- Activities that support discussion and awareness of privacy Protect- Develop and implement data processing safeguards
41
Order of execution for SQL SELECT queries
1. FROM- specifies the tables from which to extract the data 2. WHERE- filters the data 3. GROUP BY- aggregates the data 4. HAVING- filters aggregated data 5. SELECT- specifies the fields extracted 6. ORDER BY- sorts the returned data 7. Limit: restricts the rows returned
42
Privacy vs Confidential
Confidential- pertains to many types of restrictive or proprietary information from unauthorized people. Come with legal obligation limiting use, retention, or disclosure of info Privacy- pertains to personal info. While confidentiality is about unauthorized access, privacy is about unauthorized or inappropriate collection, storage, use, and sharing of personal data.
43
Type of Opinions
Unqualified (or Unmodified) Opinion- This is the "clean" opinion. It indicates that the service organization's controls were suitably designed (for a Type 1 report) and operating effectively (for a Type 2 report) during the review period. No significant exceptions or deficiencies were noted. Qualified Opinion- This opinion is provided when the service auditor determines that there are exceptions or deficiencies in certain areas, but they are limited in scope. In other words, most controls are deemed effective, but some specific issues were identified. Adverse Opinion- An adverse opinion is provided when the service auditor determines that the controls were not suitably designed (for Type 1) or were not operating effectively (for Type 2) during the review period. This is a strong negative opinion indicating widespread issues. Disclaimer of Opinion-This occurs when the service auditor cannot form an opinion due to significant scope limitations. For example, a lack of available evidence or significant restrictions on the auditor's work may lead to a disclaimer of opinion.
44
Unqualified (or Unmodified) Opinion
This is the "clean" opinion. It indicates that the service organization's controls were suitably designed (for a Type 1 report) and operating effectively (for a Type 2 report) during the review period. No significant exceptions or deficiencies were noted.
45
Qualified Opinion
This opinion is provided when the service auditor determines that there are exceptions or deficiencies in certain areas, but they are limited in scope. In other words, most controls are deemed effective, but some specific issues were identified.
46
Adverse Opinion
When the service auditor determines that the controls were not suitably designed (for Type 1) or were not operating effectively (for Type 2) during the review period. This is a strong negative opinion indicating widespread issues.
47
Disclaimer of Opinion
This occurs when the service auditor cannot form an opinion due to significant scope limitations. For example, a lack of available evidence or significant restrictions on the auditor's work may lead to a disclaimer of opinion.
48
Data Dictionary
Stores metadata related to the properties of fields in a relational database table, such as the correct data type, value, range, format, descriptions, and constraints.
49
COBIT 2019
Control Objectives for Information and Related Technologies A framework for developing, implementing, monitoring, and improving IT governance and management practices.
50
Governance System Principles
● Stakeholder Value Delivery: Governance should focus on delivering value to stakeholders. ● Holistic Approach: Approach governance from a comprehensive perspective considering all components. ● Dynamic Governance System: The governance system should adapt to changes in enterprise goals and the context it operates in. ● Governance Distinct from Management: Clearly separate governance from management to ensure checks and balances.
51
Governance Framework Principles
● Flexible Framework: It should cater to any entity regardless of size, sector, or other variables. ● Based on a Conceptual Model: The framework is based on a structured and interconnected conceptual model. ● Aligned to Major Standards: The framework is aligned to other leading frameworks and standards. ● Science-Based Foundation: The foundation of the framework is rooted in research and academic rigor.
52
NIST SP 800-53
Offers a catalog of security and privacy controls designed to protect federal information systems and organizations from various threats such as cyber-attacks, natural disasters, and human errors. It helps organizations tailor and implement controls based on their risk assessments to safeguard operations, assets, and individuals.
53
Criteria for a vendor to be considered a subservice organization
1. Providing services on behalf of the service org that is relevant to the system being described in the SOC report 2. Services provide impact to the service org ability to meet control objectives stated in SOC 1 report or TSC in SOC 2 report 3. Has autonomy or discretion in decision-making processes 4. Activities are integrated with service org operations that they are part of the services it provides to user entities.
54
Types of Data Storage
Data Storage Data Warehouse Data Lake Data Mart Database schemas Star Snowflake
55
Data Warehouse
A large, centralized repository of data that consolidates data from various sources to support business intelligence (BI) activities such as reporting and analysis. Data is structured Maintains historical data and doesn't change Integrated from various sources-cleaned and transformed
56
Data Lake
A storage repository that holds a vast amount of raw data in its native format until it's needed. It can store structured, semi-structured, or unstructured data. Can store any data—logs, sensor data, audio, video, etc. Structure is not defined when storing, only when reading. Often built on low-cost storage.
57
OODA Loop
Observe Orient Decide Act
58
What is the observe category in OODA Loop
Security monitoring tools that identify events that might need further investigation -Security information and event management -Intrusion detection systems -Netflow analyzers -Vulnerability scanners -Availability monitoring -Web Proxies
59
CIS Critical Security Controls
Critical controls that organizations should implement to mitigate cyber risks: 1. Inventory and Control of Enterprise Assets 2. Inventory and Control of Software Assets 3. Data Protection 4. Secure Configuration of Enterprise Assets and Software 5. Account Management 6. Access Control Management 7. Continuous Vulnerability Management 8. Audit Log Management 9. Email and Web Browser Protections 10. Malware Defenses 11. Data Recovery 12. Network Infrastructure Management 13. Network Monitoring and Defense 14. Security Awareness and Skills Training 15. Service Provider Management 16. Application Software Security 17. Incident Response Management 18. Penetration Testing
60

ISC (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions