IS4550 CHAPTER 8

Question 1

A committee that deals with audit issues and non-finacial risks is called ___.

Answer 1

AUDIT COMMITTEE

Question 2

An organization that developed a framework for validation internal controls and managing enterprise risks; focuses on finical operations and risk management is called ___.

Answer 2

COMMITTEE OF SPONSORING ORGANIZATIONS (COSO)

Question 3

Relates to the impact on the business for failing to comply with legal obligations is called ___.

Answer 3

COMPLIANCE RISK

Question 4

A widely accepted framework that brings together business and control requirements with technical issues is called ___.

Answer 4

CONTROL OBJECTIVES FOR INFORMATION AND RELATED TECHNOLOGY (COBIT)

Question 5

A person that implements policies and procedures such as backup, versioning, uploading, downloading and database administration is called ___.

Answer 5

DATA ADMINISTRATOR

Question 6

A person that grants access rights and assesses information security threats to organization is called ___.

Answer 6

DATA SECURITY ADMINISTRATOR

Question 7

The owner of data and approver of access rights and is responsible for data quality is called ___.

Answer 7

DATA STEWARD

Question 8

A framework that aligns strategic goals, operations effectiveness, reporting, and compliance objectives; not technology specific is called ___.

Answer 8

ENTERPRISE RISK MANAGEMENT (ERM)

Question 9

A committee that helps align the security committee to organization goals and objectives is called ___.

Answer 9

EXECUTIVE COMMITTEE

Question 10

Events that could potentially impact the business when it fails to provide adequate liquidity to meet its obligations is called ___.

Answer 10

FINANCIAL RISK

Question 11

A set of tools that bring together the capabilities to systematically manage risk and policy compliance is called ___.

Answer 11

GOVERNANCE, RISK MANAGEMENT AND COMPLIANCE (GRC)

Question 12

A role that deals with all aspects of information such as security, quality, definition, and availability; responsible for data quality is called ___.

Answer 12

HEAD OF INFORMATION MANAGEMENT

Question 13

An individual accountable for identifying, developing, and implementing security policies and corresponding security controls is called ___.

Answer 13

INTERNATIONAL ORGANIZATION FOR STANDARDIZATION (ISO)

Question 14

Having two or more layers of independent controls to reduce risk is called ___.

Answer 14

LAYERED SECURITY APPROACH

Question 15

An organization that creates security guidelines on security controls for federal information systems is called ___.

Answer 15

NATIONAL INSTITUE OF STANDARDS AND TECHNOLOGY (NIST)

Question 16

___ is a framework for information security assessment and planning consisting of tools, techniques, and methods.

Answer 16

OCTAVE

Question 17

An event that disrupts the daily activities of an organization is called ___.

Answer 17

OPERATIONAL RISK

Question 18

A committee that provides important information on the risk appetite of the organization and various businesses is called ___.

Answer 18

OPERATIONAL RISK COMMITTEE

Question 19

Understanding risks and determining how much potential risk and related problems the business is willing to accept is called ___.

Answer 19

RISK APPETITE

Question 20

A domain in the ISACA Risk IT framework that calls for analyzing risk and determining impact on the business is called ___

Answer 20

RISK EVALUATION

Question 21

A domain in the ISACA Risk IT framework that ensures that risk management activity aligns with the business goals, objectives, and tolerances is called ___.

Answer 21

RISK GOVERNANCE

Question 22

A domain in the ISACA Risk IT framework that specifies the ability to react so that risks are reduced and remedied in a cost-effective manner is called ___.

Answer 22

RISK RESPONSE

Question 23

A committee that acts as a steering committee for the information security program is called ___.

Answer 23

SECURITY COMMITTEE

Question 24

Underlying principle states that no individual should be able to execute a high-risk transaction or conceal errors or fraud in the normal course of their duties is called ___.

Answer 24

SEPARATION OF DUTIES (SOD)

Question 25

An event that may change how the entrée organization operates is called ___.

Answer 25

STRATEGIC RISK

Question 26

Focusing resources to deliver the greatest benefits is called ___.

Answer 26

VALUE DELIVERY

Question 27

1. The security committee is the key committee for the CISO? | TRUE OR FALSE

Answer 27

TRUE

Question 28

2. Which of the following is not an IT security policy framework? 1. COBIT 2. ISO 3. ERM 4. OCTAVE

Answer 28

ERM

Question 29

3. Which of the following are PCI DSS network requirements? 1. Network segregation 2. Penetration testing 3. Virus scanning 4. All the above 5. 1 and 2 only

Answer 29

Network segregation Penetration testing Virus scanning ALL THE ABOVE

Question 30

4. Which of the following are common IT framework characteristics? 1. Risk based management 2. Aligned business risk appetite 3. Reduced operation disruption and losses 4. Established path from requirements to control 5. All the above 6. 1 and 3 only

Answer 30

Risk based management Aligned business risk appetite Reduced operation disruption and losses Established path from requirements to control ALL THE ABOVE

Question 31

5. Which of the following applies to both GRC and ERM? 1. Defines an approach to reduce risk 2. Applies rigid framework to eliminate redundant controls, policies, and efforts 3. Passively enforces security policy 4. Seeks line of sight into root causes of risks

Answer 31

Defines an approach to reduce risk

Question 32

6. The underlying concept of SOD is that individuals execute high risk transactions as they receive pro-approval. TRUE OR FALSE

Answer 32

FALSE

Question 33

7. A risk management and metrics team is generally the first team to respond to an incident. TRUE OR FALSE

Answer 33

FALSE

Question 34

8. which of the following approves business access to data? 1. Data steward 2. Data guardian 3. Data administrator 4. 1 and 3 5. All the above

Answer 34

Data steward

Question 35

9. Which of the following is not a key area of improvement noted after COBIT implementation? 1. Value delivery 2. Decentralization of the risk function 3. Better resourcing of IT 4. Better communication

Answer 35

Decentralization of the risk function

Question 36

10. A security team's organizational structure defines the team's ___.

Answer 36

Priorities or specialties

Question 37

11. Implementing a governance framework can allow an organization to systemically identify and prioritize risks. TRUE OR FALSE

Answer 37

TRUE

Question 38

12. The more layers of approval required for SOD, the more ___ it is to implement the process.

Answer 38

Expensive or burdensome

Question 39

13. Monitoring detects which of the following? 1. A network breach 2. Hackers probing the network 3. 1 and 2 4. None of the above

Answer 39

A network breach | Hackers probing the network

Question 40

14. All organizations should have a full-time team dedicated to collecting, reviewing, and reporting to demonstrate adherence to regulation. TRUE OR FALSE

Answer 40

FALSE