Reference no: EM131271985
Of the following frameworks available from ISACA, which one governs IT investments?
IT Assurance Framework
Applying controls is a direct result of the risk assessment process combined with an analysis of the tradeoffs. Which one of the following is a tradeoff?
Applying controls to a system helps eliminate or reduce the risks. In many cases, the goal is not to eliminate the risk but to reduce the risk to an acceptable level. Why? Applying controls is a direct result of the risk assessment process combined with an analysis of ___________.
The governing process for managing risks and opportunities is the definition of:
NIST Internal Reports (NISTIR)
Consensus Audit Guidelines (CAG)
Generally Accepted Privacy Principles (GAPP)
Enterprise risk management (ERM)
Analyzing potential threats requires the identification of all possible threats first. This is called __________.
During an IT audit, which of the following administrative safeguards needs to be tested and validated?
Assignment of responsibilities
Rotation of duties
All of the above
When performing a security assessment, using a framework such as NIST 800-15, which is generally the first step?
Exploit and validate vulnerabilities
What is generally not tracked in a change management database?
Operating system type
Cost of software
What is an example of multifactor authentication?
A fingerprint reader
A smart card with a PIN
An acceptable use policy
Of the four elements of an audit finding, which one identifies the expected or desired state, which provides context for evaluating the evidence collected by the auditor and the subsequent procedures the auditor performs?
For security controls, gap analysis involves comparing the present state of controls with a desired state of controls. At a minimum, common baseline security controls should be in place. Any gaps to various types of controls should be clearly documented, for example - "Business continuity management", which:
Defines the program to provide initial and ongoing security education across the organization.
Defines how staff will execute upon the policies, assign responsibilities, and promote accountability.
Prevents errors and unauthorized misuse of applications.
Provides methods to continue critical operations in spite of business interruptions.
Which element does not constitute an audit finding?
During an IT audit of a social networking site, the auditor finds that users do not have the option to opt out of a new program to share portions of users' profiles automatically. Which privacy principle is most affected?
Choice and consent
Monitoring and enforcement