Please note: In order to obtain your CPE certificate for having passed the quiz, you must turn off your pop-up blocker.
Ross Article
Thorp Article
Le Grand and Sarel Article
Rozek Article
Marcella Article
Chandola Article
CPE Quiz #
122
Based on Information Systems Control Journal Volume 5, 2008
A passing score of 75 percent qualifies for one (1) hour of CISA/CISM/CGEIT Continuing Professional Education (CPE) Credit
Your results will appear in a new window.
Enter your name below so it displays on the quiz results page:
Name:
Ross Article1. Identity management and automated compliance are two obvious examples of where human intervention can be minimized.
2. Risk management is a frequently explored reason to explain the unreliability of information security.
3. “Probability” describes whether an event will occur at all, whereas “likelihood” refers to the number of instances of a certain event over a period of time.
4. A source of a problem related to risk management is time lag. The underlying asset may change but the protective mechanisms do not keep up.
Thorp Article5. The Val IT Framework 2.0 aligns more closely with COBIT and extends the Val IT framework beyond new investments to encompass all IT expenditures including ongoing IT services, assets and other resources.
6. Among the updates and enhancements to the Val IT framework are the opportunity for IT to influence, not simply support, business strategy as well as the linkage of expected investment benefits to business targets, forecasts and budgets to reinforce accountability and facilitate monitoring.
7. The Val IT Framework 2.0 excludes guidance for executives interested in establishing a more effective approach to value management, but work is underway.
Le Grand and Sarel Article8. The 2007 Computer Crime and Security Survey, by the Computer Security Institute, identifies respondents who actually detected attacks and abuses of net access at 25 percent, unauthorized access to information at 17 percent, and theft of customer or employee data at 59 percent.
9. There are known fundamental weaknesses in perimeter controls—the bad guys are frequently a step ahead of the protection and the insider threat is now recognized to be at least as serious as the threat of attack from outside the organization.
10. The centralized data access controls via the agent and monitoring system provide a focal point for knowing exactly who accessed what data, and they are also not subject to the limitations of identity access management or applications because the policy can be specified right in the agent itself.
11. It is common to implement controls specifically to compensate for known system vulnerabilities and their related exploits.
12. Compliance is best accomplished by meeting requirements and ensuring that the ways in which requirements are met actually provide effective security and accountability. The goal is to provide security first, and compliance as required.
Rozek Article13. The work required to meet the requirements of the Sarbanes-Oxley Act is no longer being regarded as a compliance process, but instead as an opportunity to establish a strong governance model designed to ensure accountability and responsiveness.
14. While testing the operational effectiveness of controls, IT management will first determine and document which controls will be tested. There is no quantitative formula or prescriptive checklist to follow.
15. Multiple areas of IT that do not directly affect financial data integrity are not required to be reviewed in the IT Sarbanes-Oxley program.
Marcella Article16. Two important concepts related to electronically stored information (ESI) are hold management (the ability to respond to a legal action) and spoliation (the willful destruction of evidence that is germane to the case in litigation).
17. ESI audit considerations include the development of repeatable processes that have the flexibility to accommodate a variety of discovery and regulatory processes.
18. Because the US court system's Federal Rules of Civil Procedure (FRCP) is US-centric in its applications, they are not global in their implication and application.
Chandola Article19. The high cost of noncompliance has enabled the shift in the question of compliance from “if” to “when” for executives who were traditionally focused on tangible return on security investments.
20. One of the compliance project challenges presented in this article pertains to “pockets of internal resistance to compliance.” This can be resolved with buy-in from the process execution owners coordinated through the steering committee.
21. The security compliance and remediation project landscape has matured to the extent that mapping and aligning the business processes and culture with the planned remediation changes is no longer a challenge.
|
Your results will appear in a new window.
|
Please note: This quiz requires a JavaScript-enabled browser.
If the quiz is not displayed above, you either do not have a browser which
supports JavaScript or JavaScript support has been disabled.
|
|
|