Trivia Flashcards

What is the purpose of a business impact analysis (BIA) in the context of IT auditing?

Answer: Identify critical systems and the financial impact of their disruption

A BIA identifies critical business functions and quantifies the financial and operational impact of disruptions to guide recovery planning.

Which recovery metric defines the maximum tolerable period of data loss after a disruption?

Answer: Recovery Point Objective (RPO)

RPO defines the maximum age of data that must be recovered from backup for normal operations to resume.

In a hot site disaster recovery arrangement, the alternate facility is characterized by:

Answer: Fully operational hardware, software, and data ready for immediate failover

A hot site is a fully equipped, mirror facility that can take over operations immediately after a disaster.

What does 'chain of custody' refer to in IS auditing and digital forensics?

Answer: The documented trail showing who handled evidence and when

Chain of custody documents the chronological handling of evidence to ensure its integrity and admissibility.

Which type of access control model assigns permissions based on a user's role within an organization?

Answer: Role-Based Access Control (RBAC)

RBAC grants access based on predefined roles, simplifying administration and supporting least privilege.

What is the primary objective of penetration testing in an IS audit context?

Answer: Identify exploitable vulnerabilities before malicious actors do

Penetration testing simulates real-world attacks to uncover vulnerabilities that could be exploited by adversaries.

Which ISACA standard requires IS auditors to maintain independence from the areas they audit?

Answer: ISACA IS Audit and Assurance Standard 1002

ISACA Standard 1002 (Organisational Independence) requires auditors to be independent from the functions and activities they audit.