Area II - Security, Confidentiality and Privacy Flashcards

Understanding cybersecurity and data protection standards. (55 cards)

1
Q

What does an output control ensure in a data system?

A

Output control ensures data is valid, properly distributed, and used with authorization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is verified by a processing control?

A

Processing control verifies that data processing results in correct outputs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define a hash total in input controls.

A

A hash total is a non-significant sum of input values used to verify data integrity.

Example: Summing Social Security Numbers to ensure consistency pre- and post-input.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What purpose does a validity check serve?

A

It confirms that data entries match predefined set criteria.

Example: Ensures no alphabetic characters are in numeric fields.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Describe a limit check in data validation.

A

A limit check ensures that numeric values do not exceed predefined limits.

Example: Validates that age does not exceed 110 years.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the function of a check digit in data entry?

A

A check digit is an additional number used to verify the accuracy of a set of digits, typically appended at the end.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Explain the purpose of a field check in data entry.

A

A field check prevents the entry of invalid characters into data fields.

Example: Ensures only numbers are entered in a Social Security Number field.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the primary purpose of the Sarbanes-Oxley Act (SOX)?

A

To protect investors by improving the accuracy and reliability of corporate disclosures.

SOX was enacted in response to financial scandals to enhance corporate governance and restore investor confidence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

True or False:

GAAP is a set of rules and guidelines for financial reporting in the United States.

A

TRUE

Generally Accepted Accounting Principles (GAAP) provide the framework for financial accounting and reporting in the U.S.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Fill in the blank:

IFRS stands for ______.

A

International Financial Reporting Standards

IFRS are designed to bring consistency to accounting language, practices, and statements globally.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

List three major components of the COSO Internal Control Framework.

A
  • Control Environment
  • Risk Assessment
  • Control Activities

The COSO framework helps organizations design and evaluate their internal controls to ensure effective operations and compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which organization is responsible for setting auditing standards for private companies in the U.S.?

A

AICPA

The American Institute of Certified Public Accountants (AICPA) provides guidelines and standards for private company audits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the primary goal of the SEC?

A

To protect investors, maintain fair, orderly, and efficient markets, and facilitate capital formation.

The U.S. Securities and Exchange Commission (SEC) oversees securities transactions, activities of financial professionals, and mutual fund trading to prevent fraud and intentional deception.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

True or False:

The IASB is responsible for developing IFRS.

A

TRUE

The International Accounting Standards Board (IASB) is the independent body that develops and approves International Financial Reporting Standards (IFRS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Name one key difference between GAAP and IFRS.

A

GAAP is rules-based, while IFRS is principles-based.

This distinction can lead to differences in how accounting standards are applied and interpreted between the two frameworks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Fill in the blank:

The ______ is a framework for evaluating the effectiveness of an organization’s risk management processes.

A

COSO ERM

COSO Enterprise Risk Management (ERM) helps organizations identify, assess, and manage risks that might affect their objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does PCAOB stand for?

A

Public Company Accounting Oversight Board

PCAOB oversees the audits of public companies to protect investors and further the public interest in the preparation of informative, accurate, and independent audit reports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

List two key objectives of internal controls.

A
  • Reliability of financial reporting
  • Compliance with applicable laws and regulations

Internal controls also aim to enhance the effectiveness and efficiency of operations and safeguard assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

True or False:

GAAP and IFRS have identical revenue recognition principles.

A

FALSE

While efforts have been made to align revenue recognition standards, differences still exist between GAAP and IFRS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the purpose of the Basel III framework?

A

To strengthen regulation, supervision, and risk management within the banking sector.

Basel III was developed in response to the deficiencies in financial regulation revealed by the financial crisis of 2007-2008.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Fill in the blank:

The ______ is a set of standards for financial reporting aimed at promoting transparency and accountability in governmental financial reporting.

A

GASB

The Governmental Accounting Standards Board (GASB) establishes standards for financial reporting for state and local governments in the U.S.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Name one of the five components of internal control according to the COSO framework.

A

Monitoring

Monitoring activities provide assurance that internal controls are present and functioning as intended.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

True or False:

The SEC directly sets accounting standards for public companies.

A

FALSE

While the SEC oversees financial reporting, it delegates the setting of accounting standards to organizations like the FASB.

24
Q

What is the primary focus of the FASB?

A

To establish and improve financial accounting and reporting standards in the U.S.

The Financial Accounting Standards Board (FASB) is recognized by the SEC as the designated accounting standard setter for public companies.

25
List two fundamental qualities of useful financial information.
* Relevance * Faithful representation ## Footnote These qualities ensure that the financial information provided is useful for decision-making purposes.
26
What is the primary objective of financial reporting?
To provide financial information that is useful to existing and potential investors, lenders, and other creditors. ## Footnote Financial reporting aims to offer insights into an entity's financial performance and position to aid in economic decision-making.
27
# Fill in the blank: The \_\_\_\_\_\_ is an international framework for ensuring the quality of audits of small- and medium-sized entities.
IFAC ## Footnote The International Federation of Accountants (IFAC) supports the development, adoption, and implementation of high-quality international standards.
28
# True or False: IFRS allows the use of LIFO inventory valuation.
FALSE ## Footnote Under IFRS, the use of Last In, First Out (LIFO) inventory valuation is prohibited.
29
What is the primary purpose of an audit?
To provide an independent opinion on the fairness of the financial statements. ## Footnote Audits enhance the credibility of financial statements by providing assurance that they are free from material misstatements.
30
List two key responsibilities of an auditor.
* Assessing risk of material misstatement * Designing audit procedures to address those risks ## Footnote Auditors also evaluate the overall presentation of the financial statements and compliance with applicable standards.
31
# Fill in the blank: The \_\_\_\_\_\_ focuses on improving the effectiveness of public sector audit institutions.
INTOSAI ## Footnote The International Organization of Supreme Audit Institutions (INTOSAI) promotes the exchange of ideas and experiences among public sector auditors globally.
32
What is the primary goal of security testing?
To identify vulnerabilities in a system. ## Footnote Security testing aims to uncover potential weaknesses in systems to prevent security breaches.
33
# True or False: Penetration testing is a type of security testing.
TRUE ## Footnote Penetration testing simulates attacks to find security weaknesses in a system.
34
# Fill in the blank: \_\_\_\_\_\_ analysis reviews source code to identify security flaws.
Static code ## Footnote Static code analysis helps detect vulnerabilities early in the software development lifecycle.
35
Name one advantage of dynamic analysis in security testing.
Identifies vulnerabilities in a running application. ## Footnote Dynamic analysis tests software in real-time, exposing issues not evident in static analysis.
36
What is the role of a security audit?
To evaluate the effectiveness of security policies and procedures. ## Footnote Security audits ensure compliance with security standards and identify areas for improvement.
37
# Define: vulnerability scanning
Automated process to identify security weaknesses. ## Footnote Vulnerability scanning uses tools to detect known vulnerabilities in systems and applications.
38
# True or False: Security testing only applies to software applications.
FALSE ## Footnote Security testing encompasses networks, systems, and applications to ensure comprehensive protection.
39
What type of security testing involves simulating a cyberattack?
Penetration testing ## Footnote Penetration testing helps assess the resilience of systems against real-world attacks.
40
List two benefits of security testing.
* Enhances system integrity * Protects sensitive data ## Footnote Effective security testing can prevent data breaches and maintain trust in systems.
41
What is 'fuzz testing'?
Injecting random data into a program to find vulnerabilities. ## Footnote Fuzz testing helps identify unexpected behavior or crashes that may indicate security flaws.
42
# Fill in the blank: A \_\_\_\_\_\_ test assesses a system's ability to handle an attacker who has partial knowledge.
Grey box ## Footnote Grey box tests combine elements of both black box and white box testing, simulating realistic attack scenarios.
43
What is the purpose of a security checklist?
To ensure all security measures are implemented and verified. ## Footnote Security checklists help standardize testing processes and ensure comprehensive coverage.
44
# True or False: Code reviews can be part of security testing.
TRUE ## Footnote Code reviews allow for the identification of security issues by examining the source code.
45
What does 'CWE' stand for?
Common Weakness Enumeration ## Footnote CWE is a list of software weaknesses used to understand and prevent vulnerabilities.
46
List one common tool used for vulnerability scanning.
Nessus ## Footnote Nessus is a widely used vulnerability scanner for identifying and fixing security issues.
47
Describe 'risk assessment' in the context of security testing.
Evaluating potential threats and their impact. ## Footnote Risk assessment helps prioritize security testing efforts based on the severity of potential vulnerabilities.
48
# True or False: Security testing is only performed after software deployment.
FALSE ## Footnote Security testing should be integrated throughout the software development lifecycle to catch vulnerabilities early.
49
What is 'threat modeling'?
Identifying and prioritizing potential security threats. ## Footnote Threat modeling helps design security measures to mitigate identified threats.
50
# Fill in the blank: A \_\_\_\_\_\_ test is conducted without any prior knowledge of the system.
Black box ## Footnote Black box testing simulates an external attack without insider knowledge, focusing on the system's external interfaces.
51
What is a 'zero-day' vulnerability?
A security flaw unknown to the vendor. ## Footnote Zero-day vulnerabilities are exploited before developers can issue patches, posing significant risk.
52
List two outcomes of successful security testing.
* Improved security posture * Reduced risk of data breaches ## Footnote Successful security testing leads to stronger defenses and protects against potential cyber threats.
53
# True or False: Security testing includes checking physical security controls.
TRUE ## Footnote Comprehensive security testing evaluates both digital and physical security measures to ensure overall protection.
54
What is 'ethical hacking'?
Authorized testing to identify security vulnerabilities. ## Footnote Ethical hacking involves using hacking techniques to improve system security with permission.
55
# Fill in the blank: \_\_\_\_\_\_ testing uses knowledge of the internal structure of the system.
White box ## Footnote White box testing involves examining the internal workings of an application to find security flaws.