INMT 341 FINAL QUESTIONS WITH VERIFIED
ANSWERS
How do organizations effectively manage processes, people, and technology so that
they can help generate value? - Answers - GRC (government, risk, and compliance)
Governance - Answers - Governing/managing processes, technology, and systems
(decide what is best for the business)
ex. CEO, CFO, CIO, installing Windows 11 ex
Risk Management - Answers - Identifying (and controlling) the risks associated with
processes, technologies, and systems (what can go wrong)
-taking away all risk is not realistic
-not costless, must perform cost/benefit analysis
Compliance - Answers - Adhering to the laws and regulations that govern organizations
(which can vary based on industry, location, and organizational structure)
ex. privacy, encryption, credit card ex
Most businesses abide by - Answers - business first, tech second
IT Governance - Answers - - subset of overall organizational governance
- business issue not tech issue
- encompasses both risk and compliance
IT+IS (Information technology, information - Answers - are the same thing
Who is the problem in IT? - Answers - people
Governance system components - Answers - -who do we let house out data?
- phishing example
- policies, processes, services, people, culture
CCPA (California Consumer Protection Act) - Answers - only in the US, is a Privacy Law
GDPR (General Data Protection Regulation) - Answers - European privacy law that
gives you the right to be forgotten, they must rid your personal data if you have asked to
be forgotten
Sarbanes-Oxley Act - Answers - IRRON, f/s controls audited by law
PCI standards security council - Answers - credit card encryption laws, emv chips
(europay, mastercard, and visa req by europe)
, HIPPA - Answers - healthcare, protects personally identifiable health records from being
shared by doctors (must be two things)
FERPA (Family Educational Rights and Privacy Act) - Answers - student protections
(parking, academic standing, financial aid)
Risk - Answers - a measure of the potential for loss or damage when a threat exploits a
vulnerability (internal or external threat) (something must be lost or likely)
Governing IT Guidance origin - Answers - frameworks, standards, and compliance
guidance
Standard - Answers - specific methods organizations must follow (solar eclipse
example)
Framework - Answers - suggestions of best practices, but not mandated
Key standard setting groups - Answers - COBIT (segregation of duties for general
business), ITIL, HMG, ISACA
Risk management can lead to - Answers - the need for controls and security measures
(to reduce risks)
Enterprise (business) Risk - Answers - any risk that could potentially affect business
objectives
I+T Risk - Answers - IT-risk that could potentially impact the business, potential for an
unplanned negative business outcome involving the failure or misuse of IT
Audit Risk - Answers - The risk that an auditor has expressed an inappropriate opinion
Vulnerability - Answers - weakness or flaw in an information asset/system that
potentially exposes an entity to threats (people are the problem)
Threat - Answers - an event or condition that has the potential for causing asset loss
and/or undesirable consequences or impact
ex. social engineering, phishing attack, unprotecting data, weather, competitors,
careless employees
Threat actors - Answers - entities who can create/pose a threat, carry out actions that
take advantage of vulnerabilities
ex. destruction, disclosure, errors, software failure, environmental events, fraud,
intrusion, attack, theft
ANSWERS
How do organizations effectively manage processes, people, and technology so that
they can help generate value? - Answers - GRC (government, risk, and compliance)
Governance - Answers - Governing/managing processes, technology, and systems
(decide what is best for the business)
ex. CEO, CFO, CIO, installing Windows 11 ex
Risk Management - Answers - Identifying (and controlling) the risks associated with
processes, technologies, and systems (what can go wrong)
-taking away all risk is not realistic
-not costless, must perform cost/benefit analysis
Compliance - Answers - Adhering to the laws and regulations that govern organizations
(which can vary based on industry, location, and organizational structure)
ex. privacy, encryption, credit card ex
Most businesses abide by - Answers - business first, tech second
IT Governance - Answers - - subset of overall organizational governance
- business issue not tech issue
- encompasses both risk and compliance
IT+IS (Information technology, information - Answers - are the same thing
Who is the problem in IT? - Answers - people
Governance system components - Answers - -who do we let house out data?
- phishing example
- policies, processes, services, people, culture
CCPA (California Consumer Protection Act) - Answers - only in the US, is a Privacy Law
GDPR (General Data Protection Regulation) - Answers - European privacy law that
gives you the right to be forgotten, they must rid your personal data if you have asked to
be forgotten
Sarbanes-Oxley Act - Answers - IRRON, f/s controls audited by law
PCI standards security council - Answers - credit card encryption laws, emv chips
(europay, mastercard, and visa req by europe)
, HIPPA - Answers - healthcare, protects personally identifiable health records from being
shared by doctors (must be two things)
FERPA (Family Educational Rights and Privacy Act) - Answers - student protections
(parking, academic standing, financial aid)
Risk - Answers - a measure of the potential for loss or damage when a threat exploits a
vulnerability (internal or external threat) (something must be lost or likely)
Governing IT Guidance origin - Answers - frameworks, standards, and compliance
guidance
Standard - Answers - specific methods organizations must follow (solar eclipse
example)
Framework - Answers - suggestions of best practices, but not mandated
Key standard setting groups - Answers - COBIT (segregation of duties for general
business), ITIL, HMG, ISACA
Risk management can lead to - Answers - the need for controls and security measures
(to reduce risks)
Enterprise (business) Risk - Answers - any risk that could potentially affect business
objectives
I+T Risk - Answers - IT-risk that could potentially impact the business, potential for an
unplanned negative business outcome involving the failure or misuse of IT
Audit Risk - Answers - The risk that an auditor has expressed an inappropriate opinion
Vulnerability - Answers - weakness or flaw in an information asset/system that
potentially exposes an entity to threats (people are the problem)
Threat - Answers - an event or condition that has the potential for causing asset loss
and/or undesirable consequences or impact
ex. social engineering, phishing attack, unprotecting data, weather, competitors,
careless employees
Threat actors - Answers - entities who can create/pose a threat, carry out actions that
take advantage of vulnerabilities
ex. destruction, disclosure, errors, software failure, environmental events, fraud,
intrusion, attack, theft
