ISC Drill

Every question you miss or reveal is saved here with its answer. Redo them: a question leaves the list once you get it right.

IT general controls

• Access to programs and data · Program changes · Program development · Computer operations.
• Application input controls include check digits, limit tests, validity checks, field checks, batch and hash totals, and record counts.

SOC reports

• SOC 1: controls relevant to user entities' financial reporting. SOC 2: trust services criteria, for informed users. SOC 3: general use.
• Type 1: design at a point in time. Type 2: design and operating effectiveness over a period.
• Carve-out excludes a subservice organization's controls; inclusive includes them.

Security

• Confidentiality: encrypt with the recipient's public key. Digital signature: sign with the sender's private key.
• Factors: something you know, have, or are. Two of the same kind is still one factor.

Continuity

• RPO: how much data you can lose. RTO: how long you can be down.
• Restore with incrementals: full + every incremental since. With differentials: full + the latest differential.