ISACA CISA Glossary Exam 395 Questions with Verified Answers,100% CORRECT, Exams of Nursing

Download ISACA CISA Glossary Exam 395 Questions with Verified Answers,100% CORRECT and more Exams Nursing in PDF only on Docsity! ISACA CISA Glossary Exam 395 Questions with Verified Answers Acceptable use policy - CORRECT ANSWER A policy that establishes an agreement between users and the enterprise and defines for all parties' the ranges of use that are approved before gaining access to a network or the Internet. Access control - CORRECT ANSWER The processes, rules and deployment mechanisms that control access to information systems, resources and physical access to premises. Access control list (ACL) - CORRECT ANSWER An internal computerized table of access rules regarding the levels of computer access permitted to logon IDs and computer terminals. Scope Note: Also referred to as access control tables. Access path - CORRECT ANSWER The logical route that an end user takes to access computerized information. Scope Note: Typically includes a route through the operating system, telecommunications software, selected application software and the access control system Access rights - CORRECT ANSWER The permission or privileges granted to users, programs or workstations to create, change, delete or view data and files within a system, as defined by rules established by data owners and the information security policy. Adware - CORRECT ANSWER A software package that automatically plays, displays or downloads advertising material to a computer after the software is installed on it or while the application is being used. Scope Note: In most cases, this is done without any notification to the user or without the user's consent. The term adware may also refer to software that displays advertisements, whether or not it does so with the user's consent; such programs display advertisements as an alternative to shareware registration fees. These are classified as adware in the sense of advertising supported software, but not as spyware. Adware in this form does not operate surreptitiously or mislead the user, and it provides the user with a specific service. Alternative routing - CORRECT ANSWER A service that allows the option of having an alternate route to complete a call when the marked destination is not available. Scope Note: In signaling, alternative routing is the process of allocating substitute routes for a given signaling traffic stream in case of failure(s) affecting the normal signaling links or routes of that traffic stream. Antivirus software - CORRECT ANSWER An application software deployed at multiple points in an IT architecture. It is designed to detect and potentially eliminate virus code before damage is done and repair or quarantine files that have already been infected Application - CORRECT ANSWER A computer program or set of programs that performs the processing of records for a specific function. Scope Note: Contrasts with systems programs, such as an operating system or network control program, and with utility programs, such as copy or sort. Application controls - CORRECT ANSWER The policies, procedures and activities designed to provide reasonable assurance that objectives relevant to a given automated solution (application) are achieved. Application programming interface (API) - CORRECT ANSWER A set of routines, protocols and tools referred to as "building blocks" used in business application software development. backbone, and networks that connect directly to the end user or customer are called "access networks." A backbone can span a geographic area of any size from a single building to an office complex to an entire country. Or, it can be as small as a backplane in a single cabinet. Backup - CORRECT ANSWER Files, equipment, data and procedures available for use in the event of a failure or loss, if the originals are destroyed or out of service. Balanced scorecard (BSC) - CORRECT ANSWER Developed by Robert S. Kaplan and David P. Norton as a coherent set of performance measures organized into four categories that includes traditional financial measures, but adds customer, internal business process, and learning and growth perspectives. Bandwidth - CORRECT ANSWER The range between the highest and lowest transmittable frequencies. It equates to the transmission capacity of an electronic line and is expressed in bytes per second or Hertz (cycles per second). Batch control - CORRECT ANSWER Correctness checks built into data processing systems and applied to batches of input data, particularly in the data preparation stage. Scope Note: There are two main forms of batch controls: sequence control, which involves numbering the records in a batch consecutively so that the presence of each record can be confirmed; and control total, which is a total of the values in selected fields within the transactions. Batch processing - CORRECT ANSWER The processing of a group of transactions at the same time. Scope Note: Transactions are collected and processed against the master files at a specified time. Baud rate - CORRECT ANSWER The rate of transmission for telecommunications data, expressed in bits per second (bps). Benchmarking - CORRECT ANSWER A systematic approach to comparing enterprise performance against peers and competitors in an effort to learn the best ways of conducting business. Scope Note: Examples include benchmarking of quality, logistic efficiency and various other metrics. Biometrics - CORRECT ANSWER A security technique that verifies an individual's identity by analyzing a unique physical attribute, such as a handprint. Black box testing - CORRECT ANSWER A testing approach that focuses on the functionality of the application or product and does not require knowledge of the code intervals. Broadband - CORRECT ANSWER Multiple channels are formed by dividing the transmission medium into discrete frequency segments. Scope Note: Broadband generally requires the use of a modem. Brouter - CORRECT ANSWER Device that performs the functions of both a bridge and a router. Scope Note: A brouter operates at both the data link and the network layers. It connects same data link type LAN segments as well as different data link ones, which is a significant advantage. Like a bridge, it forwards packets based on the data link layer address to a different network of the same type. Also, whenever required, it processes and forwards messages to a different data link type network based on the network protocol address. When connecting same data link type networks, it is as fast as a bridge and is able to connect different data link type networks. Buffer - CORRECT ANSWER Memory reserved to temporarily hold data to offset differences between the operating speeds of different devices, such as a printer and a computer. Scope Note: In a program, buffers are reserved areas of random access memory (RAM) that hold data while they are being processed. Bus configuration - CORRECT ANSWER All devices (nodes) are linked along one communication line where transmissions are received by all attached nodes. Scope Note: This architecture is reliable in very small networks, as well as easy to use and understand. This configuration requires the least amount of cable to connect the computers together and, therefore, is less expensive than other cabling arrangements. It is also easy to extend, and two cables can be easily joined with a connector to make a longer cable for more computers to join the network. A repeater can also be used to extend a bus configuration. Business case - CORRECT ANSWER Documentation of the rationale for making a business investment, used both to support a business decision on whether to proceed with the investment and as an operational tool to support management of the investment through its full economic life cycle. Business continuity plan (BCP) - CORRECT ANSWER A plan used by an enterprise to respond to disruption of critical business processes. Depends on the contingency plan for restoration of critical systems. Business impact analysis (BIA) - CORRECT ANSWER A process to determine the impact of losing the support of any resource. Scope Note: The BIA assessment study will establish the escalation of that loss over time. It is predicated on the fact that senior management, when provided reliable data to document the potential impact of a lost resource, can make the appropriate decision. Business process reengineering (BPR) - CORRECT ANSWER The thorough analysis and significant redesign of business processes and management systems to establish a better performing structure, more responsive to the customer base and market conditions, while yielding material cost savings. Capability Maturity Model (CMM) - CORRECT ANSWER 1. Contains the essential elements of effective processes for one or more disciplines. which is used as an encryption key to encrypt the "challenge" and return it to the server. The server is aware of the password. It, therefore, encrypts the "challenge" value and compares it with the value received from the user. If the values match, the user is authenticated. The challenge/response activity continues throughout the session and this protects the session from password sniffing attacks. In addition, CHAP is not vulnerable to "man-in-the-middle" attacks because the challenge value is a random value that changes on each access attempt. Change management - CORRECT ANSWER A holistic and proactive approach to managing the transition from a current to a desired organizational state, focusing specifically on the critical human or "soft" elements of change. Scope Note: Includes activities such as culture change (values, beliefs and attitudes), development of reward systems (measures and appropriate incentives), organizational design, stakeholder management, human resources (HR) policies and procedures, executive coaching, change leadership training, team building and communication planning and execution. Check digit - CORRECT ANSWER A numeric value, which has been calculated mathematically, is added to data to ensure that original data have not been altered or that an incorrect, but valid match has occurred. Scope Note: Check digit control is effective in detecting transposition and transcription errors. Checkpoint restart procedures - CORRECT ANSWER A point in a routine at which sufficient information can be stored to permit restarting the computation from that point. Checksum - CORRECT ANSWER A mathematical value that is assigned to a file and used to "test" the file at a later date to verify that the data contained in the file has not been maliciously changed. Scope Note: A cryptographic checksum is created by performing a complicated series of mathematical operations (known as a cryptographic algorithm) that translates the data in the file into a fixed string of digits called a hash value, which is then used as the checksum. Without knowing which cryptographic algorithm was used to create the hash value, it is highly unlikely that an unauthorized person would be able to change data without inadvertently changing the corresponding checksum. Cryptographic checksums are used in data transmission and data storage. Cryptographic checksums are also known as message authentication codes, integrity check-values, modification detection codes or message integrity codes. Circuit-switched network - CORRECT ANSWER A data transmission service requiring the establishment of a circuit-switched connection before data can be transferred from source data terminal equipment (DTE) to a sink DTE. Scope Note: A circuit-switched data transmission service uses a connection network. Circular routing - CORRECT ANSWER In open systems architecture, circular routing is the logical path of a message in a communication network based on a series of gates at the physical network layer in the open systems interconnection (OSI) model. Client-server - CORRECT ANSWER A group of computers connected by a communication network, in which the client is the requesting machine and the server is the supplying machine. Scope Note: Software is specialized at both ends. Processing may take place on either the client or the server, but it is transparent to the user. Cluster controller - CORRECT ANSWER A communication terminal control hardware unit that controls a number of computer terminals. Scope Note: All messages are buffered by the controller and then transmitted to the receiver. Coaxial cable - CORRECT ANSWER Composed of an insulated wire that runs through the middle of each cable, a second wire that surrounds the insulation of the inner wire like a sheath, and the outer insulation which wraps the second wire. Scope Note: Has a greater transmission capacity than standard twisted-pair cables, but has a limited range of effective distance. Cohesion - CORRECT ANSWER The extent to which a system unit--subroutine, program, module, component, subsystem--performs a single dedicated function. Scope Note: Generally, the more cohesive the unit, the easier it is to maintain and enhance a system because it is easier to determine where and how to apply a change. Cold site - CORRECT ANSWER An IISS backup facility that has the necessary electrical and physical components of a computer facility, but does not have the computer equipment in place. Scope Note: The site is ready to receive the necessary replacement computer equipment in the event that the users have to move from their main computing location to the alternative computer facility. Compensating control - CORRECT ANSWER An internal control that reduces the risk of an existing or potential control weakness resulting in errors and omissions. Completely connected (mesh) configuration - CORRECT ANSWER A network topology in which devices are connected with many redundant interconnections between network nodes (primarily used for backbone networks). Completeness check - CORRECT ANSWER A procedure designed to ensure that no fields are missing from a record. Compliance testing - CORRECT ANSWER Tests of control designed to obtain audit evidence on both the effectiveness of the controls and their operation during the audit period. Comprehensive audit - CORRECT ANSWER An audit designed to determine the accuracy of financial records as well as to evaluate the internal controls of a function or department. Control objective - CORRECT ANSWER A statement of the desired result or purpose to be achieved by implementing control procedures in a particular process. Control practice - CORRECT ANSWER Key control mechanism that supports the achievement of control objectives through responsible use of resources, appropriate management of risk and alignment of IT with business. Control risk - CORRECT ANSWER The risk that a material error exists that would not be prevented or detected on a timely basis by the system of internal controls. See Inherent risk. Cookie - CORRECT ANSWER A message kept in the web browser for the purpose of identifying users and possibly preparing customized web pages for them. Scope Note: The first time a cookie is set, a user may be required to go through a registration process. Subsequent to this, whenever the cookie's message is sent to the server, a customized view based on that user's preferences can be produced. The browser's implementation of cookies has, however, brought several security concerns, allowing breaches of security and the theft of personal information (e.g., user passwords that validate the user identity and enable restricted web services). Corporate governance - CORRECT ANSWER The system by which enterprises are directed and controlled. The board of directors is responsible for the governance of their enterprise. It consists of the leadership and organizational structures and processes that ensure the enterprise sustains and extends strategies and objectives. Corrective control - CORRECT ANSWER Designed to correct errors, omissions and unauthorized uses and intrusions, once they are detected. Coupling - CORRECT ANSWER Measure of interconnectivity among structure of software programs. Coupling depends on the interface complexity between modules. This can be defined as the point at which entry or reference is made to a module, and what data pass across the interface. Scope Note: In application software design, it is preferable to strive for the lowest possible coupling between modules. Simple connectivity among modules results in software that is easier to understand and maintain and is less prone to a ripple or domino effect caused when errors occur at one location and propagate through the system. Critical infrastructure - CORRECT ANSWER Systems whose incapacity or destruction would have a debilitating effect on the economic security of an enterprise, community or nation. Critical success factor (CSF) - CORRECT ANSWER The most important issue or action for management to achieve control over and within its IT processes Customer relationship management (CRM) - CORRECT ANSWER A way to identify, acquire and retain customers. CCRRMM is also an industry term for software solutions that help an enterprise manage customer relationships in an organized manner. Data custodian - CORRECT ANSWER The individual(s) and department(s) responsible for the storage and safeguarding of computerized data. Data dictionary - CORRECT ANSWER A database that contains the name, type, range of values, source and authorization for access for each data element in a database. It also indicates which application programs use those data so that when a data structure is contemplated, a list of the affected programs can be generated. Scope Note: May be a stand-alone information system used for management or documentation purposes, or it may control the operation of a database. Data diddling - CORRECT ANSWER Changing data with malicious intent before or during input into the system. Data Encryption Standard (DES) - CORRECT ANSWER An algorithm for encoding binary data. Scope Note: It is a secret key cryptosystem published by the National Bureau of Standards (NBS), the predecessor of the US National Institute of Standards and Technology (NIST). DES and its variants has been replaced by the Advanced Encryption Standard (AES). Data leakage - CORRECT ANSWER Siphoning out or leaking information by dumping computer files or stealing computer reports and tapes. Data owner - CORRECT ANSWER The individual(s), normally a manager or director, who has responsibility for the integrity, accurate reporting and use of computerized data. Data structure - CORRECT ANSWER The relationships among files in a database and among data items within each file. Database - CORRECT ANSWER A stored collection of related data needed by enterprises and individuals to meet their information processing and retrieval requirements. Database administrator (DBA) - CORRECT ANSWER An individual or department responsible for the security and information classification of the shared data stored n a database system. This responsibility includes the design, definition and maintenance of the database. Database management system (DBMS) - CORRECT ANSWER A software system that controls the organization, storage and retrieval of data in a database. Database replication - CORRECT ANSWER The process of creating and managing duplicate versions of a database. from the local carrier, including dual entrance facilities. However, acquiring this type of access is time-consuming and costly. Most carriers provide facilities for alternate and diverse routing, although the majority of services are transmitted over terrestrial media. These cable facilities are usually located in the ground or basement. Ground- based facilities are at great risk due to the aging infrastructures of cities. In addition, cable-based facilities usually share room with mechanical and electrical systems that can impose great risk due to human error and disastrous events. Domain name system (DNS) poisoning - CORRECT ANSWER Corrupts the table of an Internet server's DNS, replacing an Internet address with the address of another vagrant or scoundrel address. Scope Note: If a web user looks for the page with that address, the request is redirected by the scoundrel entry in the table to a different address. Cache poisoning differs from another form of DNS poisoning in which the attacker spoofs valid e-mail accounts and floods the "in" boxes of administrative and technical contacts. Cache poisoning is related to URL poisoning or location poisoning, in which an Internet user behavior is tracked by adding an identification number to the location line of the browser that can be recorded as the user visits successive pages on the site. It is also called DNS cache poisoning or cache poisoning. Downtime report - CORRECT ANSWER A report that identifies the elapsed time when a computer is not operating correctly because of machine failure. Dry-pipe fire extinguisher system - CORRECT ANSWER Refers to a sprinkler system that does not have water in the pipes during idle usage, unlike a fully charged fire extinguisher system that has water in the pipes at all times. Scope Note: The dry-pipe system is activated at the time of the fire alarm and water is emitted to the pipes from a water reservoir for discharge to the location of the fire. Duplex routing - CORRECT ANSWER The method or communication mode of routing data over the communication network. Dynamic Host Configuration Protocol (DHCP) - CORRECT ANSWER A protocol used by networked computers (clients) to obtain IP addresses and other parameters such as the default gateway, subnet mask and IP addresses of domain name system (DNS) servers from a DHCP server. Scope Note: The DHCP server ensures that all IP addresses are unique (e.g., no IP address is assigned to a second client while the first client's assignment is valid [its lease has not expired]). Thus, IP address pool management is done by the server and not by a human network administrator. Echo checks - CORRECT ANSWER Detects line errors by retransmitting data back to the sending device for comparison with the original transmission. E-commerce - CORRECT ANSWER The processes by which enterprises conduct business electronically with their customers, suppliers and other external business partners, using the Internet as an enabling technology. Scope Note: E-commerce encompasses both business-to-business (B2B) and business-to-consumer (B2C) e-commerce models, but does not include existing non-Internet e-commerce methods based on private networks such as electronic data interchange (EDI) and Society for Worldwide Interbank Financial Telecommunication (SWIFT). Edit control - CORRECT ANSWER Detects errors in the input portion of information that is sent to the computer for processing. May be manual or automated and allow the user to edit data errors before processing. Editing - CORRECT ANSWER Ensures that data conform to predetermined criteria and enable early identification of potential errors. Electronic data interchange (EDI) - CORRECT ANSWER The electronic transmission of transactions (information) between two enterprises. EDI promotes a more efficient paperless environment. EDI transmissions can replace the use of standard documents, including invoices or purchase orders. Electronic funds transfer (EFT) - CORRECT ANSWER The exchange of money via telecommunications. EFT refers to any financial transaction that originates at a terminal and transfers a sum of money from one account to another. Embedded audit module (EAM) - CORRECT ANSWER Integral part of an application system that is designed to identify and report specific transactions or other information based on pre-determined criteria. Identification of reportable items occurs as part of real-time processing. Reporting may be real-time online or may use store and forward methods. Also known as integrated test facility or continuous auditing module. Encapsulation (objects) - CORRECT ANSWER The technique used by layered protocols in which a lower-layer protocol accepts a message from a higher-layer protocol and places it in the data portion of a frame in the lower layer. Encryption - CORRECT ANSWER The process of taking an unencrypted message (plaintext), applying a mathematical function to it (encryption algorithm with a key) and producing an encrypted message (ciphertext). Encryption key - CORRECT ANSWER A piece of information, in a digitized form, used by an encryption algorithm to convert the plaintext to the ciphertext. End-user computing - CORRECT ANSWER The ability of end users to design and implement their own information system utilizing computer software products. ERP (enterprise resource planning) system - CORRECT ANSWER A packaged business software system that allows an enterprise to automate and integrate the majority of its business processes, share common data and practices across the entire enterprise, and produce and access information in a real-time environment. messages. A virtual private network (VPN) and tunneling are often used to implement extranets, to ensure security and privacy. Fallback procedures - CORRECT ANSWER A plan of action or set of procedures to be performed if a system implementation, upgrade or modification does not work as intended. Scope Note: May involve restoring the system to its state prior to the implementation or change. Fallback procedures are needed to ensure that normal business processes continue in the event of failure and should always be considered in system migration or implementation.. False authorization - CORRECT ANSWER Also called false acceptance, occurs when an unauthorized person is identified as an authorized person by the biometric system. False enrollment - CORRECT ANSWER Occurs when an unauthorized person manages to enroll into the biometric system. Scope Note: Enrollment is the initial process of acquiring a biometric feature and saving it as a personal reference on a smart card, a PC or in a central database. Fault tolerance - CORRECT ANSWER A system's level of resilience to seamlessly react to hardware and/or software failure Feasibility study - CORRECT ANSWER A phase of a system development life cycle (SDLC) methodology that researches the feasibility and adequacy of resources for the development or acquisition of a system solution to a user need. Fiber-optic cable - CORRECT ANSWER Glass fibers that transmit binary signals over a telecommunications network. Scope Note: Fiber-optic systems have low transmission losses as compared to twisted-pair cables. They do not radiate energy or conduct electricity. They are free from corruption and lightning-induced interference, and they reduce the risk of wiretaps. File allocation table (FAT) - CORRECT ANSWER A table used by the operating system to keep track of where every file is located on the disk. Scope Note: Since a file is often fragmented and thus subdivided into many sectors within the disk, the information stored in the FAT is used when loading or updating the contents of the file. File layout - CORRECT ANSWER Specifies the length of the file record and the sequence and size of its fields. Scope Note: Also will specify the type of data contained within each field; for example, alphanumeric, zoned decimal, packed and binary. File server - CORRECT ANSWER A high-capacity disk storage device or a computer that stores data centrally for network users and manages access to those data. Scope Note: File servers can be dedicated so that no process other than network management can be executed while the network is available; file servers can be non-dedicated so that standard user applications can run while the network is available. Financial audit - CORRECT ANSWER An audit designed to determine the accuracy of financial records and information. Firewall - CORRECT ANSWER A system or combination of systems that enforces a boundary between two or more networks, typically forming a barrier between a secure and an open environment such as the Internet. Firmware - CORRECT ANSWER Memory chips with embedded program code that hold their content when power is turned off. Foreign key - CORRECT ANSWER A value that represents a reference to a tuple (a row in a table) containing the matching candidate key value. Scope Note: The problem of ensuring that the database does not include any invalid foreign key values is known as the referential integrity problem. The constraint that values of a given foreign key must match values of the corresponding candidate key is known as a referential constraint. The relation (table) that contains the foreign key is referred to as the referencing relation and the relation that contains the corresponding candidate key as the referenced relation or target relation. (In the relational theory it would be a candidate key, but in real database management systems (DBMSs) implementations it is always the primary key.) Format checking - CORRECT ANSWER The application of an edit, using a predefined field definition to a submitted information stream; a test to ensure that data conform to a predefined format. Frame relay - CORRECT ANSWER A packet-switched wide-area-network (WAN) technology that provides faster performance than older packet-switched WAN technologies. Scope Note: Best suited for data and image transfers. Because of its variable- length packet architecture, it is not the most efficient technology for real-time voice and video. In a frame-relay network, end nodes establish a connection via a permanent virtual circuit (PVC). Function point analysis - CORRECT ANSWER A technique used to determine the size of a development task, based on the number of function points. Scope Note: Function points are factors such as inputs, outputs, inquiries and logical internal sites. General computer control - CORRECT ANSWER A Control, other than an application control, that relates to the environment within which computer-based application systems are developed, maintained and operated, and that is therefore applicable to all applications. The objectives of general controls are to ensure the proper development and implementation of applications and the integrity of program and data files and of computer operations. Like application controls, general controls may be either manual or programmed. Examples of general controls include the development and implementation of an IS strategy and an IS security policy, the organization of Scope Note: Impersonation has three possible levels: identification, letting the server inspect the client's identity; impersonation, letting the server act on behalf of the client; and delegation, the same as impersonation but extended to remote systems to which the server connects (through the preservation of credentials). Impersonation by imitating or copying the identification, behavior or actions of another may also be used in social engineering to obtain otherwise unauthorized physical access. Incident - CORRECT ANSWER Any event that is not part of the standard operation of a service and that causes, or may cause, an interruption to, or a reduction in, the quality of that service. Incident response - CORRECT ANSWER The response of an enterprise to a disaster or other significant event that may significantly affect the enterprise, its people, or its ability to function productively. An incident response may include evacuation of a facility, initiating a disaster recovery plan (DRP), performing damage assessment, and any other measures necessary to bring an enterprise to a more stable status. Incremental testing - CORRECT ANSWER Deliberately testing only the value-added functionality of a software component. Independence - CORRECT ANSWER 1. Self-governance. 2. Freedom from conflict of interest and undue influence. Scope Note: The IS auditor should be free to make his/her own decisions, not influenced by the enterprise being audited and its people (managers and employers). Indexed Sequential Access Method (ISAM) - CORRECT ANSWER A disk access method that stores data sequentially while also maintaining an index of key fields to all the records in the file for direct access capability. Indexed sequential file - CORRECT ANSWER A file format in which records are organized and can be accessed, according to a pre-established key that is part of the record. Information processing facility (IPF) - CORRECT ANSWER The computer room and support areas. Information security - CORRECT ANSWER Ensures that within the enterprise, information is protected against disclosure to unauthorized users (confidentiality), improper modification (integrity), and non-access when required (availability). Information security governance - CORRECT ANSWER The set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risk is managed appropriately and verifying that the enterprise's resources are used responsibly. Information systems (IS) - CORRECT ANSWER The combination of strategic, managerial and operational activities involved in gathering, processing, storing, distributing and using information and its related technologies. Scope Note: Information systems are distinct from information technology (IT) in that an information system has an IT component that interacts with the process components. Inherent risk - CORRECT ANSWER 1. The risk level or exposure without taking into account the actions that management has taken or might take (e.g., implementing controls). 2. The risk that a material error could occur, assuming that there are no related internal controls to prevent or detect the error. Scope Note: Audit perspective; also see Control risk. Inheritance (objects) - CORRECT ANSWER Database structures that have a strict hierarchy (no multiple inheritance). Inheritance can initiate other objects irrespective of the class hierarchy, thus there is no strict hierarchy of objects. Initial program load (IPL) - CORRECT ANSWER The initialization procedure that causes an operating system to be loaded into storage at the beginning of a workday or after a system malfunction. Input control - CORRECT ANSWER Techniques and procedures used to verify, validate and edit data to ensure that only correct data are entered into the computer. Instant messaging (IM) - CORRECT ANSWER An online mechanism or a form of real-time communication between two or more people based on typed text and multimedia data. Scope Note: Text is conveyed via computers or another electronic device (e.g., cellular phone or handheld device) connected over a network, such as the Internet. Integrated services digital network (ISDN) - CORRECT ANSWER A public end-to- end digital telecommunications network with signaling, switching and transport capabilities supporting a wide range of service accessed by standardized interfaces with integrated customer control. Scope Note: The standard allows transmission of digital voice, video and data over 64-Kpbs lines. Integrated test facilities (ITF) - CORRECT ANSWER A testing methodology in which test data are processed in production systems. Scope Note: The data usually represent a set of fictitious entities such as departments, customers or products. Output reports are verified to confirm the correctness of the processing. Integrity - CORRECT ANSWER Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity. Scope Note: A lead indicator of whether a goal will likely be reached, and a good indicator of capabilities, practices and skills. It measures an activity goal, which is an action that the process owner must take to achieve effective process performance. Leased line - CORRECT ANSWER A communication line permanently assigned to connect two points, as opposed to a dial-up line that is only available and open when a connection is made by dialing the target machine or network. Also known as a dedicated line. Librarian - CORRECT ANSWER The individual responsible for the safeguard and maintenance of all program and data files. Licensing agreement - CORRECT ANSWER A contract that establishes the terms and conditions under which a piece of software is being licensed (i.e., made legally available for use) from the software developer (owner) to the user. Life cycle - CORRECT ANSWER A series of stages that characterize the course of existence of an organizational investment (e.g., product, project, program). Limit check - CORRECT ANSWER Tests specified amount fields against stipulated high or low limits of acceptability. Scope Note: When both high and low values are used, the test may be called a range check. Local area network (LAN) - CORRECT ANSWER Communication network that serves several users within a specified geographic area. Scope Note: A personal computer LAN functions as a distributed processing system in which each computer in the network does its own processing and manages some of its data. Shared data are stored in a file server that acts as a remote disk drive for all users in the network. Log - CORRECT ANSWER To record details of information or events in an organized record-keeping system, usually sequenced in the order in which they occurred. Logical access controls - CORRECT ANSWER The policies, procedures, organizational structure and electronic access controls designed to restrict access to computer software and data files. Magnetic card reader - CORRECT ANSWER Reads cards with a magnetic surface on which data can be stored and retrieved. Malware - CORRECT ANSWER Short for malicious software. Designed to infiltrate, damage or obtain information from a computer system without the owner's consent. Scope Note: Malware is commonly taken to include computer viruses, worms, Trojan horses, spyware and adware. Spyware is generally used for marketing purposes and, as such, is not malicious, although it is generally unwanted. Spyware can, however, be used to gather information for identity theft or other clearly illicit purposes. Management information system (MIS) - CORRECT ANSWER An organized assembly of resources and procedures required to collect, process and distribute data for use in decision making. Mapping - CORRECT ANSWER Diagramming data that are to be exchanged electronically, including how they are to be used and what business management systems need them. See also Application Tracing and Mapping. Scope Note: Mapping is a preliminary step for developing an applications link. Masking - CORRECT ANSWER A computerized technique of blocking out the display of sensitive information, such as passwords, on a computer terminal or report. Master file - CORRECT ANSWER A file of semi permanent information that is used frequently for processing data or for more than one purpose. Materiality - CORRECT ANSWER An auditing concept regarding the importance of an item of information with regard to its impact or effect on the functioning of the entity being audited. An expression of the relative significance or importance of a particular matter in the context of the enterprise as a whole. Maturity - CORRECT ANSWER In business, indicates the degree of reliability or dependency that the business can place on a process achieving the desired goals or objectives Maturity model - CORRECT ANSWER Scope Note: See Capability Maturity Model (CMM). Media access control (MAC) - CORRECT ANSWER Applied to the hardware at the factory and cannot be modified, MAC is a unique, 48-bit, hard-coded address of a physical layer device, such as an Ethernet local area network (LAN) or a wireless network card. Media oxidation - CORRECT ANSWER The deterioration of the media on which data are digitally stored due to exposure to oxygen and moisture. Scope Note: Tapes deteriorating in a warm, humid environment are an example of media oxidation. Proper environmental controls should prevent, or significantly slow, this process. Memory dump - CORRECT ANSWER The act of copying raw data from one place to another with little or no formatting for readability. Scope Note: Usually, dump refers to copying data from the main memory to a display screen or a printer. Dumps are useful for diagnosing bugs. After a program fails, one can study the dump and analyze the contents of memory at the time of the failure. A memory dump will not help unless each person knows what to look for because dumps are usually output in a difficult-to-read form (binary, octal or hexadecimal). Normalization - CORRECT ANSWER The elimination of redundant data. Numeric check - CORRECT ANSWER An edit check designed to ensure that the data element in a particular field is numeric. Object code - CORRECT ANSWER Machine-readable instructions produced from a compiler or assembler program that has accepted and translated the source code. Object orientation - CORRECT ANSWER An approach to system development in which the basic unit of attention is an object, which represents an encapsulation of both data (an object's attributes) and functionality (an object's methods). Scope Note: Objects usually are created using a general template called a class. A class is the basis for most design work in objects. A class and its objects communicate in defined ways. Aggregate classes interact through messages, which are directed requests for services from one class (the client) to another class (the server). A class may share the structure or methods defined in one or more other classes - a relationship known as inheritance. Objectivity - CORRECT ANSWER The ability to exercise judgment, express opinions and present recommendations with impartiality. Offsite storage - CORRECT ANSWER A facility located away from the building housing the primary information processing facility (IPF), used for storage of computer media such as offline backup data and storage files. Online data processing - CORRECT ANSWER Achieved by entering information into the computer via a video display terminal. Scope Note: With online data processing, the computer immediately accepts or rejects the information as it is entered. Open system - CORRECT ANSWER System for which detailed specifications of the composition of its component are published in a nonproprietary environment, thereby enabling competing enterprises to use these standard components to build competitive systems. Scope Note: The advantages of using open systems include portability, interoperability and integration. Operating system (OS) - CORRECT ANSWER A master control program that runs the computer and acts as a scheduler and traffic controller. Scope Note: The operating system is the first program copied into the computer's memory after the computer is turned on; it must reside in memory at all times. It is the software that interfaces between the computer hardware (disk, keyboard, mouse, network, modem, printer) and the application software (word processor, spreadsheet, e-mail), which also controls access to the devices and is partially responsible for security components and sets the standards for the application programs that run in it. Operational audit - CORRECT ANSWER An audit designed to evaluate the various internal controls, economy and efficiency of a function or department. Operational control - CORRECT ANSWER Deals with the everyday operation of a company or enterprise to ensure that all objectives are achieved. Optical scanner - CORRECT ANSWER An input device that reads characters and images that are printed or painted on a paper form into the computer. Outsourcing - CORRECT ANSWER A formal agreement with a third party to perform IS or other business functions for an enterprise. Packet switching - CORRECT ANSWER The process of transmitting messages in convenient pieces that can be reassembled at the destination Paper test - CORRECT ANSWER A walk-through of the steps of a regular test, but without actually performing the steps. Scope Note: Usually used in disaster recovery and contingency testing; team members review and become familiar with the plans and their specific roles and responsibilities. Parallel testing - CORRECT ANSWER The process of feeding test data into two systems, the modified system and an alternative system (possibly the original system), and comparing results to demonstrate the consistency and inconsistency between two versions of the application. Parity check - CORRECT ANSWER A general hardware control that helps to detect data errors when data are read from memory or communicated from one computer to another. Scope Note: A 1-bit digit (either 0 or 1) is added to a data item to indicate whether the sum of that data item's bit is odd or even. When the parity bit disagrees with the sum of the other bits, the computer reports an error. The probability of a parity check detecting an error is 50 percent. Partitioned ffiillee - CORRECT ANSWER A file format in which the file is divided into multiple sub files and a directory is established to locate each sub file. Passive assault - CORRECT ANSWER Intruders attempt to learn some characteristic of the data being transmitted. Scope Note: With a passive assault, intruders may be able to read the contents of the data so the privacy of the data is violated. Alternatively, although the content of the data itself may remain secure, intruders may read and analyze the plaintext source and destination identifiers attached to a message for routing purposes, or they may examine the lengths and frequency of messages being transmitted. Password - CORRECT ANSWER A protected, generally computer-encrypted string of characters that authenticate a computer user to the computer system. Patch management - CORRECT ANSWER An area of systems management that involves acquiring, testing and installing multiple patches (code changes) to an administered computer system in order to maintain up-to-date software and often to address security risk. Scope Note: Patch management tasks include the following: maintaining current knowledge of available patches; deciding what patches are appropriate for particular systems; ensuring that patches are installed properly; testing systems Portfolio - CORRECT ANSWER A grouping of "objects of interest" (investment programs, IT services, IT projects, other IT assets or resources) managed and monitored to optimize business value. (The investment portfolio is of primary interest to Val IT. IT service, project, asset and other resource portfolios are of primary interest to COBIT.) Preventive control - CORRECT ANSWER An internal control that is used to avoid undesirable events, errors and other occurrences that an enterprise has determined could have a negative material effect on a process or end product Privacy - CORRECT ANSWER Freedom from unauthorized intrusion or disclosure of information about an individual. Private branch exchange (PBX) - CORRECT ANSWER A telephone exchange that is owned by a private business, as opposed to one owned by a common carrier or by a telephone company. Private key cryptosystems - CORRECT ANSWER Used in data encryption, it utilizes a secret key to encrypt the plaintext to the ciphertext. Private key cryptosystems also use the same key to decrypt the ciphertext to the corresponding plaintext. Scope Note: In this case, the key is symmetric such that the encryption key is equivalent to the decryption key. Problem escalation procedure - CORRECT ANSWER The process of escalating a problem up from junior to senior support staff, and ultimately to higher levels of management. Scope Note: Problem escalation procedure is often used in help desk management, when an unresolved problem is escalated up the chain of command, until it is solved. Procedure - CORRECT ANSWER A document containing a detailed description of the steps necessary to perform specific operations in conformance with applicable standards. Procedures are defined as part of processes. Process - CORRECT ANSWER Generally, a collection of activities influenced by the enterprise's policies and procedures that takes inputs from a number of sources, (including other processes), manipulates the inputs and produces outputs. Scope Note: Processes have clear business reasons for existing, accountable owners, clear roles and responsibilities around the execution of the process, and the means to measure performance. Production program - CORRECT ANSWER Program used to process live or actual data that were received as input into the production environment. Production software - CORRECT ANSWER Software that is being used and executed to support normal and authorized organizational operations. Scope Note: Production software is to be distinguished from test software, which is being developed or modified, but has not yet been authorized for use by management. Professional competence - CORRECT ANSWER Proven level of ability, often linked to qualifications issued by relevant professional bodies and compliance with their codes of practice and standards. Program Evaluation and Review Technique (PERT) - CORRECT ANSWER A project management technique used in the planning and control of system projects. Program flowchart - CORRECT ANSWER Shows the sequence of instructions in a single program or subroutine. Scope Note: The symbols used in program flowcharts should be the internationally accepted standard. Program flowcharts should be updated when necessary. Program narrative - CORRECT ANSWER Provides a detailed explanation of program flowcharts, including control points and any external input. Project - CORRECT ANSWER A structured set of activities concerned with delivering a defined capability (that is necessary but not sufficient, to achieve a required business outcome) to the enterprise based on an agreed-on schedule and budget. Project portfolio - CORRECT ANSWER The set of projects owned by a company. Scope Note: It usually includes the main guidelines relative to each project, including objectives, costs, time lines and other information specific to the project. Protocol - CORRECT ANSWER The rules by which a network operates and controls the flow and priority of transmissions. Protocol converter - CORRECT ANSWER Hardware devices, such as asynchronous and synchronous transmissions, that convert between two different types of transmission. Prototyping - CORRECT ANSWER The process of quickly putting together a working model (a prototype) in order to test various aspects of a design, illustrate ideas or features and gather early user feedback. Scope Note: Prototyping uses programmed simulation techniques to represent a model of the final system to the user for advisement and critique. The emphasis is on end-user screens and reports. Internal controls are not a priority item since this is only a model. Proxy server - CORRECT ANSWER A server that acts on behalf of a user. Scope Note: Typical proxies accept a connection from a user, make a decision as to whether the user or client IP address is permitted to use the proxy, perhaps perform additional authentication, and complete a connection to a remote destination on behalf of the user. Public key cryptosystem - CORRECT ANSWER Used in data encryption, it uses an encryption key, as a public key, to encrypt the plaintext to the ciphertext. It uses the different decryption key, as a secret key, to decrypt the ciphertext to the corresponding plaintext. Recovery time objective (RTO) - CORRECT ANSWER The amount of time allowed for the recovery of a business function or resource after a disaster occurs. Redundancy check - CORRECT ANSWER Detects transmission errors by appending calculated bits onto the end of each segment of data. Redundant Array of Inexpensive Disks (RAID) - CORRECT ANSWER Provides performance improvements and fault-tolerant capabilities via hardware or software solutions, by writing to a series of multiple disks to improve performance and/or save large files simultaneously. Reengineering - CORRECT ANSWER A process involving the extraction of components from existing systems and restructuring these components to develop new systems or to enhance the efficiency of existing systems. Scope Note: Existing software systems can be modernized to prolong their functionality. An example is a software code translator that can take an existing hierarchical database system and transpose it to a relational database system. Computer- aided software engineering (CASE) includes a source code reengineering feature. Registration authority (RA) - CORRECT ANSWER The individual institution that validates an entity's proof of identity and ownership of a key pair. Regression testing - CORRECT ANSWER A testing technique used to retest earlier program abends or logical errors that occurred during the initial testing phase. Remote procedure call (RPC) - CORRECT ANSWER The traditional Internet service protocol widely used for many years on UNIX-based operating systems and supported by the Internet Engineering Task Force (IETF) that allows a program on one computer to execute a program on another (e.g., server). Scope Note: The primary benefit derived from its use is that a system developer need not develop specific procedures for the targeted computer system. For example, in a client-server arrangement, the client program sends a message to the server with appropriate arguments, and the server returns a message containing the results of the program executed. Common Object Request Broker Architecture (CORBA) and Distributed Component Object Model (DCOM) are two newer object-oriented methods for related RPC functionality. Repository - CORRECT ANSWER An enterprise database that stores and organizes data. Request for proposal (RFP) - CORRECT ANSWER A document distributed to software vendors requesting them to submit a proposal to develop or provide a software product. Requirements definition - CORRECT ANSWER A technique used in which the affected user groups define the requirements of the system for meeting the defined needs. Scope Note: Some of these are business-, regulatory-, and security-related requirements as well as development-related requirements. Resilience - CORRECT ANSWER The ability of a system or network to resist failure or to recover quickly from any disruption, usually with minimal recognizable effect. Return on investment (ROI) - CORRECT ANSWER A measure of operating performance and efficiency, computed in its simplest form by dividing net income by the total investment over the period being considered. Reverse engineering - CORRECT ANSWER A software engineering technique whereby an existing application system code can be redesigned and coded using computer- aided software engineering (CASE) technology. Ring configuration - CORRECT ANSWER Used in either token ring or fiber distributed data interface (FDDI) networks, all stations (nodes) are connected to a multi-station access unit (MSAU), that physically resembles a star-type topology. Scope Note: A ring configuration is created when MSAUs are linked together in forming a network. Messages in the network are sent in a deterministic fashion from sender and receiver via a small frame, referred to as a token ring. To send a message, a sender obtains the token with the right priority as the token travels around the ring,, with receiving nodes reading those messages addressed to it. Ring topology - CORRECT ANSWER A type of local area network (LAN) architecture in which the cable forms a loop, with stations attached at intervals around the loop. Scope Note: In ring topology, signals transmitted around the ring take the form of messages. Each station receives the messages and each station determines, on the basis of an address, whether to accept or process a given message. However, after receiving a message, each station acts as a repeater, retransmitting the message at its original signal strength. Risk - CORRECT ANSWER The combination of the probability of an event and its consequence. (ISO/IEC 73) Risk analysis - CORRECT ANSWER 1. A process by which frequency and magnitude of IT risk scenarios are estimated. 2. The initial steps of risk management: analyzing the value of assets to the business, identifying threats to those assets and evaluating how vulnerable each asset is to those threats Scope Note: It often involves an evaluation of the probable frequency of a particular event, as well as the probable impact of that event. Risk assessment - CORRECT ANSWER A process used to identify and evaluate risk and its potential effects. Scope Note: Includes assessing the critical functions necessary for an enterprise to continue business operations, defining the controls in place to reduce enterprise exposure and evaluating the cost for such controls. Risk analysis often involves an evaluation of the probabilities of a particular event. Risk management - CORRECT ANSWER 1. The coordinated activities to direct and control an enterprise with regard to risk. Scope Note: This definition is based on the definition for IT security awareness as defined in Implementation Guide: How to Make Your Organization Aware of IT Security, European Security Forum (ESF), London, 1993. Security incident - CORRECT ANSWER A series of unexpected events that involves an attack or series of attacks (compromise and/or breach of security) at one or more sites. A security incident normally includes an estimation of its level of impact. A limited number of impact levels are defined and, for each, the specific actions required and the people who need to be notified are identified. Security policy - CORRECT ANSWER A high-level document representing an enterprise's information security philosophy and commitment. Security procedures - CORRECT ANSWER The formal documentation of operational steps and processes that specify how security goals and objectives set forward in the security policy and standards are to be achieved. Segregation/separation of duties (SoD) - CORRECT ANSWER A basic internal control that prevents or detects errors and irregularities by assigning to separate individuals the responsibility for initiating and recording transactions and for the custody of assets. Scope Note: Segregation/separation of duties is commonly used in large IT organizations so that no single person is in a position to introduce fraudulent or malicious code without detection. Sequence check - CORRECT ANSWER Verification that the control number follows sequentially and any control numbers out of sequence are rejected or noted on an exception report for further research. Scope Note: Can be alpha or numeric and usually utilizes a key field Sequential file - CORRECT ANSWER A computer file storage format in which one record follows another. Scope Note: Records can be accessed sequentially only. It is required with magnetic tape. Service bureau - CORRECT ANSWER A computer facility that provides data processing services to clients on a continual basis. Service level agreement (SLA) - CORRECT ANSWER An agreement, preferably documented, between a service provider and the customer(s)/user(s) that defines minimum performance targets for a service and how they will be measured. Servlet - CORRECT ANSWER A Java applet or a small program that runs within a web server environment. Scope Note: A Java servlet is similar to a common gateway interface (CGI) program, but unlike a CGI program, once started, it stays in memory and can fulfill multiple requests, thereby saving server execution time and speeding up the services. Smart card - CORRECT ANSWER A small electronic device that contains electronic memory, and possibly an embedded integrated circuit. Scope Note: Smart cards can be used for a number of purposes including the storage of digital certificates or digital cash, or they can be used as a token to authenticate users. Software - CORRECT ANSWER Programs and supporting documentation that enable and facilitate use of the computer. Scope Note: Software controls the operation of the hardware and the processing of data. Source code - CORRECT ANSWER The language in which a program is written. Scope Note: Source code is translated into object code by assemblers and compilers. In some cases, source code may be converted automatically into another language by a conversion program. Source code is not executable by the computer directly. It must first be converted into a machine language. SPOOL (simultaneous peripheral operations online) - CORRECT ANSWER An automated function that can be based on an operating system or application in which electronic data being transmitted between storage areas are spooled or stored until the receiving device or storage area is prepared and able to receive the information. Scope Note: Spool allows more efficient electronic data transfers from one device to another by permitting higher speed sending functions, such as internal memory, to continue on with other operations instead of waiting on the slower speed receiving device, such as a printer. Spyware - CORRECT ANSWER Software whose purpose is to monitor a computer user's actions (e.g., web sites visited) and report these actions to a third party, without the informed consent of that machine's owner or legitimate user. Scope Note: A particularly malicious form of spyware is software that monitors keystrokes to obtain passwords or otherwise gathers sensitive information such as credit card numbers, which it then transmits to a malicious third party. The term has also come to refer more broadly to software that subverts the computer's operation for the benefit of a third party. Standard - CORRECT ANSWER A mandatory requirement, code of practice or specification approved by a recognized external standards organization, such as International Organization for Standardization (ISO). Star topology - CORRECT ANSWER A type of local area network (LAN) architecture that utilizes a central controller to which all nodes are directly connected. Scope Note: With star topology, all transmissions from one station to another pass through the central controller which is responsible for managing and controlling all communication. The central controller often acts as a switching device. Tape management system (TMS) - CORRECT ANSWER A system software tool that logs, monitors and directs computer tape usage. Test data - CORRECT ANSWER Simulated transactions that can be used to test processing logic, computations and controls actually programmed in computer applications. Individual programs or an entire system can be tested. Scope Note: This technique includes Integrated Test Facilities (ITFs) and Base Case System Evaluations (BCSEs). Test generators - CORRECT ANSWER Software used to create data to be used in the testing of computer programs. Test programs - CORRECT ANSWER Programs that are tested and evaluated before approval into the production environment. Scope Note: Test programs, through a series of change control moves, migrate from the test environment to the production environment and become production programs. Third-party review - CORRECT ANSWER An independent audit of the control structure of a service organization, such as a service bureau, with the objective of providing assurance to the users of the service organization that the internal control structure is adequate, effective and sound Threat - CORRECT ANSWER Anything (e.g., object, substance, human) that is capable of acting against an asset in a manner that can result in harm. Scope Note: A potential cause of an unwanted incident. (ISO/IEC 13335) Throughput - CORRECT ANSWER The quantity of useful work made by the system per unit of time. Throughput can be measured in instructions per second or some other unit of performance. When referring to a data transfer operation, throughput measures the useful data transfer rate and is expressed in kbps, Mbps and Gbps. Token - CORRECT ANSWER A device that is used to authenticate a user, typically in addition to a username and password. Scope Note: A token is usually a device the size of a credit card that displays a pseudo random number that changes every few minutes. Token ring topology - CORRECT ANSWER A type of local area network (LAN) ring topology in which a frame containing a specific format, called the token, is passed from one station to the next around the ring. Scope Note: When a station receives the token, it is allowed to transmit. The station can send as many frames as desired until a predefined time limit is reached. When a station either has no more frames to sendd or reaches the time limit, it transmits the token. Token passing prevents data collisions that can occur when two computers begin transmitting at the same time. Topology - CORRECT ANSWER The physical layout of how computers are linked together. Scope Note: Examples of topology include ring, star and bus. Transaction log - CORRECT ANSWER A manual or automated log of all updates to data files and databases. Transmission Control Protocol/Internet Protocol (TCP/IP) - CORRECT ANSWER Provides the basis for the Internet; a set of communication protocols that encompass media access, packet transport, session communication, file transfer, electronic mail (e-mail), terminal emulation, remote file access and network management. Trap door - CORRECT ANSWER Unauthorized electronic exit, or doorway, out of an authorized computer program into a set of malicious instructions or programs. Trojan horse - CORRECT ANSWER Purposefully hidden malicious or damaging code within an authorized computer program. Scope Note: Unlike viruses, they do not replicate themselves, but they can be just as destructive to a single computer. Tunneling - CORRECT ANSWER Commonly used to bridge between incompatible hosts/routers or to provide encryption, a method by which one network protocol encapsulates another protocol within itself. Scope Note: When protocol A encapsulates protocol B, a protocol A header and optional tunneling headers are appended to the original protocol B packet. Protocol A then becomes the data link layer of protocol B. Examples of tunneling protocols include IPSec, Point-to-point Protocol Over Ethernet (PPPoE) and Layer 2 Tunneling Protocol (L2TP). Twisted pair - CORRECT ANSWER A low--capacity transmission medium; a pair of small, insulated wires that are twisted around each other to minimize interference from other wires in the cable. Uninterruptible power supply (UPS) - CORRECT ANSWER Provides short-term backup power from batteries for a computer system when the electrical power fails or drops to an unacceptable voltage level. Unit testing - CORRECT ANSWER A testing technique that is used to test program logic within a particular program or module. Scope Note: The purpose of the test is to ensure that the internal operation of the program performs according to specification. It uses a set of test cases that focus on the control structure of the procedural design. Universal Serial BUS (USB) - CORRECT ANSWER An external bus standard that provides capabilities to transfer data at a rate of 12 Mbps. Scope Note: A USB port can connect up to 127 peripheral devices. building, to extremely long transmissions that encompass a large region or several countries. Wide area network (WAN) switch - CORRECT ANSWER A data link layer device used for implementing various WAN technologies such as asynchronous transfer mode, point-to-point frame relay solutions, and integrated services digital network (ISDN). Scope Note: WAN switches are typically associated with carrier networks providing dedicated WAN switching and router services to enterprises via T-1 or T-3 connections. Wi-Fi Protected Access (WPA) - CORRECT ANSWER A class of systems used to secure wireless (Wi-Fi) computer networks. Scope Note: WPA was created in response to several serious weaknesses that researchers found in the previous system, Wired Equivalent Privacy (WEP). WPA implements the majority of the IEEE 802.11i standard, and was intended as an intermediate measure to take the place of WEP while 802.11i was prepared. WPA is designed to work with all wireless network interface cards, but not necessarily with first generation wireless access points. WPA2 implements the full standard, but will not work with some older network cards. Both provide good security with two significant issues. First, either WPA or WPA2 must be enabled and chosen in preference to WEP; WEP is usually presented as the first security choice in most installation instructions. Second, in the "personal" mode, the most likely choice for homes and small offices, a pass phrase is required that, for full security, must be longer than the typical six to eight character passwords users are taught to employ. Wired Equivalent Privacy (WEP) - CORRECT ANSWER A scheme that is part of the IEEE 802.11 wireless networking standard to secure IEEE 802.11 wireless networks (also known as Wi-Fi networks). Scope Note: Because a wireless network broadcasts messages using radio, it is particularly susceptible to eavesdropping. WEP was intended to provide comparable confidentiality to a traditional wired network (in particular, it does not protect users of the network from each other), hence the name. Several serious weaknesses were identified by cryptanalysts, and WEP was superseded by Wi-Fi Protected Access (WPA) in 2003, and then by the full IEEE 802.11i standard (also known as WPA2) in 2004. Despite the weaknesses, WEP provides a level of security that can deter casual snooping. Wiretapping - CORRECT ANSWER The practice of eavesdropping on information being transmitted over telecommunications links. X.25 Interface - CORRECT ANSWER An interface between data terminal equipment (DTE) and data circuit-terminating equipment (DCE) for terminals operating in the packet mode on some public data networks.