ICAB CL Information Technology flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

Volatile memory

Memory that loses its contents when power is removed, such as RAM. It holds programs and data currently in use and is faster but more expensive per unit than secondary storage.

TCP versus UDP

TCP is connection-oriented and reliable, using handshakes, sequencing, and retransmission. UDP is connectionless and faster but does not guarantee delivery, making it suitable for streaming and voice.

OSI model layers

Seven layers from bottom to top: Physical, Data Link, Network, Transport, Session, Presentation, Application. Each layer provides services to the layer above and uses services from the layer below.

DNS function

The Domain Name System translates human-readable hostnames into IP addresses. It is a distributed hierarchical database, and failures can make services unreachable even when servers are running.

IPv4 versus IPv6

IPv4 uses 32-bit addresses written as four decimal octets, allowing about 4.3 billion addresses. IPv6 uses 128-bit addresses, providing a vastly larger address space and simpler header structure.

LAN and WAN

A LAN covers a limited area such as one building under a single administration. A WAN spans large geographic distances and typically interconnects LANs using carrier or leased links.

Cloud service models

IaaS provides virtualized compute and storage; PaaS provides a managed development and runtime platform; SaaS provides a complete application. Responsibility for controls shifts toward the provider as you move up.

Database normalization

A design process that reduces redundancy and anomalies. First normal form removes repeating groups, second removes partial dependencies, and third removes transitive dependencies on non-key attributes.

Backup types

A full backup copies all data; an incremental copies changes since the last backup of any type; a differential copies changes since the last full backup. Restore speed and storage needs differ by type.

SDLC phases

The systems development life cycle proceeds through planning and feasibility, requirements analysis, design, development, testing, implementation, and maintenance. Each phase produces deliverables that feed the next.

Waterfall versus agile

Waterfall is sequential with requirements fixed early and heavy documentation. Agile delivers work in short iterations with continuous stakeholder feedback and welcomes changing requirements between iterations.

ACID properties

Atomicity means all-or-nothing execution; consistency means only valid states; isolation means concurrent transactions do not interfere; durability means committed changes survive system failure.

Primary and foreign keys

A primary key uniquely identifies each row and cannot be null. A foreign key references a primary key in another table and enforces referential integrity between related tables.

Data governance roles

The data owner is accountable for a data domain, the data steward maintains quality and definitions, and data users consume data. Clear role assignment supports accountability and data quality.

Master versus transactional data

Master data is core shared reference data such as customers, products, and vendors that changes slowly. Transactional data records business events such as orders and payments and changes rapidly.

Data-quality dimensions

Common dimensions are accuracy, completeness, timeliness, consistency, validity, and uniqueness. Measuring each dimension lets an organization target remediation where it matters most.

Data dictionary

A repository of metadata describing each data element: name, data type, length, format, allowed values, and validation rules. It supports consistent design and maintenance across systems.

Batch versus real-time processing

Batch processing collects transactions and processes them on a schedule. Real-time processing handles each transaction immediately, which is required for reservations, payments, and monitoring.

Control types by timing

Preventive controls stop errors before they occur, such as access restrictions and input validation. Detective controls find errors afterward, such as reconciliations. Corrective controls restore correct processing.

Segregation of duties

Separating authorization, custody of assets, and record-keeping so no single person can both commit and conceal an error or fraud. Incompatible duties are split across different employees.

Input validation controls

Checks applied to data entering a system, including field, validity, range, reasonableness, and completeness checks, check digits, and batch totals such as hash and record counts.

Batch totals

Control totals computed before processing and rechecked afterward. Financial totals sum amounts, hash totals sum numeric fields, and record counts tally documents, revealing missing or altered items.

General versus application controls

General IT controls govern the IT environment, covering change management, access, backup, and operations. Application controls apply to specific transaction processing and are tested within business cycles.

RTO and RPO

Recovery time objective is the maximum acceptable downtime before operations resume. Recovery point objective is the maximum acceptable data loss measured in time, which drives backup frequency.

COSO components

Five components of internal control: control environment, risk assessment, control activities, information and communication, and monitoring activities. They apply across the entity and at process levels.

Change management steps

Request, impact assessment, approval by authorized personnel, controlled implementation, and post-implementation review. Emergency changes follow a shortened path but remain documented and reviewed afterward.

CIA triad

Confidentiality ensures only authorized parties access data; integrity ensures data is accurate and unaltered; availability ensures systems and data are accessible when needed by authorized users.

Authentication factors

Something you know (password), something you have (token or device), and something you are (biometric). Multi-factor authentication combines two or more different factor types for stronger assurance.

Symmetric encryption

One shared secret key encrypts and decrypts data. It is fast and suits bulk data, but distributing and managing keys securely is its main weakness compared with asymmetric encryption.

Hashing versus encryption

Hashing is one-way and produces a fixed-length digest used to verify integrity. Encryption is reversible with a key and is used to protect confidentiality. Hashing does not conceal content.

Digital signature

A hash of a message encrypted with the sender's private key. It verifies integrity, authenticates the sender, and provides non-repudiation because only the sender holds the private key.

IDS versus IPS

An intrusion detection system monitors traffic and alerts on suspicious activity. An intrusion prevention system also blocks or drops the traffic, acting as an inline preventive control.

Risk formula and responses

Risk equals likelihood multiplied by impact. Responses are avoid, reduce or mitigate, transfer such as through insurance, and accept. Residual risk remains after controls are applied.

SOC report types

SOC 1 reports address controls relevant to financial reporting. SOC 2 reports address security, availability, processing integrity, confidentiality, and privacy. SOC 3 is a general-use summary.