CITP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

IT governance definition

The structures of decision rights and accountability plus the processes that direct and control IT, ensuring alignment with enterprise strategy, value delivery, and risk management.

COBIT EDM vs management

COBIT 2019 splits governance into Evaluate, Direct, Monitor objectives and management into APO, BAI, DSS, MEA domains. Governance sets direction; management plans, builds, runs, and monitors.

Three lines model

First line owns and manages risk in operations; second line provides independent oversight and challenge; third line, internal audit, gives independent assurance to the governing body.

Segregation of duties

Splitting incompatible duties so no one person can initiate, approve, execute, and record a transaction, preventing fraud and undetected error.

Risk appetite vs tolerance

Risk appetite is the amount of risk an organization is willing to accept in pursuit of objectives; tolerance is the acceptable variance around that appetite for a specific measure.

Balanced Scorecard IT perspectives

A measurement framework with financial, customer, internal process, and learning and growth perspectives, used to show IT contribution through outcomes rather than activity counts.

Governance decision archetypes

Weill and Ross archetypes: business monarchy, IT monarchy, federal, IT duopoly, and anarchy, applied to principles, architecture, infrastructure, business application needs, and investment.

Availability in nines

Downtime per year: 99% is 3.65 days, 99.9% is 8.76 hours, 99.99% is 52.6 minutes, 99.999% is 5.26 minutes. Availability equals MTBF divided by MTBF plus MTTR.

RPO versus RTO

Recovery point objective is the maximum tolerable data loss in time, driving backup frequency. Recovery time objective is the maximum tolerable outage, driving recovery infrastructure.

RAID levels

RAID 1 mirrors, RAID 5 stripes with single parity tolerating one disk failure, RAID 6 uses dual parity tolerating two, RAID 10 mirrors and stripes. None replaces backup.

OSI layer functions

Layers one to seven are physical, data link, network, transport, session, presentation, and application. TCP is transport, IP is network, and TLS spans transport to application.

Cloud shared responsibility

In IaaS the customer patches the operating system and above; in PaaS the customer secures applications and data; in SaaS the provider secures nearly everything but user access and data.

Containers versus virtual machines

Containers share the host kernel and isolate processes, giving fast startup and low overhead. Virtual machines run separate guest kernels on a hypervisor, giving stronger isolation.

Database normalization forms

First normal form removes repeating groups; second removes partial dependencies on part of a composite key; third removes transitive dependencies on non-key attributes.

CAP theorem

A distributed system facing a network partition must sacrifice either consistency or availability. BASE systems choose availability with eventual consistency instead of strict ACID guarantees.

CIA triad

Confidentiality limits disclosure to authorized parties, integrity keeps data accurate and unaltered, and availability ensures timely access. Authentication, authorization, and non-repudiation support these goals.

Risk treatment options

Mitigate by applying controls, transfer through insurance or contracts, avoid by eliminating the activity, or accept and monitor. Residual risk remains after treatment and needs owner sign-off.

Access control models

Discretionary control lets owners grant access; mandatory uses classification labels; role-based grants by job function; attribute-based evaluates policy on multiple attributes.

Control categories

Preventive controls stop events, detective controls identify them, corrective controls restore service, deterrent controls discourage attackers, and compensating controls substitute for a primary control.

Symmetric versus asymmetric keys

Symmetric ciphers such as AES use one shared key for bulk encryption. Asymmetric keys such as RSA or ECC use key pairs for key exchange and digital signatures at lower speed.

Incident response phases

Preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Evidence handling follows order of volatility and preserves chain of custody.

Privacy principles

Purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability govern lawful personal data processing and require demonstrable compliance.

Controller versus processor

The controller determines why and how personal data is processed and bears primary accountability; the processor handles data only on the controller's documented instructions.

BCP versus DRP

Business continuity planning keeps critical business functions operating during disruption. Disaster recovery planning restores IT systems and data after an outage, supporting the continuity plan.

Cost variance formula

Cost variance equals earned value minus actual cost. A negative result means spending exceeds the value earned; positive means under budget for work performed.

Schedule variance formula

Schedule variance equals earned value minus planned value. A negative value indicates work is behind the planned baseline; positive indicates ahead of schedule.

Cost performance index

CPI equals earned value divided by actual cost. A value below 1.0 means each unit of currency buys less work than planned; 1.0 means on budget.

Estimate at completion

EAC forecasts total project cost. Use budget at completion divided by CPI when current cost performance continues, or actual cost plus a fresh estimate to complete.

Critical path

The longest duration path through the project network, which sets the minimum project duration. Activities on it have zero float, so any delay slips the finish date.

Change control board

A body that reviews change requests, assesses impact on scope, schedule, cost, and risk, then approves, rejects, or defers changes to the approved baseline.

Testing levels

Unit tests components, integration tests interfaces, system tests end-to-end behavior, user acceptance tests business fitness, and regression tests confirm changes broke nothing existing.

Contract types

Fixed-price places cost risk on the seller, cost-reimbursable places it on the buyer, and time and materials shares it. Choice depends on requirement clarity and risk tolerance.