Information Systems Operations and Business Resilience practice questions

Hardware maintenance programs exist to keep equipment reliable by maintaining it as the manufacturer specifies.

The core of a hardware maintenance program is preventive maintenance performed at the frequency and in the manner the vendor specifies, prioritised by the equipment's criticality, with records showing the work was done. Staying within budget, using in-house staff or replacing at the end of depreciation are management choices that do not by themselves keep hardware reliable.

1. Ask what the program is for: reliable hardware with fewer failures.
2. Identify the reference for adequate maintenance: the vendor's specifications.
3. Set aside cost, staffing and accounting choices that do not determine reliability.
4. Choose maintenance scheduled to vendor specifications.

Exam tip: Hardware maintenance is judged against the vendor's specified schedule and the equipment's criticality.

An auditor assesses the impact of a deviation with evidence before recommending or reporting.

Departing from the manufacturer's schedule is a deviation, but its significance depends on its effect. Hardware error reports, downtime records and incident history for the affected servers show whether failures have increased. Only with that evidence can the auditor rate the finding and frame a recommendation. Recommending or reporting first is premature, and arranging the work is management's job.

1. Note that the deviation is known but its effect is not.
2. Gather evidence of impact on the affected servers.
3. Use the evidence to rate the finding.
4. Recommend and report only after that.

Exam tip: Found a deviation? Measure its effect with evidence before recommending or reporting.

USB mass storage devices are a leading route for data leakage.

Unrestricted copying of server files to personal USB devices means data can leave the organization on media it neither owns nor protects. Lost, stolen or deliberately removed devices expose that data. Malware introduction is the other classic USB risk, but it is tied to connecting untrusted media rather than to copying data out, which is what the scenario describes. Version confusion and server load are minor by comparison.

1. Identify the direction of the activity: data copied out to personal media.
2. Ask what is lost when data leaves on unmanaged devices.
3. Compare against malware, which arises from untrusted media coming in.
4. Choose unauthorized disclosure.

Exam tip: Data copied to unmanaged USB devices is a confidentiality risk first.

Where removable media must stay enabled, approved encrypted devices with device control are the preventive control.

The business need rules out blocking USB, so the control must allow USB while preventing leakage. Allowing only company-issued encrypted drives prevents data going to personal media and keeps it unreadable if a drive is lost. Antivirus scanning addresses a different risk (malware), log review only detects after the fact, and an acceptable-use agreement only directs behaviour.

1. Note the constraint: USB use must remain available.
2. Identify the risk named: data leaving the organization.
3. Prefer a preventive control over detective or directive ones.
4. Choose approved encrypted devices with device control.

Exam tip: If USB must stay on, permit only approved encrypted devices; scanning stops malware, not leakage.

IT asset management starts with an inventory.

An organization cannot classify, protect, maintain or dispose of assets it does not know it has. The first step is therefore to identify and record IT assets in an inventory or register, with attributes such as owner, location and configuration. Classification, replacement cycles and disposal procedures all build on that inventory.

1. List the activities in an asset life cycle.
2. Ask which activity every other one depends on.
3. Recognise that classification, replacement and disposal need a known asset base.
4. Choose building the inventory.

Exam tip: You cannot manage or protect an asset you have not inventoried.

Every information asset needs an accountable owner.

Asset ownership assigns accountability: the owner decides the asset's classification, the protection it needs, who may use it and when it is retired. Without owners, those decisions are made by no one, so protection may be inadequate and life cycle actions missed. Lapsed contracts and stale entries are symptoms that can follow; depreciation is a finance calculation unaffected by ownership.

1. Ask what the owner field establishes: accountability.
2. List the decisions that need an accountable person.
3. Separate the root risk from the symptoms that follow it.
4. Choose the loss of accountability for protection and life cycle.

Exam tip: No owner means no one decides an asset's protection; the other problems follow from that.