Assessment & Evaluation Methods Flashcards

Which of the following best describes the purpose of a configuration management database (CMDB) in system assessment?

Answer: Provide an authoritative inventory of IT assets and their relationships for auditing

A CMDB serves as the authoritative source of record for IT assets, making it essential for impact analysis, audits, and change assessments.

A server's availability is recorded as 99.5% over a month with 30 days. Approximately how many minutes of downtime occurred?

Answer: 216 minutes

0.5% of 43,200 minutes (30 days) = 216 minutes of downtime.

Which evaluation method involves reviewing system documentation, policies, and procedures without testing live systems?

Answer: Document review

Document review is a passive assessment technique that examines written policies, procedures, and architecture documentation to identify gaps.

When assessing backup integrity, which test provides the strongest evidence that backups are valid?

Answer: Performing a full restore to a test system and validating data

Only a full restore test to a separate environment confirms that backup data is both complete and recoverable.

Which performance assessment approach tests a system's behavior under maximum expected load?

Answer: Load testing

Load testing evaluates system performance and stability by simulating the maximum anticipated concurrent user or transaction load.

In an IT audit, the term 'compensating control' refers to what?

Answer: An alternative control that mitigates risk when the primary control cannot be implemented

A compensating control provides equivalent risk reduction when the standard required control is not feasible to implement in a specific environment.

Which metric is used to evaluate the efficiency of a help desk or incident response team's resolution speed?

Answer: MTTR (Mean Time to Resolve)

MTTR (Mean Time to Resolve) measures the average duration from incident detection to full resolution, reflecting team response efficiency.