Assessment Flashcards
Which of these choices is the best answer regarding who is primarily responsible for
providing internal controls to detect, correct, and prevent irregularities or illegal acts?
A. Board of directors
B. Information technology
C. Legal, aka general council
D. Human resources
A.
The board of directors has oversight control and responsibility to task executive management with the duties of providing internal controls. This function is to be specifically authorized in writing; given sufficient priority; and given resources of personnel, time, and money for proper implementation. CHAPTER 2
Which of the following functions should be separated from the others if segregation of
duties cannot be achieved in an automated system?
A. Origination
B. Authorization
C. Reprocessing
D. Transaction logging
B.
Authorization should be separate from all other activities. A second person should review changes before implementation. Authorization will be granted if the change is warranted and the level of risk is acceptable. Chapter 3 and 5
What is the purpose of the audit committee?
A. To provide daily coordination of all audit activities
B. To challenge and review assurances
C. To assist the managers with training in auditing skills
D. To govern, control, and manage the organization
B.
The purpose of the audit committee is to review and challenge assurances made and to maintain a positive working relationship with management and the auditors. For more information, see Chapters 2 and 3.
What are the qualifications of the incident commander when responding to a crisis?
A. Trained crisis manager
B. First person on scene
C. Member of management
D. First responder
B.
The first person on the scene is the incident commander, regardless of rank or position. The incident commander may be relieved by a person with more experience or less experience, according to the situation. The incident commander will change throughout the crisis. For more information, see Chapter 8
Which of the following options is not true in regard to configuring routers, servers, workstations, printers, and networked databases set up using default settings?
A. Designed to reduce technical support during installation for novice users
B. Sufficient controls to provide a minimum level of safety for production use
C. Predictable to facilitate successful intrusion attacks using well-known filenames, access
paths, and missing or incomplete security parameters
D. Remote scanning and automated penetration tools that prey upon systems running on
default settings
B.
Option B is not true. Vendors automate the installation to be as easy as possible so the majority of buyers will keep the product past the return deadline. Systems running on default settings are highly susceptible to attack because the layout and security profile is well known and easily available for anyone via a simple web search. All operating systems and databases require postinstallation tasks to lock default accounts, complete missing security parameters, set missing passwords, set access restrictions, and remove the installation utility and online examples, which the hacker will use against you. See Chapter 6 for more information.
How should management act to best deal with emergency changes?
A. Emergency changes cannot be made without advance testing.
B. The change control process does not apply to emergency conditions.
C. All changes should still undergo review.
D. Emergency changes are not allowed under any condition.
C.
All emergency changes should still undergo the formal change management process after the fact. The review determines whether the change should remain in place or be modifi ed. For more information, see Chapter 6.
Which of the following would be a concern that the auditor should explain in the audit report along with their findings?
A. Lack of a detailed list of audit objectives
B. Undue restrictions placed by management on evidence use or audit procedure
C. Communicating results directly to the chairperson of the audit committee
D. Need by the current auditor to communicate with the prior auditors
B.
Undue restrictions on scope would be a major concern, as would a lack of time or the inability to obtain suffi cient reliable evidence. For more information, see Chapter 3.
During the performance of an audit, a reportable finding is identified with the auditee. The
auditee immediately fixed the problem upon identification. Which of the following is true
as a result of this interaction?
A. Auditee resolved the problem before the audit report is written, therefore no finding
exists.
B. Auditor can verify that the corrective action has been taken before the audit report is
written, therefore no finding exists.
C. Auditor includes the finding in the final audit report as resolved.
D. Auditor lists the finding as it existed.
D.
Audit reports are intended to reflect the situation prior to the start of the audit. An audit is always a review of past history. This situation indicates that the auditee never detected the problem until it was found by the auditor. The audit report should include the finding and described the corrective action taken by the auditee after discovery. If the finding was to be color-coded red, the final audit report should indicate a red color code with the notation in the comments field that corrective action was taken by the auditee. For more information, see Chapter 3.
Which of the following management methods provides the most control rather than
discretionary flexibility?
A. Distributed
B. Centralized
C. In-house
D. Outsourced
B. Centralized management always provides the most control. Distributed management is also known as discretionary because the decision is made locally and is based on a variety of factors. Distributed methods provide the lowest overall control. For more information, see Chapter 7.
What is the principal issue surrounding the use of CAAT software?
A. The capability of the software vendor
B. Documentary evidence is more effective
C. Inability of automated tools to consider the human characteristics of the environment
D. The possible cost, complexity, and security of output
D.
Computer-assisted audit tools are able to perform detailed technical tasks faster than humans and produce more accurate data during particular functions such as system scanning. Cost, training, and security of output are major considerations. For more information, see Chapter 3.
Digital signatures are designed to provide additional protection for electronic messages in
order to determine which of the following?
A. Message read by unauthorized party
B. Message sender verification
C. Message deletion
D. Message modification
B.
Digital signatures provide authentication assurance of the email sender. A cryptographic process uses the private key of the sender to form a hash value of the message. Message hashing provides assurance that the message is from the specified sender and was not modified. For more information, see Chapter 7.
Which is the primary benefit of using a risk-based approach in audit planning?
A. Simplifies resource scheduling.
B. Allocates resources to the areas of highest concern.
C. Properly trained personnel are available.
D. Lowers the overall cost of compliance.
B.
Areas of highest concern are usually identified by comparing individual tasks identified within the auditee’s workflow process diagram with the handling rules of individual data assets being used according to their records management system (RMS). A risk-based approach allows annual audit compliance requirements to be divided up into a series of smaller audits occurring each month in each quarter. Resource scheduling and verifying the availability of properly trained personnel may be done months in advance using various methods of external individual audits. For more information, see Chapters 2 and 3.
What indicators are used to identify the anticipated level of recovery and loss at a given
point in time?
A. RPO and RTO
B. RTO and SDO
C. RPO and ITO
D. SDO and IRO
A.
The recovery point objective (RPO) indicates the fallback position and duration of loss that has occurred. A valid RPO example is to recover by using backup data from last night’s backup tape, meaning that the more recent transactions would be lost. The recovery time objective (RTO) indicates a point in time that the restored data should be available for the user to access. For more information, see Chapter 8.
Which of the following is the best choice to ensure that internal control objectives are met?
A. Top executive issues a policy stating compliance objectives.
B. Procedures are created to govern employee conduct.
C. Suitable systems for tracking and reporting incidents are used.
D. The clients operating records are audited annually.
C.
Designing, implementing, and using suitable systems for tracking and reporting incidents
is the best way to ensure that internal control objectives are met. What gets measured is what
gets done, so tracking the detection of problems is the best answer. The other choices are also
important actions, but in the hierarchy of controls the first priority is timely detection. Lack of detection is a total governance failure. For more information, see Chapter 2.
Which of the following statements is true concerning asymmetric key cryptography?
A. The sender encrypts the files by using the recipient’s private key.
B. The sender and receiver use the same key.
C. Asymmetric keys cannot be used for digital signatures.
D. The sender and receiver have different keys.
D.
The sender and receiver each have their own public and private key pair. Only the public keys are shared between sender and receiver. All the other statements are false. Asymmetric keys are definitely used for creating digital signatures. The sender would never use the recipient’s private
key, only the recipient’s public key. For more information, see Chapter 7.
Who is responsible for designating the appropriate information classification level?
A. Data custodian
B. Data user
C. Data owner
D. Security manager
C.
The data owner is responsible for designating the appropriate information security level and appointing the custodian. The data owner is usually a vice president or someone in a position higher up in the organization, up to an agency head. The data owner also specifies the controls to be used. The audit committee and management can change the security level if the data owner fails to properly classify the data. For more information, see Chapter 7.
What is the best statement regarding the purpose of using the OSI model?
A. To define separation of duties, controls, and boundaries
B. To define which level of program-to-program gateways operate
C. To define how networking protocols work for IT professionals
D. To define the differences between OSI and IP protocols
A.
The Open Systems Interconnect (OSI) model is used to define separation of duties for electronic services, personnel, control points, and boundaries used in service-level agreements, compliance rules, and legal contracts. Most IT professionals were never taught the actual content and don’t understand the incredibly valuable information they missed. For more information, see Chapter 4
What is one of the bigger concerns regarding asset disposal?
A. Residual asset value
B. Employees taking disposed property home
C. Standing data
D. Environmental regulations
C.
Standing data should be purged from the equipment prior to disposal. Standing data refers to information that can be recovered from a device by using any means. For more information, see Chapter 6.
What is the primary purpose of database views?
A. Restrict the viewing of selected data
B. Provide a method for generating reports
C. Allow the user access into the database
D. Allow the system administrator access to maintain the database
A.
Database views are weak controls used to implement least privilege and restrict the data that can be viewed by the user. For more information, see Chapter 7.
Which step is necessary before moving into the next phase when using the System Development Life Cycle?
A. Phase meeting
B. Change control
C. Formal approval
D. Review meeting
C.
Formal approval is necessary before moving into the next phase. A review meeting is held with the stakeholders, project manager, and executive chairperson. All of the projections and open issues are discussed. Each item is approved, rejected, or canceled. The project may advance to the next stage with formal approval. The auditor should look for evidence of formal approval and how the decision was made. For more information, see Chapter 5.
Which of the following indicates why continuity planners can create plans without a
business impact analysis (BIA)?
A. Management already dictated all the key processes to be used.
B. They can’t because critical processes may change monthly or annually.
C. Business impact analysis is not required.
D. Risk assessment is acceptable.
B.
It is not possible to create business continuity plans without a current business impact analysis (BIA). The BIA is a step-by-step process map that identifies critical processes and their dependencies. The critical processes will change as the business changes with new products and customers. For more information, see Chapter 8.
Which of the following answers contains the steps for business process reengineering (BPR)
in proper sequence?
A. Diagnose, envision, redesign, reconstruct
B. Envision, initiate, diagnose, redesign, reconstruct, evaluate
C. Evaluate, envision, redesign, reconstruct, review
D. Initiate, evaluate, diagnose, reconstruct, review
B.
According to ISACA, the general steps in business process reengineering are envision the need, initiate the project, diagnose the existing process, redesign a process, use change management to reconstruct the organization in transition, and evaluate the results. For more information, see Chapter 2.
Segregation or separation of duties may not be practical in a small environment. A single employee may be performing the combined functions of server operator and application programmer. The IS auditor should recommend controls for which of the following?
A. Automated logging of changes made to development libraries
B. Procedures that verify that only approved program changes are implemented
C. Automated controls to prevent the operator logon ID from making program modifications
D. Hiring additional technical staff to force segregation of duties
B.
Procedures should be implemented to ensure that only approved program changes are implemented. The purpose of separation of duties is to prevent intentional or unintentional errors. In the worst case, a logical separation of duties may exist if a single person performs two job roles. The ultimate objective is to ensure that a second person has reviewed and approved a change before it is implemented. For more information, see Chapter 6.
Which of the following is true concerning reporting by internal auditors?
A. Results can be used for industry licensing.
B. The corresponding value of the audit report is high.
C. Results can be used for external reporting.
D. The corresponding value of the audit report is low.
D.
Reports by internal auditors have a low corresponding value due to the built-in reporting conflict that may exist. This is why external independent audits are required for regulatory licensing. For more information, see Chapter 3.
The auditor is permitted to deviate from professional audit standards when they feel it is
necessary because of which of the following?
A. Standards are designed for discretionary use.
B. The unique characteristics of each client will require auditor flexibility.
C. Deviating from standards is almost unheard of and would require significant justification.
D. Deviation depends on the authority granted in the audit charter.
C.
Standards are mandatory and any deviation would require justification. Exceptions are rarely accepted. For more information, see Chapter 2.
Which of the following is true regarding the principle of auditor independence?
A. It is not an issue for auditors working for a consulting company.
B. It is required for an external audit to prevent bias.
C. An internal auditor must undergo certification training to be independent.
D. The audit committee would bestow independence on the auditor.
B.
The auditor must be independent of personal and organizational relationships with the auditee, which could imply a biased opinion. The auditor is not permitted to audit a system for which they participated in the support, configuration, or design. An auditor may not audit any system that they helped to remediate. For more information, see Chapter 1.
What is the best definition of auditing?
A. Review of past history using evidence to tell the story
B. Forecasting compliance generated by a new system preparing to enter production
C. Precompliance assessment based on management’s intended design
D. Certification testing of the system benefits or failures
A.
Auditing is a review of past history. We use evidence and testing to determine the story. It’s not possible to use an audit to forecast compliance benefits before entering production. Every system creates unforeseen consequences that can be fully realized only after that system enters production. You can audit the system attributes during design and development but you can’t audit the unrealized operating issues impacting its compliance. Compliance requires an audit after it enters production to include the way the system is actually used and managed. For more information, see Chapters 3 and 5.
Which of the following is the most significant issue to consider regarding insurance coverage?
A. Premiums may be very expensive.
B. Insurance can pay for all the costs of recovery.
C. Coverage must include all business assets.
D. Salvage, rather than replacement, may be dictated.
D.
The insurance company may dictate salvage to save money. Salvage will increase the delay before recovery. Any replacement purchases by the organization may not be covered under reimbursement. For more information, see Chapter 8.
Which of the following statements is not true regarding the use of passwords for
authentication?
A. Password lockout is not effective against hackers using the common technique of
bypassing the login utility.
B. Hash utilities for one-way encryption of OS login passwords are highly susceptible to chosen ciphertext lookup tables, which will show the actual plaintext password currently in use.
C. Many dynamic websites with a database backend use program-to-program configuration files to store the passwords using encrypted hash format.
D. Passwords are portable, easily captured and reused for unauthorized access, and
considered terribly weak authenticators.
D.
Option D is no true. Passwords are considered weak because they are portable and easily reused for authorized access. Hacker utilities frequently bypass the login utility by going straight to the authenticator service. For over 30 years, the rainbow tables have provided a ciphertext-to-plaintext lookup for each of the known hash encryption algorithms used by various operating systems. Simply matching the hash value of the target with the lookup table will allow you to see what plaintext generated the hash value. On many websites, the database login and password are visible using the right-click View Source option. Program- to-program configuration file passwords are normally stored in the directory tree using simple plaintext without encryption. For more information, see Chapter 6.
Using public-key interchange (PKI) encryption, which key is used by the sender for authentication of the receiving party?
A. Sender’s private key
B. Recipient’s private key
C. Recipient’s public key
D. Sender’s public key
Which of the following statements is true concerning a software worm?
A. Uses authentication defects to freely travel to infect other systems
B. Is a synonym for a malicious virus appending itself to data files
C. Must be executed by opening a file
D. Attaches itself to programs and data by the opening and closing of files
A.
Unlike a virus, a worm can freely travel across network connections to infect other systems. Worms exploit authentication failures in other programs to copy themselves between systems. Worms can infect files without the file being opened or closed by the user. For more information, see Chapter 7.
What are three of the four key perspectives on the IT balanced scorecard?
A. Business justification, service-level agreements, budget
B. Organizational staffing, cost reduction, employee training
C. Cost reduction, business process, growth
D. Service level, critical success factors, vendor selection
C.
The four perspectives on the IT balanced scorecard are the customer perspective, business process perspective, financial perspective, and the growth perspective. Each of these seeks to define the highest return by IT. For more information, see Chapter 2.
