B4-6 Flashcards
Which of the following controls most likely would ensure that an entity can reconstruct its financial records?
a.
System flowcharts provide accurate descriptions of input and output operations.
b.
Personnel who are independent of data input perform parallel simulations.
c.
Hardware controls are built into the computer by the computer manufacturer.
d.
Backup diskettes or tapes of files are stored away from originals.
Choice “d” is correct. Backup diskettes or tapes of files stored away from originals would enable an entity to reconstruct its financial records if the originals were destroyed.
Choice “c” is incorrect. Hardware controls affect the processing and transfer of information within the system. They do not enable the entity to reconstruct its financial records.
Choice “b” is incorrect. Parallel simulation is an auditing technique used when auditing through the computer. It does not allow an entity to reconstruct its financial records.
Choice “a” is incorrect. System flowcharts could provide accurate descriptions of input and output operations but would not assist in the reconstruction of financial records.
A company has a significant e-commerce presence and self-hosts its web site. To assure continuity in the event of a natural disaster, the firm should adopt which of the following strategies?
a.
Store records off-site.
b.
Purchase and implement RAID technology.
c.
Backup the server database daily.
d.
Establish off-site mirrored web server.
Choice “d” is correct. An off-site mirrored web server allows the off-site web server to take over almost immediately in the event of a disaster, thereby providing nearly uninterrupted service and allowing for business continuity.
Choice “c” is incorrect. Backing up the server database daily will provide a second copy of the data; however, by storing it in the same location, it would also be at risk in the event of a natural disaster and would not be an effective business continuity strategy.
Choice “a” is incorrect. Records are stored off-site for many reasons and while it is important to have these records in the event of a disaster, it would take days or weeks to upload it into a new system, making it a poor strategy for business continuity.
Choice “b” is incorrect. RAID (Redundant Array of Independent Disks) is often used for disk storage. The basic idea of RAID is to combine multiple inexpensive disk drives into an array of disk drives to obtain performance, capacity and reliability that exceed that of a single large disk drive. This is implemented at the original location for disk storage and is not considered a disaster recovery and business continuity option.
Disaster recovery service providers normally have an extensive amount of floor space and an extensive amount of equipment, but nowhere near enough if all (or even a significant number of similar customers) declared a disaster at the same time. Nonetheless, if a disaster recover service offers restoration of information technology functions within hours or a disaster, that off-site location would best be described by which term?
a.
Warm site.
b.
Hot site.
c.
In-house site.
d.
Cold site.
Choice “b” is correct. The hot site is not just sitting there waiting for a particular customer to declare a disaster. Disaster recovery service providers normally have an extensive amount of floor space and an extensive amount of equipment, but nowhere near enough if all (or even a significant number of similar customers) declared a disaster at the same time. How much is needed is determined on a probabilistic basis; to the disaster recovery services provider, geographic and industry diversification of customers is extremely important. Nonetheless, service restoration would be provided in hours.
Choice “d” is incorrect. Cold sites have fewer resources than hot sites and would not fully respond in few hours.
Choice “a” is incorrect. The term warm site refers to blended capabilities. Warm sites would not respond as rapidly as hot sites.
Choice “c” is incorrect. An in-house solution would use available capacity for critical functions. Hot sites typically involve external providers and off premises facilities.
Which of the following procedures should be included in the disaster recovery plan for an Information Technology department?
a.
Physical security of warehouse facilities.
b.
Replacement personal computers for user departments.
c.
Cross-training of operating personnel.
d.
Identification of critical applications.
Choice “d” is correct. The identification of critical applications will be found in almost all disaster recovery plans and thus is the best answer.
Choice “b” is incorrect. Replacement of PCs could be in some disaster recovery plans, even though when it is, the plan is more likely to be called a business continuity plan. If end users cannot use their PCs because the PCs have been destroyed, they might not be able to access the recovered applications. However, PCs can be readily purchased, and many firms will decide to purchase replacements only when they need to (depending on the nature and extent of the disaster, the end users might be able to move to an alternate location which still has its PCs). However, that approach should probably be documented in the disaster recovery plan. Choice “d” is a better option.
Choice “a” is incorrect. It is there to try to trick people into picking it because of the word “warehouse.” After all, we do have “data warehouses.”
Choice “c” is incorrect. Cross-training could be in some disaster recovery plans, assuming that the “operating personnel” means computer operations personnel (if it means something else, it won’t be). Cross-training of computer operations personnel (anybody who will be expected to be at the disaster recovery site to provide the care and feeding of the applications) might be appropriate because the disaster might keep some of the expected people from being there. If so, then the cross-training should be documented in the disaster recovery plan. Replacement of personnel is something that is often incorrectly ignored in disaster recovery plans.
Which of the following configurations of elements represents the most complete disaster recovery plan?
a.
Vendor contract for alternate processing site, backup procedures, names of persons on the disaster recovery team.
b.
Alternate processing site, backup and off-site storage procedures, identification of critical applications, test of the plan.
c.
Vendor contract for alternate processing site, names of persons on the disaster recovery team, off-site storage procedures.
d.
Off-site storage procedures, identification of critical applications, test of the plan.
Choice “b” is correct. All of the factors listed in the various choices are important for disaster recovery, but this question asks for the “most complete” disaster recovery plan. Any disaster plan must include an alternate processing site (of some kind), backup (of some kind) of programs and data, and a test of the plan. Normally, there must be some identification of critical applications; although, it is certainly possible in certain situations for “all” applications to be considered critical. This choice contains all of the required factors and is, thus, the best choice.
Choice “a” is incorrect. A vendor contract for an alternate processing site is normally included in a disaster recovery plan; however, it is possible for an organization to use its own facilities so that an outside vendor is not necessary. The names of persons on the disaster recovery team are not essential; the individuals involved could be identified by position and not by name. Also, testing of the plan must be included in the disaster recovery plan, and it is not in this choice.
Choice “d” is incorrect. A disaster recovery plan has to include some sort of alternate processing site, and this choice does not include that factor. In addition, backup is missing. Offsite storage tends to imply backup (since there has to be something to store offsite), but backup is not specifically included. So this choice is thus not as good as choice “b”.
Choice “c” is incorrect. An alternate processing site, backup, and testing are not included in this choice.
To prevent interrupted information systems operation, which of the following controls are typically included in an organization’s disaster recovery plan?
a.
Data input and downtime controls.
b.
Backup and data transmission controls.
c.
Backup and downtime controls.
d.
Disaster recovery and data processing controls.
Choice “c” is correct. Downtime (or the complete lack thereof) is a key factor in the disaster recovery plan. Backup is always essential in any disaster recovery plan. Choice “c” is the only choice with both downtime and backup.
Choice “b” is incorrect. Backup is always essential in any disaster recovery plan. These days, data transmission is an integral part of normal processing and of disaster recovery, and data transmission would definitely be important in any disaster recovery plan (normal data transmission has to be re-established at the disaster recovery facility, and this sometimes is one of the more difficult things to do). However, this choice does not include the word “downtime” and this choice is thus not as good as choice “c”.
Choice “a” is incorrect. Data input controls (and here the word does have meaning) have little to do with disaster recovery. Data input controls are an essential part of normal processing, and the normal controls would be available in the recovered applications once they are recovered. Downtime is addressed in this choice, but the inclusion of the data input controls makes this choice not as good as choice “c”.
Choice “d” is incorrect. This answer is a distractor
In which of the following locations should a copy of the accounting system data backup of year-end information be stored?
a.
Fireproof cabinet in the data network room.
b.
Secure off-site location.
c.
Locked file cabinet in the accounting department.
d.
Data backup server in the network room.
Choice “b” is correct. The accounting system data backup of year-end information should be stored in some kind of secure off-site location and not in any of the other listed locations.
Choice “d” is incorrect. The accounting system data backup would certainly not be stored (only) on a data backup server in the network room. What if the server crashed completely and the data could not be recovered? What if the network room burned down?
Choice “a” is incorrect. The accounting system data backup would certainly not be stored (only) in a fireproof cabinet in the data network room. The media to store the data might be more than would fit into a “cabinet” (many large corporations have hundreds of tapes of such data). The cabinet may be fireproof, but if a flood or other natural disaster hits, the cabinet may not be safe.
Choice “c” is incorrect. The accounting system data backup would certainly not be stored (only) in a locked file cabinet in the accounting department. The accounting department is not immune to fires, floods, and other natural disasters.
Which of the following procedures would an entity most likely include in its disaster recovery plan?
a.
Develop an auxiliary power supply to provide uninterrupted electricity.
b.
Maintain a Trojan horse program to prevent illicit activity.
c.
Store duplicate copies of files in a location away from the computer center.
d.
Convert all data from EDI format to an internal company format.
Choice “c” is correct. Storing duplicate copies of key files in a separate location can help a company continue operations in the event a disaster destroys the originals.
Choice “d” is incorrect. Conversion of data from EDI format to internal company format (using translation software) is necessary for companies that wish to utilize EDI, but it does not aid in disaster recovery.
Choice “b” is incorrect. Trojan horse programs perform rather than prevent illicit activity.
Choice “a” is incorrect. Provision of uninterrupted electricity may prevent accidental loss of data, but it does not help a company recover from a disaster that has already occurred.
A company switches all processing to an alternative site, and staff members report to the alternative site to verify that they are able to connect to all major systems and perform all core business processes from the alternative site. Which of the following best identifies the activities performed by the staff?
a.
Authentication validation.
b.
Disaster recovery planning.
c.
Closed loop verification.
d.
Segregation control testing.
Choice “b” is correct. Disaster recovery planning involves a company ensuring that it is able to restore and continue its operations in the event that its computing systems are shut down or destroyed. Staff members verifying the effectiveness of an alternative site established to allow business to continue in the event its systems are shut down is an example of disaster recovery planning.
Choice “c” is incorrect. Closed loop verification involves one party verifying the identity of another party.
Choice “a” is incorrect. Authentication validation involves establishing the identity of a system or user and verifying that it is valid.
Choice “d” is incorrect. Segregation control testing ensures that any controls that have been established to ensure that specific responsibilities are segregated amongst different employees are working as intended.
A controller is developing a disaster recovery plan for a corporation’s computer systems. In the event of a disaster that makes the company’s facilities unusable, the controller has arranged for the use of an alternate location and the delivery of duplicate computer hardware to this alternate location. Which of the following recovery plans would best describe this arrangement?
a.
Cold site.
b.
Hot site.
c.
Back-up site procedures.
d.
Hot spare site agreement.
Choice “a” is correct. The arrangement that the controller would be looking for would be a cold site. The reason is the use of an alternate location (either a hot site or a cold site) and then the delivery of duplicate computer hardware (that makes it a cold site).
Choice “b” is incorrect. With a hot site, the hardware would already be on the floor at the alternate location and available for use. Nothing would have to be delivered, unless the organization had some company-specific hardware that was not included in the disaster recovery contract. If so, that hardware would have to be delivered to the alternate location.
Choice “c” is incorrect. There should certainly be written procedures for the use of the back-up site, but that is not the name of the arrangement. There may or may not be written procedures.
Choice “d” is incorrect. This is not a commonly used term to describe disaster recovery facilities.
A client is concerned that a power outage or disaster could impair the computer hardware’s ability to function as designed. The client desires off-site backup hardware facilities that are fully configured and ready to operate within several hours. The client most likely should consider a:
a.
Hot site.
b.
Warm site.
c.
Cold site.
d.
Cool site.
Choice “a” is correct. A hot site is a backup facility for a computer center that contains most of the equipment contained in the original computer center.
Choice “c” is incorrect. A cold site usually requires one to three days to be made operational.
Choice “d” is incorrect. This is not a term that is typically used in the area of backup facilities.
Choice “b” is incorrect. The warm backup site is the compromise between the hot backup site and the cold backup site.
Which of the following terms refers to a site that has been identified and maintained by the organization as a data processing disaster recovery site but has not been stocked with equipment?
a.
Hot.
b.
Warm.
c.
Flying start.
d.
Cold.
Choice “d” is correct. A cold site is an off-site location that has all the electrical connections and other physical requirements for data processing, but does not have the actual equipment.
Choice “a” is incorrect. A hot site is an off-site location that is fully equipped to take over the company’s data processing.
Choice “b” is incorrect. A warm backup site is a facility that is stocked with all the hardware necessary to create a reasonable facsimile of the primary data center. The warm backup site is the compromise between the hot backup site and the cold backup site.
Choice “c” is incorrect. Flying start is not a method of disaster recovery.
Which of the following best describes a hot site?
a.
Location within the company that is most vulnerable to a disaster.
b.
Location that is equipped with the necessary hardware and possibly software.
c.
Location where a company can install data processing equipment on short notice.
d.
Location that is considered too close to a potential disaster area.
Choice “b” is correct. A hot site will have hardware that can be configured to be used for the processing needs of the client. The client will normally provide its own application software but backup copies of the software and data may be maintained at or near the hot site to expedite the recovery process.
Choice “a” is incorrect. The term “hot site” refers to a type of disaster recovery facility, not to a location within the company.
Choice “c” is incorrect. This describes a cold site which has electrical and telecommunication capabilities but no hardware. A client would need to first acquire and install hardware before processing capability would be restored.
Choice “d” is incorrect. A disaster recovery center should not be too close to the company’s normal operations center to make sure that they are not both involved in the same disaster. For example, if the company’s normal operations center were located in Galveston, Texas, the disaster recovery center should be located somewhere else. It should not be located in Houston, for example, because the same “disaster” (hurricane) could affect both locations
Which method of backup involves copying only the data items that have changed since the last backup?
a.
Differential.
b.
Off-schedule.
c.
Full.
d.
Incremental.
Choice “d” is correct. An incremental backup involves copying only the data items that have changed since the last backup. This produces a set of incremental backup files, each containing the results of one day’s transactions.
Choice “a” is incorrect. Differential backup copies all changes made since the last full backup.
Choice “c” is incorrect. Full Backup is an exact copy of the entire database.
Choice “b” is incorrect. Back up schedules are not routinely referred to as off-schedule backups. This is a distracter.
Vulnerable Corporation has its data centers in Ft. Lauderdale, Miami, and Galveston. Since each of these locations is somewhat susceptible to hurricanes, Vulnerable is considering developing a disaster recovery plan. Which of the following statements is/are incorrect for disaster recovery?
I.
Vulnerable uses application software packages. The license agreements for the packages usually provide the license holder the right to make backup copies of the software for disaster recovery purposes.
II.
Disaster recovery plans are limited to the restoration of IT processing.
III.
The major emphasis in disaster recovery is on the restoration of hardware and telecommunication services.
a.
I, II, and III are incorrect.
b.
I and III only are incorrect.
c.
I and II only are incorrect.
d.
II and III only are incorrect.
Choice “d” is correct. II and III are incorrect statements.
Statement I is correct. Vulnerable uses application software packages. The license agreements for the packages do usually provide the right to make backup copies of the software for disaster recovery purposes.
Statement II is incorrect. Standard disaster recovery plans are not limited to the restoration of IT processing. Disaster recover plans should be designed to restore critical operations as quickly as possible and that requires more than restoration of IT processing.
Statement III is incorrect. The major emphasis in disaster recovery is normally not just the restoration of hardware and telecommunication services. It is the restoration of operating functionality.
