chapter 2 | mcq Flashcards

1
Q

All of the following are issues of computer security except
a. releasing incorrect data to authorized individuals
b. permitting computer operators unlimited access to the computer room
c. permitting access to data by unauthorized individuals
d. providing correct data to unauthorized individuals

A

b. permitting computer operators unlimited access to the computer room

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Segregation of duties in the computer-based information system includes
a. separating the programmer from the computer operator
b. preventing management override
c. separating the inventory process from the billing process
d. performing independent verifications by the computer operator

A

a. separating the programmer from the computer operator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

In a computer-based information system, which of the following duties needs to be separated? a. program coding from program operations
b. program operations from program maintenance
c. program maintenance from program coding
d. all of the above duties should be separated

A

d. all of the above duties should be separated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Supervision in a computerized environment is more complex than in a manual environment for all of the following reasons except
a. rapid turnover of systems professionals complicates management’s task of assessing the
competence and honesty of prospective employees
b. many systems professionals have direct and unrestricted access to the organization’s
programs and data
c. rapid changes in technology make staffing the systems environment challenging
d. systems professionals and their supervisors work at the same physical location

A

d. systems professionals and their supervisors work at the same physical location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Adequate backups will protect against all of the following except
a. natural disasters such as fires
b. unauthorized access
c. data corruption caused by program errors
d. system crashes

A

b. unauthorized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which is the most critical segregation of duties in the centralized computer services function?
a. systems development from data processing
b. data operations from data librarian
c. data preparation from data control
d. data control from data librarian

A

a. systems development from data processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Systems development is separated from data processing activities because failure to do so
a. weakens database access security
b. allows programmers access to make unauthorized changes to applications during
execution
c. results in inadequate documentation
d. results in master files being inadvertently erased

A

b. allows programmers access to make unauthorized changes to applications during
execution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which organizational structure is most likely to result in good documentation procedures?
a. separate systems development from systems maintenance
b. separate systems analysis from application programming
c. separate systems development from data processing
d. separate database administrator from data processing

A

a. separate systems development from systems maintenance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

All of the following are control risks associated with the distributed data processing structure except
a. lack of separation of duties
b. system incompatibilities
c. system interdependency
d. lack of documentation standards

A

c. system interdependency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which of the following is not an essential feature of a disaster recovery plan?
a. off-site storage of backups
b. computer services function
c. second site backup
d. critical applications identified

A

b. computer services function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A cold site backup approach is also known as
a. internally provided backup
b. recovery operations center
c. empty shell
d. mutual aid pact

A

c. empty shell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The major disadvantage of an empty shell solution as a second site backup is
a. the host site may be unwilling to disrupt its processing needs to process the critical
applications of the disaster stricken company
b. intense competition for shell resources during a widespread disaster
c. maintenance of excess hardware capacity
d. the control of the shell site is an administrative drain on the company

A

b. intense competition for shell resources during a widespread disaster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

An advantage of a recovery operations center is that
a. this is an inexpensive solution
b. the initial recovery period is very quick
c. the company has sole control over the administration of the center
d. none of the above are advantages of the recovery operations center

A

b. the initial recovery period is very quick

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

For most companies, which of the following is the least critical application for disaster recovery purposes?
a. month-end adjustments
b. accounts receivable
c. accounts payable
d. order entry/billing

A

a. month-end adjustments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The least important item to store off-site in case of an emergency is
a. backups of systems software
b. backups of application software
c. documentation and blank forms
d. results of the latest test of the disaster recovery program

A

d. results of the latest test of the disaster recovery program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Some companies separate systems analysis from programming/program maintenance. All of the following are control weaknesses that may occur with this organizational structure except
a. systems documentation is inadequate because of pressures to begin coding a new program
before documenting the current program
b. illegal lines of code are hidden among legitimate code and a fraud is covered up for a long
period of time
c. a new systems analyst has difficulty in understanding the logic of the program
d. inadequate systems documentation is prepared because this provides a sense of job
security to the programmer

A

c. a new systems analyst has difficulty in understanding the logic of the program

17
Q

All of the following are recommended features of a fire protection system for a computer center except
a. clearly marked exits
b. an elaborate water sprinkler system
c. manual fire extinguishers in strategic locations
d. automatic and manual alarms in strategic locations

A

b. an elaborate water sprinkler system

18
Q

All of the following tests of controls will provide evidence about the physical security of the computer center except
a. review of fire marshal records
b. review of the test of the backup power supply
c. verification of the second site backup location
d. observation of procedures surrounding visitor access to the computer center

A

c. verification of the second site backup location

19
Q

All of the following tests of controls will provide evidence about the adequacy of the disaster recovery plan except
a. inspection of the second site backup
b. analysis of the fire detection system at the primary site
c. review of the critical applications list
d. composition of the disaster recovery team

A

b. analysis of the fire detection system at the primary site

20
Q

The following are examples of commodity assets except
a. network management
b. systems operations
c. systems development
d. server maintenance

A

c. systems development

21
Q

The following are examples of specific assets except
a. application maintenance
b. data warehousing
c. highly skilled employees
d. server maintenance

A

d. server maintenance

22
Q

Which of the following is true?
a. Core competency theory argues that an organization should outsource specific core assets.
b. Core competency theory argues that an organization should focus exclusively on its core business
competencies
c. Core competency theory argues that an organization should not outsource specific commodity
assets.
d. Core competency theory argues that an organization should retain certain specific noncore assets
in-house.

A

b. Core competency theory argues that an organization should focus exclusively on its core business
competencies

23
Q

Which of the following is not true?
a. Large-scale IT outsourcing involves transferring specific assets to a vendor
b. Specific assets, while valuable to the client, are of little value to the vendor
c. Once an organization outsources its specific assets, it may not be able to return to its pre-outsource
state.
d. Specific assets are of value to vendors because, once acquired, vendors can achieve economies of
scale by employing them with other clients

A

d. Specific assets are of value to vendors because, once acquired, vendors can achieve economies of
scale by employing them with other clients

24
Q

Which of the following is not true?
a. When management outsources their organization’s IT functions, they also outsource responsibility
for internal control.
b. Once a client firm has outsourced specific IT assets, its performance becomes linked to the
vendor’s performance.
c. IT outsourcing may affect incongruence between a firm’s IT strategic planning and its business
planning functions.
d. The financial justification for IT outsourcing depends upon the vendor achieving economies of
scale.

A

a. When management outsources their organization’s IT functions, they also outsource responsibility
for internal control.

25
Q

Which of the following is not true?
a. Management may outsource their organizations’ IT functions, but they cannot outsource their
management responsibilities for internal control.
b. section 404 requires the explicit testing of outsourced controls.
c. The SAS 70 report, which is prepared by the outsourcer’s auditor, attests to the adequacy of the
vendor’s internal controls.
d. Auditors issue two types of SAS 70 reports: SAS 70 Type I report and SAS 70 Type II report.

A

c. The SAS 70 report, which is prepared by the outsourcer’s auditor, attests to the adequacy of the
vendor’s internal controls.

26
Q

Segregation of duties in the computer-based information system includes
a. separating the programmer from the computer operator
b. preventing management override
c. separating the inventory process from the billing process
d. performing independent verifications by the computer operator

A

a. separating the programmer from the computer operator

27
Q

A disadvantage of distributed data processing is
a. the increased time between job request and job completion.
b. the potential for hardware and software incompatibility among users.
c. the disruption caused when the mainframe goes down.
d. that users are not likely to be involved.

A

b. the potential for hardware and software incompatibility among users.

28
Q

Which of the following is NOT a control implication of distributed data processing?
a. redundancy
b. user satisfaction
c. incompatibility
d. lack of standards

A

b. user satisfaction

29
Q

Which of the following disaster recovery techniques may be least optimal in the case of a disaster?
a. empty shell
b. mutual aid pact
c. internally provided backup
d. they are all equally beneficial

A

b. mutual aid pact

30
Q

Which of the following is a feature of fault tolerance control?
a. interruptible power supplies
b. RAID
c. DDP
d. MDP

A

b. RAID

31
Q

Which of the following disaster recovery techniques is has the least risk associated with it?
a. empty shell
b. ROC
c. internally provided backup
d. they are all equally risky

A

c. internally provided backup

32
Q

Which of the following is NOT a potential threat to computer hardware and peripherals?
a. low humidity
b. high humidity
c. carbon dioxide fire extinguishers
d. water sprinkler fire extinguishers

A

c. carbon dioxide fire extinguishers

33
Q

Which of the following would strengthen organizational control over a large-scale data processing center?
a. Requiring the user departments to specify the general control standards necessary for processing transactions.
b. Requiring that requests and instructions for data processing services be submitted directly to the computer operator in the data center.
c. Having the database administrator report to the manager of computer operations.
d. Assigning maintenance responsibility to the original system designer who best knows its logic.

A

a. Requiring the user departments to specify the general control standards necessary for processing transactions.

34
Q

Which of the following is true?
a. Core competency theory argues that an organization should outsource specific core assets.
b. Core competency theory argues that an organization should focus exclusively on its core business competencies
c. Core competency theory argues that an organization should not outsource specific commodity
assets.
d. Core competency theory argues that an organization should retain certain specific non-core assets
in-house.

A

b. Core competency theory argues that an organization should focus exclusively on its core business competencies