Chapter 3 Flashcards
The computer’s control program.
Operating System
Common computer resources includes:
a. processors
b. main memory
c. databases
d. printers
e. AOTA
e. AOTA
The larger the computer facility, the greater the scale of potential damage.
TRUE
High-level languages:
a. COBOL
b. C++
c. BASIC
d. SQL
e. AOTA
e. AOTA
The language translator modules of the operating system.
a. compilers and interpreters
b. controllers and interpreters
c. compilers and translators
d. controllers and translators
e. NOTA
a. compilers and interpreters
The operating system’s first line of defense against unauthorized access.
a. access control list
b. access token
c. log-on procedure
d. discretionary access privilege
e. NOTA
c. log-on procedure
Contains key information about the user, including user ID, password, user group, and privileges granted to the user.
a. access control list
b. access token
c. log-on procedure
d. discretionary access privilege
e. NOTA
b. access token
Assigned to each IT resource which controls access to the resources.
a. access control list
b. access token
c. log-on procedure
d. discretionary access privilege
e. NOTA
a. access control list
Allows resource owners to grant access privileges to other users.
a. access token
b. discretionary access privileges
c. access control list
d. log-on procedure
e. NOTA
b. discretionary access privileges
Intentional threats include hardware failures that cause the operating system to crash.
FALSE. Accidental threats
Exposures to intentional threats come from three sources which includes:
a. Privilege personnel who abuse their authority
b. Individuals who browse the operating system to identify and exploit security flaws
c. Individuals who intentionally insert computer viruses or other forms of destructive programs into the operating system
d. AOTA
e. NOTA
d. AOTA
The auditor’s objective is to verify that access privileges are granted in a manner that is consistent with the need to separate incompatible functions and is in accordance with the organization’s policy.
Audit Objective Relating to Access Privileges
A secret code the user enters to gain access to systems, applications, data files, or a network server.
Password
The most common forms of contra security behavior includes
a. the Post-it Syndrome
b. failing to change passwords on a frequent basis
c. forgetting passwords and being locked out of the system
d. simplistic passwords that a computer criminal easily anticipates
e. AOTA
e. AOTA
The most common method of password control.
Reusable Passwords
Under this approach the users password changes continuously.
One-Time Passwords (OTP)
The auditor’s objective is to verify that effective management policies and procedures are in place to prevent the introduction and spread of destructive programs including viruses, worms, back doors, logic bombs, and Trojan horses.
Audit Objective Relating to Viruses and Other Destructive Programs
Logs that record activity at the system, application, and user level.
System Audit Trail Control
Two types of audit logs
- Detailed logs of individual keystrokes
- Event-oriented logs
Which of the following is true about keystroke monitoring?
a. It involves recording both the user’s keystrokes and the system’s responses.
b. It may be used after the fact to reconstruct the details of an event or as a real-time control to prevent unauthorized intrusion.
c. It is the computer equivalent of a telephone wiretap.
d. AOTA
e. NOTA
d. AOTA
Summarizes key activities related to system resources.
Event Monitoring
Event logs typically record the:
a. ID’s of all users accessing the system
b. the time and duration of a user’s session
c. programs that were executed during a session
d. and the files, databases, printers, and other resources accessed
e. AOTA
e. AOTA
Audit trails can be used to support the following security objectives except:
a. Detecting an authorized access to the system
b. Promoting personal accountability
c. Facilitating the reconstruction of events
d. NOTA
d. NOTA
The COSO framework consists of five components.
- the control environment
- risk assessment
- information and communication
- monitoring
- control activities.
It is the foundation for the other four control components which sets the tone for the organization and influences the control awareness
of its management and employees.
a. the control environment
b. risk assessment
c. information and communication
d. monitoring
e. control activities
a. the control environment
