Chapter 4 Self Assessment Flashcards
Which one of the following provides the BEST method for determining the level of performance provided by similar information processing facility environments?
A. User satisfaction
B. Goal accomplishment
C. Benchmarking
D. Capacity and growth planning
C. Benchmarking
For mission critical systems with a low tolerance to interruption and a high cost of recovery, the IS auditor, in principle, recommends the use of which of the following recovery options?
A. Mobile site
B. Warm site
C. Cold site
D. Hot site
D. Hot site
Which of the following is the MOST effective method for an IS auditor to use in testing the program change management process?
A. Trace from system-generated information to the change management documentation
B. Examine change management documentation for evidence ofaccuracy
C. Trace from the change management documentation to a system- generated audit trail
D. Examine change management documentation for evidence of
completeness
A. Trace from system-generated information to the change management documentation
Which of the following would allow an enterprise to extend its intranet across the Internet to its business partners?
A. Virtual private network
B. Client-server
C. Dial-up access
D. Network service provider
A. Virtual private network
The classification based on criticality of a software application as part of an IS business continuity plan is determined by the:
A. nature of the business and the value of the application to the business.
B. replacement cost of the application.
C. vendor support available for the application.
D. associated threats and vulnerabilities of the application
A. nature of the business and the value of the application to the business.
When conducting an audit of client-server database security, the IS auditor should be MOST concerned about the availability of:
A. system utilities.
B. application program generators.
C. systems security documentation.
D. access to stored procedures.
A. system utilities.
When reviewing a network used for Internet communications, an IS auditor will FIRST examine the:
A. validity of password change occurrences.
B. architecture of the client-server application.
C. network architecture and design.
D. firewall protection and proxy servers.
C. network architecture and design.
An IS auditor should be involved in:
A. observing tests of the disaster recovery plan.
B. developing the disaster recovery plan.
C. maintaining the disaster recovery plan.
D. reviewing the disaster recovery requirements of supplier contracts.
A. observing tests of the disaster recovery plan.
Data mirroring should be implemented as a recovery strategy when:
A. recovery point objective (RPO) is low.
B. recovery point objective (RPO) is high.
C. recovery time objective (RTO) is high.
D. disaster tolerance is high.
A. recovery point objective (RPO) is low.
Which of the following components of a business continuity plan is
PRIMARILY the responsibility of an organization’s IS department?
A. Developing the business continuity plan
B. Selecting and approving the recovery strategies used in the business continuity plan
C. Declaring a disaster
D. Restoring the IT systems and data after a disaster
D. Restoring the IT systems and data after a disaster
Which of the following is the highest level of incident classification?
a. Major
b. Minor
c. Defined
d. Crisis
d. Crisis
From an audit perspective, what best defines how current the data must be or how much data an organization can afford to lose?
a. RTO
b. RPO
c. MTD
d. WRT
b. RPO
Which of the following specifies the maximum elapsed time to recover an ap- plication at an alternate site?
a. RTO
b. RPO
c. MTD
d. WRT
a. RTO
Which of the following defines the maximum amount of time the organiza- tion can provide services at the alternate site? This value can be determined by items such as contractual values.
a. SDO
b. SLA
c. MTD
d. WRT
c. MTD
Which of the following activities are specifically required for critical processes and produce revenue?
a. Core processing
b. Non-discretionary processes
c. Maximum acceptable outage
d. Supporting processes
a. Core processing
