Exam 2 Flashcards
Which of the following is the MOST efficient and sufficiently reliable way to test the design effectiveness of a change control process?
A) Interview personnel in charge of the change control process
B) Perform an end-to-end walk- through of the process
C) Test a sample of authorized changes
D) Test a sample population of change requests
B) Perform an end-to-end walk- through of the process
An organization provides information to its supply chain partners and customers through an extranet infrastructure. Which of the following should be the GREATEST concern to an IS auditor reviewing the firewall security architecture?
A) Inbound traffic is blocked unless the traffic type and connections have been specifically permitted.
B) A Secure Sockets Layer has been implemented for user authentication and remote administration of the firewall.
C) The firewall is placed on top of the commercial operating system with all default instillation options.
D) Firewall policies are updated on the basis of changing requirements
C) The firewall is placed on top of the commercial operating system with all default instillation options.
Which of the following choices would be the BEST source of information when developing a risk- based audit plan?
A) System custodians identify vulnerabilities.
B) Process owners identify key controls.
C) Senior management identify key business processes.
D) Peer auditors understand previous audit results.
C) Senior management identify key business processes.
Which of the following inputs adds the MOST value to the strategic IT initiative decision-making process?
A)The maturity of the project management process
B) The regulatory environment
C) Past audit findings
D) The IT project portfolio analysis
D) The IT project portfolio analysis
The implementation of which of the following would MOST effectively prevent unauthorized access to a system administration account on a web server?
A) Password expiration and lockout policy
B) Password complexity rules
C) Host intrusion detection software installed on a server
D) Two-factor authentication
D) Two-factor authentication
Which of the following should be included in an organization’s information security policy?
A) The basis for access control authorization
B) Relevant software security features
C) A list of key IT resources to be secured
D) Identity of sensitive security assets
A) The basis for access control authorization
Which of the following types of testing would determine whether a new or modified system can operate in its target environment without adversely impacting other existing systems?
A) Parallel testing
B) Interface/integration testing
C) Sociability testing
D) Pilot testing
C) Sociability testing
An IS auditor finds that not all employees are aware of the enterprise’s information security policy. The IS auditor should conclude that:
A) Information security is not critical to all functions.
B) IS audit should provide security training to the employees.
C) this lack of knowledge may read to unintentional disclosure of sensitive information.
D) The audit finding will cause management to provide continuous training to staff.
C) this lack of knowledge may read to unintentional disclosure of sensitive information.
The PRIMARY objective of performing a post incident review is that it presents an opportunity to
A) improve internal control procedures.
B) highlight the importance of incident response management to management.
C) improve employee awareness of the incident response process.
D) harden the network to industry good practices.
A) improve internal control procedures.
While reviewing the IT governance processes of an organization, an IS auditor discovers the firm has recently implemented an IT balanced scorecard (BSC). The implementation is complete; however, the IS auditor notices that performance indicators are not objectively measurable. What is the PRIMARY risk presented by this situation?
A) IT projects could suffer from cost overruns
B) Misleading indications of IT performance may be presented to management.
C) Key performance indicators are not reported to management and management cannot determine the effectiveness of the BSC.
D) IT service level agreements may not be accurate.
B) Misleading indications of IT performance may be presented to management.
Which of the following is the BEST criterion for evaluating the adequacy of an organization’s security awareness program?
A) No actual incidents have occurred that have caused a loss or a public embarrassment.
B) Job descriptions contain clear statements of accountability for information security.
C) In accordance with the degree of risk and business impact, there is adequate funding for security efforts.
D) Senior management is aware of critical information assets and demonstrates an adequate concern for their protection.
B) Job descriptions contain clear statements of accountability for information security.
As result of profitability pressure, senior management of an enterprise decided to keep investments in information security at an inadequate level, which of the following is the BEST recommendation of an IS auditor?
A) Revise compliance enforcement processes.
B) Request that senior management accepts the risk.
C) Use cloud providers for low-risk operations.
D) Postpone low-priority security procedures.
B) Request that senior management accepts the risk.
During the course of an application software review, an IS auditor identified minor weaknesses in a relevant database environment that is out of scope for the audit. The BEST option is to:
A) document for future review.
B) work with database administrators to correct the issue.
C) report the weaknesses as observed.
D) include a review of the database controls in the scope.
C) report the weaknesses as observed.
For the annual internal IS audit plan, which of the following is the FIRST step performed prior to creating a risk ranking?
A) Prioritize the identified risk.
B) Identify the critical controls.
C) Determine the testing approach.
D) Define the audit universe.
C) Determine the testing approach.
An Internet-based attack using password sniffing can:
A) be used to gain access to systems containing proprietary information.
B) enable one party to act as if they are another party.
C) result in major problems with billing systems and transaction processing agreements.
D) cause modification to the contents of certain transactions.
A) be used to gain access to systems containing proprietary information.
Which of the following BEST helps an IS auditor evaluate the quality of programming activities related to future maintenance capabilities?
A) Program coding standards
B) The development environment
C) A version control system
D) The programming language
A) Program coding standards
An IS auditor reviewing access controls for a client-server environment should FIRST:
A) review the application-level access controls.
B) identify the network access points.
C) review the identity management system.
D) evaluate the encryption technique.
B) identify the network access points.
A centralized antivirus system determines whether each personal computer has the latest signature files and installs the latest signature files before allowing a PC to connect to the network. This is an example of a:
A) corrective control.
B) directive control.
C) compensating control.
D)detective control.
A) corrective control.
Which of the following is the MOST secure way to remove data from obsolete magnetic tapes during a disposal?
A) Initializing the tape labels
B) Erasing the tapes
C) Overwriting the tapes
D)Degaussing the tapes
D)Degaussing the tapes
An IS auditor reviewing the authentication controls of an organization should be MOST concerned if:
A) passwords can be reused by employees within a defined time frame.
B) user accounts are not locked out after five failed attempts.
C) system administrators use shared login credentials.
D) password expiration is not automated.
C) system administrators use shared login credentials.
During the review of a biometrics system operation, an IS auditor should FIRST review the stage of:
A) identification
B) storage
C) verification
D) enrollment
D) enrollment
A key IT systems developer has suddenly resigned from an enterprise. Which of the following will be the MOST important action?
A) Set up an exit interview with human resources.
B) Ensure that management signs off on the termination paperwork.
C) Terminate the developer’s logical access to IT resources.
D)Initiate the handover process to ensure continuity of the project.
C) Terminate the developer’s logical access to IT resources.
Which of the following is the BEST way for an IS auditor to determine the effectiveness of a security awareness and training program?
A) Ask the security administrator.
B) Interview a sample of employees.
C) Review the security training program.
D) Review the security reminders to employees.
B) Interview a sample of employees.
In the planning phase of an IS audit, which of the following is the MAIN reason to perform a risk assessment?
A) To ensure management’s concerns are addressed
B) To develop the audit program and procedures to perform the audit
C) To provide reasonable assurance material items will be addressed
D) To ensure the audit team will perform audits within budget
C) To provide reasonable assurance material items will be addressed
Normally, it would be essential to involve which of the following stakeholders in the initiation stage of a project?
A) System builders
B) System designers
C) System users
D) System owners
D) System owners
An IS auditor needs to review the procedures used to restore a software application to its state prior to an upgrade. Therefore, the auditor needs to assess:
A) backout procedures.
B) problem management procedures.
C) incident management procedures.
D) software development procedures.
A) backout procedures.
An IS auditor is reviewing access to an application to determine whether recently added accounts were appropriately authorized. This is an example of -
A) variable sampling.
B) stop-or-go sampling.
C) compliance testing.
D) substantive testing.
C) compliance testing.
The IS management of a multinational company is considering upgrading its existing virtual private network to support Voice-over Internet Protocol communication via tunneling. Which of the following considerations should be PRIMARILY addressed?
A) Means of authentication
B) Privacy of voice transmissions
C) Reliability and quality of service
D) Confidentiality of data transmissions
C) Reliability and quality of service
While performing an audit of an accounting application’s internal data integrity controls, an IS auditor identifies a major control deficiency in the change management software supporting the accounting application. The MOST appropriate action for the IS auditor to take is to:
A) continue to test the accounting application controls and include the deficiency in the final report.
B) continue to test the accounting application controls and inform the IT manager about the control deficiency and recommend possible solutions.
C) complete the audit and not report the control deficiency because it is not part of the audit scope.
D) cease all audit activity until the control deficiency is resolved
A) continue to test the accounting application controls and include the deficiency in the final report.
Business units are concerned about the performance of a newly implemented system. Which of the following should an IS auditor recommend?
A) Implement the changes users have suggested.
B) Develop a baseline and monitor system usage.
C) Prepare the maintenance manual.
D) Define alternate processing procedures.
B) Develop a baseline and monitor system usage.
An IS auditor should recommend the use of library control software to provide reasonable assurance that:
A) modified programs are automatically moved to production.
B) only thoroughly tested programs are released.
C) program changes have been authorized.
D) source and executable code integrity is maintained.
C) program changes have been authorized.
Which of the following is the MOST effective control over visitor access to a data center?
A) Visitors sign in.
B) Visitor badges are required.
C) Visitors are spot-checked by operators.
D) Visitors are escorted.
D) Visitors are escorted
The PRIMARY benefit of an IT manager monitoring technical capacity is to:
A) identify the need for new hardware and storage procurement.
B) ensure that the service level requirements are met.
C) determine the future capacity need based on usage.
D) ensure that systems operate at optimal capacity.
B) ensure that the service level requirements are met
An IS auditor reviewing the IT organization is MOST concerned if the IT steering committee:
A) reports the status of IT projects to the board of directors.
B) is responsible for project approval and prioritization.
C) is responsible for determining business goals.
D) is responsible for developing the long-term IT plan.
C) is responsible for determining business goals.
Which of the following should be considered FIRST when implementing a risk management program?
A) An understanding of the organization’s threat, vulnerability and risk profile
B) A determination of risk management priorities that are based on potential consequences
C) A risk mitigation strategy sufficient to keep risk consequences at an acceptable level
D) An understanding of the risk exposures and the potential consequences of compromise
A) An understanding of the organization’s threat, vulnerability and risk profile
During a system development life cycle audit of a human resources and payroll application, the IS auditor notes that the data used for user acceptance testing have been masked. The purpose of masking the data is to ensure the:
A) reliability of the data.
B) accuracy of the data.
C) completeness of the data.
D) confidentiality of the data.
D) confidentiality of the data.
To gain an understanding of the effectiveness of an organization’s planning and management of investments in IT assets, an IS auditor should review the:
A) IT organizational structure.
B) historical financial statements.
C) enterprise data model.
D) IT balanced scorecard.
D) IT balanced scorecard.
The use of residual biometric information to gain unauthorized access is an example of which of the following attacks?
A) Mimic
B) Cryptographic
C) Replay
D) Brute force
C) Replay
Which of the following intrusion detection systems will MOST likely generate false alarms resulting from normal network activity?
A) Host-based
B) Signature-based
C) Neural network
D) Statistical-based
D) Statistical-based
Which of the following exposures associated with the spooling of sensitive reports for offline printing should an IS auditor consider to be the MOST serious?
A) Unauthorized report copies might be printed.
B) Sensitive data might be read by operators.
C) Output might be lost in the event of system failure.
D) Data might be amended without authorization.
A) Unauthorized report copies might be printed.
An organization allows for the use of universal serial bus drives to transfer operational data between offices. Which of the following is the GREATEST risk associated with the use of these devices?
A) Files are not backed up
B) Use of the devices for personal purposes
C) Theft of the devices
D) Introduction of malware into the network
C) Theft of the devices
Due to resource constraints, a developer requires full access to production data to support certain problems reported by production users. Which of the following choices would be a good compensating control for controlling unauthorized changes in production?
A) Back up all affected records before allowing the developer to make production changes.
B) Provide and monitor separate developer login IDs for programming and for production support.
C) Capture activities of the developer in the production environment by enabling detailed audit trails.
D) Ensure that all changes are approved by the change manager prior to implementation.
B) Provide and monitor separate developer login IDs for programming and for production support
hich of the following would an IS auditor consider to be MOST helpful when evaluating the effectiveness and adequacy of a preventive computer maintenance program?
A) Regularly scheduled maintenance log
B) A system downtime log
C) Vendors’ reliability figures
D) A written preventive maintenance schedule
B) A system downtime log
The PRIMARY purpose of a post- implementation review is to ascertain that:
A) future enhancements can be identified.
B) the lessons learned have been documented.
C) the project has been delivered on time and budget.
D) project objectives have been met.
D) project objectives have been met.
Which of the following reasons BEST describes the purpose of a mandatory vacation policy?
A) To identify potential errors or inconsistencies in business processes
B) To be used as a cost-saving measure
C) To ensure that employees are properly cross-trained in multiple functions
D) To improve employee morale
A) To identify potential errors or inconsistencies in business processes
During an audit, the IS auditor notes the application developer also performs quality assurance testing on another application. Which of the following is the MOST important course of action for the auditor?
A) Report the identified condition.
B) Analyze the quality assurance dashboards.
C) Recommend compensating controls.
D) Review the code created by the developer.
A) Report the identified condition.
Which of the following should be developed during the requirements definition phase of a software development project to address aspects of software testing?
A) User acceptance test specifications
B) Detailed test plans
C) Test data covering critical applications
D) Quality assurance test specifications
A) User acceptance test specifications
An IS auditor is performing a review of an organization’s governance model. Which of the following should be of MOST concern to the auditor?
A) The information security policy is not periodically reviewed by senior management.
B) The audit committee did not review the organizations’s global mission statement.
C) A policy ensuring systems are patched in a timely manner does not exist.
D) An organizational policy related to information asset protection does not exist.
A) The information security policy is not periodically reviewed by senior management.
An organization purchased a third-party application and made significant modifications. While auditing the development process for this critical, customer-facing application, the IS auditor noted that the vendor has been in business for only one year. Which of the following helps to mitigate the risk relating to continued application support?
A) A viability study on the vendor
B) A software escrow agreement
C) A contractual agreement for future enhancements
D) Financial evaluation of the vendor
B) A software escrow agreement
The cost of ongoing operations when a disaster recovery plan (DRP) is in place, compared to not having a DRP, will MOST likely:
A) remain the same.
B) decrease.
C) increase.
D) be unpredictable.
C) increase.
An IS auditor has found time constraints and expanded needs to be the root causes for recent violations of corporate data definition standards in a new business intelligence project. Which of the following is the MOST appropriate suggestion for an auditor to make?
A) Enforce standard compliance by adopting punitive measures against violators.
B) Achieve standards alignment through an increase of resources devoted to the project.
C) Delay the project until compliance with standards can be achieved.
D) Align the data definition standards after completion of the project.
B) Achieve standards alignment through an increase of resources devoted to the project.
A characteristic of User Datagram Protocol in network communications is:
A) incompatibility with packet broadcast.
B) packets may arrive out of order.
C) increased communication latency.
D) error correction may slow down processing.
B) packets may arrive out of order.
When reviewing an intrusion detection system, an IS auditor should be MOST concerned about which of the following?
A) Default detection settings
B) Network performance downgrade
C) High number of false- positive alarms
D) Low coverage of network traffic
D) Low coverage of network traffic
An IS auditor reviewing the implementation of an intrusion detection system (IDS) should be MOST concerned if:
A) a signature-based IDS is weak against new types of attacks.
B) IDS sensors are placed outside of the firewall.
C) the IDS is used to detect encrypted traffic.
D) a behavior-based IDS is causing many false alarms.
C) the IDS is used to detect encrypted traffic.
An organization sells books and music online at its secure web site. Transactions are transferred to the accounting and delivery systems every hour to be processed. Which of the following controls BEST ensures that sales processed on the secure web site are transferred to both the delivery and accounting systems?
A) Transaction totals are recorded on a daily basis in the sales systems. Daily sales system totals are aggregated and totaled.
B) Processing systems check for duplicated transaction numbers. If a transaction number is duplicated (already present), it is rejected.
C) Transactions are automatically numerically sequenced. Sequences are checked and gaps in continuity are accounted for.
D) System time is synchronized hourly using a centralized time server. All transactions have a date/time stamp.
C) Transactions are automatically numerically sequenced. Sequences are checked and gaps in continuity are accounted for.
While conducting an IS audit of a service provider for a government program involving confidential information, an IS auditor noted that the service provider delegated a part of the IS work to another subcontractor. Which of the following provides the MOST assurance that the requirements for protecting confidentiality of information are met?
A) Monthly committee meetings include the subcontractor’s IS manager
B) Management reviews weekly reports from the subcontractor
C) Permission is obtained from the government agent regarding the contract
D) Periodic independent audit of the work delegated to the subcontractor
D) Periodic independent audit of the work delegated to the subcontractor
Which of the following is a MAJOR concern during a review of help desk activities?
A) Resolved incidents are closed without reference to end users.
B) A dedicated line is not assigned to the help desk team.
C) Certain calls could not be resolved by the help desk team.
D) The help desk instant messaging has been down for over six months.
A) Resolved incidents are closed without reference to end users.
During the system testing phase of an application development project the IS auditor should review the:
A) error reports.
B) vendor contract.
C) program change requests.
D) conceptual design specifications.
A) error reports.
Which of the following is MOST effective for monitoring transactions exceeding predetermined thresholds?
A) An integrated test facility
B) Regression tests
C) Transaction snapshots
D) Generalized audit software
D) Generalized audit software
Which of the following does an IS auditor consider to be MOST important when evaluating an organization’s IT strategy? That it:
A) supports the business objectives of the organization.
B) does not vary from the IT department’s preliminary budget.
C) was approved by line management.
D) complies with procurement procedures.
A) supports the business objectives of the organization.
