GTG FoR IT

Question 1

WHAT is the role of the Systems Analyst?

Answer 1

(1) Designing systems
(2) Preparing specifications for programmers; and
(3) Serving as intermediary between users and programmers

NOTE: Analysts and Programmers should NEVER be able to make changes directly to programs that are used in “live” production

Question 2

WHAT is an example of data security control?

Answer 2

Ensuring that storage media are subject to authorization prior to access, change, or destruction

Question 3

WHAT is an advantage of a computer-based system over a manual-system?

Answer 3

THE Computer-based system will be more efficient at producing financial statements

i.e. the computer-based system can perform complex calculations in high volume

Question 4

WHAT is a key difference in controls when changing from a manual system to a computer system?

Answer 4

THE Methodologies for implementing controls change

i.e. THE design and implementation are different in a computerized system compared to the manual one

Question 5

WHAT is a likely disadvantage for a company that keeps data files prepared by personal computers rather than manually prepared files?

Answer 5

IT is usually easier for unauthorized persons to access and alter the files

Question 6

WHAT would be considered “General” Controls?

Answer 6

Developing, modifying, and maintaining computer programs

i.e. General controls are policies and procedures that relate to the entity’s overall IT environment

Question 7

WHAT is a validity check?

Answer 7

Tests of identification numbers or transaction codes for validity by comparison with items already known to be correct or authorized

e.g. Social Security numbers on payroll input records can be compared with Social Security numbers authorized by the personnel department

Question 8

WHAT is a console log?

Answer 8

A log of activities of the computer system and the actions taken by the computer operator

i.e. IT can tell a computer operator whether a job had already been run that day

Question 9

WHAT is a proxy-server?

Answer 9

A firewall system that limits access to a computer by routing users to replicated Web pages

i.e. IT maintains copies of web pages to be accessed by specified users

Question 10

WHAT are Parity and Echo Checks examples of?

Answer 10

Hardware Controls

i. e. these controls are built into equipment by manufacturers
- THEY ensure the proper internal handling of data as they are moved and stored

Question 11

WHAT is a Logic Test?

Answer 11

A type of application control that confirms if input value is appropriate

e.g., a letter cannot appear in a field that should be a number

Question 12

WHAT is considered a significant function of Hardware Controls?

Answer 12

THEY ensure the proper execution of machine instructions

Question 13

WHAT are Preventive Controls in an IT environment?

Answer 13

Measures taken in advance so that anticipated problems associated with performance of an activity will not occur

Question 14

WHAT would be considered a policy used to protect a company’s vital information resources from computer viruses?

Answer 14

Prudent management procedures

**instituted in conjunction with technological safeguards

Question 15

WHAT is an example of a computer program that appears legitimate BUT performs illicit activities when ran?

Answer 15

A Trojan Horse

e.g. A computer game that contains an application destructive to the computer system

Question 16

WHO within a company maintains custody of its data?

Answer 16

The Data Librarian

i.e. THEY maintain control over and accountability for documentation, programs, and data storage media

Question 17

WHAT is a control that most likely could prevent computer personnel from modifying programs to bypass programmed controls?

Answer 17

Segregation of duties for computer programming and operations

i.e. Programmers and analysts have the ability to modify programs, data files and controls

Thus, they should have no access to programs used to process transactions

Question 18

WHAT type of validation routine is not likely to be appropriate in a real-time operation?

Answer 18

Sequence Checks

i.e. This control would NOT apply in a real-time operation because records are not processed sequentially

Question 19

WHAT are some “enablers” of the COBIT 5 framework?

Answer 19

Information and organizational structures

i.e. THEY support comprehensive IT governance and management

Question 20

WHAT would be considered a Distributed Denial-of-Service attack?

Answer 20

Computers of innocent parties infected with Trojan horse programs