Practice Exam 2 Flashcards
An information systems (IS) auditor has been asked by management to review a potentially fraudulent transaction. The PRIMARY focus of the IS auditor while evaluating the transaction should be to:
A.maintain impartiality while evaluating the transaction.
B.ensure that the independence of the IS auditor is maintained.
C.ensure that the integrity of the evidence is maintained.
D.assess all relevant evidence for the transaction.
C. The IS auditor has been requested to perform an investigation to capture evidence that may be used for legal purposes, and, therefore, maintaining the integrity of the evidence should be the foremost goal. Improperly handled computer evidence is subject to being ruled inadmissible in a court of law.
An organization is considering using a new IT service provider. From an audit perspective, which of the following is the MOST important item to review?
A.References from other clients for the service provider
B.The physical security of the service provider site
C.The proposed service level agreement (SLA) with the service provider
D.Background checks of the service provider’s employees
C. An SLA is a guarantee that the provider will deliver the services according to the contract. When contracting with a service provider, it is a good practice to enter into an SLA with the provider. The information systems (IS) auditor will want to ensure that performance and security requirements are clearly stated in the SLA.
For which of the following controls would an information systems (IS) auditor look in an environment where duties cannot be appropriately segregated?
A.Overlapping controls
B.Boundary controls
C.Access controls
D.Compensating controls
D. Compensating controls are internal controls that are intended to reduce the risk of an existing or potential control weakness that may arise when duties cannot be appropriately segregated.
An information systems (IS) auditor finds that not all employees are aware of the enterprise’s information security policy. The IS auditor should conclude that:
A.this lack of knowledge may lead to unintentional disclosure of sensitive information.
B.information security is not critical to all functions.
C.IS audit should provide security training to the employees.
D.the audit finding will cause management to provide continuous training to staff.
A. All employees should be aware of the enterprise’s information security policy to prevent unintentional disclosure of sensitive information. Training is a preventive control. Security awareness programs for employees can prevent unintentional disclosure of sensitive information to outsiders.
To ensure that an enterprise is complying with privacy requirements, an information systems (IS) auditor should FIRST review:
A.the IT infrastructure.
B.organizational policies, standards and procedures.
C.legal and regulatory requirements.
D.adherence to organizational policies, standards and procedures.
C. To ensure that the enterprise is complying with privacy issues, an IS auditor should address legal and regulatory requirements first. To comply with legal and regulatory requirements, enterprises need to adopt the appropriate infrastructure. After understanding the legal and regulatory requirements, an IS auditor should evaluate organizational policies, standards and procedures to determine whether they adequately address the privacy requirements, and then review the adherence to these specific policies, standards and procedures.
In a distributed system, which of the following BEST allows different components or modules to communicate and coordinate their activities?
A.Message queue interface
B.Application programming interface (API)
C.Remote procedure call
D.Communication infrastructure interface
B. An application programming interface (API) allows components or modules in a distributed system to communicate and coordinate their activities. An API defines a set of rules and protocols that enable the interaction and exchange of data between software components.
The internal audit department wrote some scripts that are used for continuous auditing. The IT department asked for copies of the scripts so that they can be used for setting up a continuous monitoring process on key systems. Considering the ability of the information systems (IS) auditors to independently and objectively audit the IT function, should sharing these scripts be permitted?
A.Sharing the scripts is not permitted because it gives IT the ability to pre-audit systems and avoid an accurate, comprehensive audit.
B.Sharing the scripts is required because IT must have the ability to review all programs and software that run on information systems regardless of audit independence.
C.Sharing the scripts is permissible if IT recognizes that audits may be conducted in areas not covered in the scripts.
D.Sharing the scripts is not permitted because the IS auditors who wrote the scripts would not be permitted to audit any information systems where the scripts are being used for monitoring.
C. IS audit may not be able to review the effectiveness of the scripts, but it can still audit all aspects of the systems.
Which of the following is the BEST factor for determining the required extent of data collection during the planning phase of an information systems (IS) compliance audit?
A.Complexity of the organization’s operation
B.Findings and issues noted from the prior year
C.Purpose, objective and scope of the audit
D.Auditor’s familiarity with the organization
C. The extent to which data will be collected during an information systems (IS) audit is related directly to the purpose, objective and scope of the audit. An audit with a narrow purpose and limited objective and scope is most likely to result in less data collection than an audit with a wider purpose and scope. Statistical analysis may also determine the extent of data collection, such as sample size or means of data collection.
The PRIMARY purpose for meeting with auditees prior to formally closing a review is to:
A.confirm that the auditors did not overlook any important issues.
B.gain agreement on the findings.
C.receive feedback on the adequacy of the audit procedures.
D.test the structure of the final presentation.
B. The primary purpose for meeting with auditees prior to formally closing a review is to gain agreement on the findings and responses from management.
Which of the following would be MOST appropriate for helping to detect sensitive information that is stored on the enterprise hard drive(s) with inappropriate authorization or security controls?
A.intrusion detection system (IDS)
B.data loss prevention (DLP)
C.intrusion prevention system (IPS)
D.Transport Layer Security (TLS)
B. Data loss prevention (DLP) systems identify sensitive information stored on endpoint systems or in transit over a network.
Which of the following is the BEST reason to implement a policy that places conditions on secondary employment for IT employees?
A.To prevent the misuse of corporate resources
B.To prevent conflicts of interest
C.To prevent employee performance issues
D.To prevent theft of IT assets
B. The best reason to implement and enforce a policy governing secondary employment is to prevent conflicts of interest. Policies should be in place to control IT employees seeking secondary employment from releasing sensitive information or working for a competing organization. Conflicts of interest can result in serious risk, such as fraud, theft of intellectual property or other improprieties.
Which of the following statements is useful while drafting a disaster recovery plan (DRP)?
A.Downtime costs decrease as the recovery point objective (RPO) increases.
B.Downtime costs increase with time.
C.Recovery costs are independent of time.
D.Recovery costs can only be controlled on a short-term basis.
B. Downtime costs—such as loss of sales, idle resources and salaries—increase with time. A disaster recovery plan (DRP) should be drawn up to achieve the lowest downtime costs possible.
The purpose of a checksum on an amount field in an electronic data interchange communication of financial transactions is to ensure:
A.integrity.
B.authenticity.
C.authorization.
D.nonrepudiation.
A. A checksum that is calculated on an amount field and included in the electronic data interchange communication can be used to identify unauthorized modifications.
What kind of software application testing is considered the final stage of testing and typically includes users outside of the development team?
A.Alpha testing
B.White box testing
C.Regression testing
D.Beta testing
D. Beta testing is the final stage of testing and typically includes users outside of the development area. Beta testing is a form of user acceptance testing and generally involves a limited number of users who are external to the development effort.
What is the MAJOR benefit of conducting a control self-assessment (CSA) over a traditional audit?
A.It detects risk sooner.
B.It replaces the internal audit function.
C.It reduces the audit workload.
D.It reduces audit resource requirements.
A. Control self-assessments (CSAs) require employees to assess the control stature of their own function. CSAs help to increase the understanding of business risk and internal controls. Because they are conducted more frequently than audits, CSAs help to identify risk in a timelier manner.
An enterprise discovers that the computer of the chief financial officer has been infected with malware that includes a keystroke logger and a rootkit. The FIRST action to take is to:
A.contact the appropriate law enforcement authorities to begin an investigation.
B.immediately ensure that no additional data are compromised.
C.disconnect the PC from the network.
D.update the antivirus signature on the PC to ensure that the malware or virus is detected and removed.
C. The most important task is to prevent further data compromise and preserve evidence by disconnecting the computer from the network.
An information systems (IS) auditor is reviewing system development for a health care organization with two application environments—production and test. During an interview, the auditor notes that production data are used in the test environment to test program changes. What is the MOST significant potential risk from this situation?
A.The test environment may not have adequate controls to ensure data accuracy.
B.The test environment may produce inaccurate results due to use of production data.
C.Hardware in the test environment may not be identical to the production environment.
D.The test environment may not have adequate access controls implemented to ensure data confidentiality.
D. In many cases, the test environment is not configured with the same access controls that are enabled in the production environment. For example, programmers may have privileged access to the test environment (for testing purposes), but not to the production environment. If the test environment does not have adequate access control, the production data are subject to risk of unauthorized access and/or data disclosure. This is the most significant risk of the choices listed and is especially important in a health care organization where patient data confidentiality is critical and privacy laws in many countries impose strict penalties on misuse of these data.
Which of the following is a prevalent risk in the development of end-user computing applications?
A.Applications may not be subject to testing and IT general controls.
B.Development and maintenance costs may be increased.
C.Application development time may be increased.
D.Decision-making may be impaired due to diminished responsiveness to requests for information.
A. End-user computing is defined as the ability of end users to design and implement their own information system using computer software products. End-user developed applications may not be subjected to an independent outside review by systems analysts and frequently are not created in the context of a formal development methodology. These applications may lack appropriate standards, controls, quality assurance procedures and documentation. A risk of end-user applications is that management may rely on them as much as traditional applications.
An information systems (IS) auditor is developing an audit plan for an environment that includes new systems. Enterprise management wants the IS auditor to focus on recently implemented systems. How should the IS auditor respond?
A.Audit the new systems as requested by management.
B.Audit systems not included in last year’s scope.
C.Determine the highest-risk systems and plan accordingly.
D.Audit systems not in last year’s scope and the new systems.
C. The best action is to conduct a risk assessment and design the audit plan to cover the areas of highest risk. ISACA IS Audit and Assurance Standard 1201 (Risk Assessment in Planning), statement 1201.1: “The IT audit and assurance function shall use an appropriate risk assessment approach (i.e., data-driven with both quantitative and qualitative factors) and supporting methodology to develop the overall IT audit plan and to determine priorities for the effective allocation of IT audit resources.”
An enterprise’s IT director approved the installation of a wireless local area network (WLAN) access point in a conference room for a team of consultants to access the Internet with their laptop computers. The BEST control to protect the corporate servers from unauthorized access is to ensure that:
A.encryption is enabled on the access point.
B.the conference room network is on a separate virtual local area network (VLAN).
C.antivirus signatures and patch levels are current on the consultants’ laptops.
D.default user IDs are disabled and strong passwords are set on the corporate servers.
B. The installation of the wireless network device presents risk to the corporate servers from authorized and unauthorized users. A separate virtual local area network (VLAN) is the best solution because it ensures that authorized and unauthorized users are prevented from gaining network access to database servers, while allowing Internet access to authorized users.
An information systems (IS) auditor reviewing wireless network security determines that the Dynamic Host Configuration Protocol is disabled at all wireless access points. This practice:
A.reduces the risk of unauthorized access to the network.
B.is not suitable for small networks.
C.automatically provides an internet protocol (IP) address to anyone.
D.increases the risk associated with Wireless Encryption Protocol.
A. Dynamic Host Configuration Protocol (DHCP) automatically assigns internet protocol (IP) addresses to anyone connecting to the network. With DHCP disabled, static IP addresses must be used, and this requires either administrator support or a higher level of technical skill to attach to the network and gain Internet access.
Applying a retention date on a file will ensure that:
A.data cannot be read until the date is set.
B.data will not be deleted before that date.
C.backup copies are not retained after that date.
D.datasets having the same name are differentiated.
B. A retention date ensures that a file cannot be overwritten or deleted before that date has passed.
When reviewing an enterprise’s preventive maintenance process for systems at a data center, what is the MOST important practice that should be in place for an information systems (IS) auditor to be able to ensure that adequate maintenance is being performed on all critical computing, power and cooling systems?
A.Proper background checks on all service personnel are conducted.
B.Service personnel are escorted at all times when performing their work.
C.Maintenance is scheduled during noncritical processing times.
D.Verification of maintenance being performed is done independently.
D. Independent verification confirms documented maintenance activities, ensuring their effectiveness in sustaining critical systems. It provides assurance and detects any maintenance process gaps or deficiencies.
Which of the following BEST helps to prioritize project activities and determine the timeline for a project?
A.Gantt chart
B.Earned value analysis
C.Program evaluation review technique (PERT)
D.Function point analysis
C. The PERT method works on the principle of obtaining project timelines based on project events for three likely scenarios—worst, best and normal. The timeline is calculated by a predefined formula and identifies the critical path, which identifies the key activities that must be prioritized.
From a control perspective, the key element in job descriptions is that they:
A.provide instructions on how to do the job and define authority.
B.are current, documented and readily available to the employee.
C.communicate management’s specific job performance expectations.
D.establish responsibility and accountability for the employee’s actions.
D. From a control perspective, a job description should establish responsibility and accountability. This aids in ensuring that users are given system access in accordance with their defined job responsibilities and are accountable for how they use that access.
Which of the following considerations is the MOST important while evaluating a business case for the acquisition of a new accounting application?
A.Total cost of ownership of the application
B.The resources required for implementation
C.Return on investment (ROI) for the enterprise
D.The cost and complexity of security requirements
C. The proposed ROI benefits, and targets or metrics that can be measured, are the most important aspects of a business case. While reviewing the business case, it should be verified that the proposed ROI is achievable, does not make unreasonable assumptions and can be measured for success. (Benefits realization should look beyond project cycles to longer-term cycles that consider the total benefits and total costs throughout the life of the new system.)
Which of the following sampling methods is MOST useful when testing for compliance?
A.Attribute sampling
B.Variable sampling
C.Stratified mean-per-unit sampling
D.Difference estimation sampling
A. Attribute sampling is the primary sampling method used for compliance testing. Attribute sampling is a sampling model that is used to estimate the rate of occurrence of a specific quality (attribute) in a population and is used in compliance testing to confirm whether the quality exists. For example, an attribute sample may check all transactions over a certain predefined dollar amount for proper approvals.
An information systems (IS) auditor needs to review the procedures used to restore a software application to its state prior to an upgrade. Therefore, the auditor needs to assess the following:
A.Problem management procedures
B.Software development procedures
C.Back-out procedures
D.Incident management procedures
C. Back-out procedures are used to restore a system to a previous state and are an important element of the change control process. The other choices are not related to the change control process, which specifies what procedures should be followed when software is being upgraded but does not work and requires a fallback to its former state.
Which of the following is the BEST method for determining the criticality of each application system in the production environment?
A.Interview the application programmers.
B.Perform a gap analysis.
C.Review the most recent application audits.
D.Perform a business impact analysis (BIA).
D. A business impact analysis (BIA) gives the impact of the loss of each application. A BIA is conducted with representatives of the business that can accurately describe the criticality of a system and its importance to the business.
An information systems (IS) auditor is reviewing a contract management process to determine the financial viability of a software vendor for a critical business application. An IS auditor should determine whether the vendor being considered:
A.can deliver on the immediate contract.
B.is of similar financial standing as the organization.
C.has significant financial obligations that can impose liability to the organization.
D.can support the organization in the long term.
D. The long-term financial viability of a vendor is essential for deriving maximum value for the organization—it is more likely that a financially sound vendor will be in business for a long period of time and thereby more likely to be capable of providing long-term support for the purchased product.
