Question 1

In a public key infrastructure (PKI), which of the following may be relied upon to prove that an online transaction was authorized by a specific customer?  Correct A. Nonrepudiation    B. Encryption    C. Authentication    D. Integrity   .

Accepted Answer

You are correct, the answer is A.    A. Nonrepudiation, achieved through the use of digital signatures, prevents the senders from later denying that they generated and sent the message.  B. Encryption may protect the data transmitted over the Internet, but may not prove that the transactions were made.  C. Authentication is necessary to establish the identification of all parties to a communication.  D. Integrity ensures that transactions are accurate but does not provide the identification of the customer

Question 2

Which of the following BEST ensures the integrity of a server\'s operating system (OS)?   A. Protecting the server in a secure location    B. Setting a boot password   Correct C. Hardening the server configuration    D. Implementing activity logging

Accepted Answer

You are correct, the answer is C.    A. Protecting the server in a secure location is a good practice, but does not ensure that a user will not try to exploit logical vulnerabilities and compromise the operating system (OS).  B. Setting a boot password is a good practice, but does not ensure that a user will not try to exploit logical vulnerabilities and compromise the OS.  C. Hardening a system means to configure it in the most secure manner (install latest security patches, properly define access authorization for users and administrators, disable insecure options and uninstall unused services) to prevent nonprivileged users from gaining the right to execute privileged instructions and, thus, take control of the entire machine, jeopardizing the integrity of the OS.  D. Activity logging has two weaknesses in this scenarioâit is a detective control (not a preventive one), and the attacker who already gained privileged access can modify logs or disable them.

Question 3

The IS auditor is reviewing an organization\'s human resources (HR) database implementation. The IS auditor discovers that the database servers are clustered for high availability, all default database accounts have been removed and database audit logs are kept and reviewed on a weekly basis. What other area should the IS auditor check to ensure that the databases are appropriately secured?   A. Database digital signatures   Incorrect B. Database encryption nonces and other variables    C. Database media access control (MAC) address authentication    D. Database initialization parameters

Accepted Answer

You answered B. The correct answer is D.    A. Digital signatures are used for authentication and nonrepudiation, and are not commonly used in databases. As a result, this is not an area in which the IS auditor should investigate.  B. A nonce is defined as a \"parameter that changes over time\" and is similar to a number generated to authenticate one specific user session. Nonces are not related to database security (they are commonly used in encryption schemes).  C. A media access control (MAC) address is the hardware address of a network interface. MAC address authentication is sometimes used with wireless local area network (WLAN) technology, but is not related to database security.  D. When a database is opened, many of its configuration options are governed by initialization parameters. These parameters are usually governed by a file (\"init.ora\" in the case of Oracle DBMS), which contains many settings. The system initialization parameters address many \"global\" database settings, including authentication, remote access and other critical security areas. To effectively audit a database implementation, the IS auditor must examine the database initialization parameters.

Question 4

Which of the following processes will be MOST effective in reducing the risk that unauthorized software on a backup server is distributed to the production server?   A. Manually copy files to accomplish replication.    B. Review changes in the software version control system.   Incorrect C. Ensure that developers do not have access to the backup server.    D. Review the access control log of the backup server.

Accepted Answer

You answered C. The correct answer is B.    A. Even if replication is be conducted manually with due care, there still remains a risk to copying unauthorized software from one server to another.  B. It is common practice for software changes to be tracked and controlled using version control software. An IS auditor should review reports or logs from this system to identify the software that is promoted to production. Only moving the versions on the version control system (VCS) program will prevent the transfer of development or earlier versions.  C. If unauthorized code was introduced onto the backup server by developers, controls on the production server and the software version control system should mitigate this risk.  D. Review of the access log will identify staff access or the operations performed; however, it may not provide enough information to detect the release of unauthorized software.

Question 5

A consulting firm has created a File Transfer Protocol (FTP) site for the purpose of receiving financial data and has communicated the site\'s address, user ID and password to the financial services company in separate email messages. The company is to transmit its data to the FTP site after manually encrypting the data. The IS auditor\'s GREATEST concern with this process is that:  Correct A. the users may not remember to manually encrypt the data before transmission.    B. the site credentials were sent to the financial services company via email.    C. personnel at the consulting firm may obtain access to sensitive data.    D. the use of a shared user ID to the FTP site does not allow for user accountability.

Accepted Answer

You are correct, the answer is A.    A. If the data is not encrypted, an unauthorized external party may download sensitive company data.  B. Even though the possibility exists that the logon information was captured from the emails, data should be encrypted, so the theft of the data would not allow the attacker to read it.  C. Some of the employees at the consulting firm will have access to the sensitive data and the consulting firm must have procedures in place to protect the data.  D. Tracing accountability is of minimal concern compared to the compromise of sensitive data.

Question 6

In the course of performing a risk analysis, an IS auditor has identified threats and potential impacts. Next, the IS auditor should:   A. identify and assess the risk assessment process used by management.    B. identify information assets and the underlying systems.    C. disclose the threats and impacts to management.   Correct D. identify and evaluate the existing controls.

Accepted Answer

You are correct, the answer is D.    A. The review of the risk assessment process should be done at the start of the risk analysis. Because the threats and impact have already been determined, there must already be a risk assessment process in place.  B. It would be impossible to determine impact without first having identified the assets affected; therefore, this must already have been completed.  C. Upon completion of a risk assessment, an IS auditor should describe and discuss with management the threats and potential impacts on the assets as well as recommendations for addressing the risk. However, this cannot be done until the controls have been identified and the likelihood of the threat has been calculated.  D. It is important for an IS auditor to identify and evaluate the existence and effectiveness of existing and planned controls so that the risk level can be calculated after the potential threats and possible impacts are identified.

Question 7

The PRIMARY purpose of an IT forensic audit is:   A. to participate in investigations related to corporate fraud.    B. the systematic collection and analysis of evidence after a system irregularity.    C. to assess the correctness of an organization\'s financial statements.   Incorrect D. to preserve evidence of criminal activity.

Accepted Answer

You answered D. The correct answer is B.    A. Forensic audits are not limited to corporate fraud.  B. The systematic collection and analysis of evidence best describes a forensic audit. The evidence collected could then be analyzed and used in judicial proceedings.  C. Assessing the correctness of an organization\'s financial statements is not the primary purpose of most forensic audits.  D. Forensics is the investigation of evidence related to a crime or misbehavior. Preserving evidence is the forensic process, but not the primary purpose.

Question 8

The sender of a public key would be authenticated by a:   A. certificate revocation list (CRL).    B. digital signature.   Correct C. digital certificate.    D. receiver\'s private key.

Accepted Answer

You are correct, the answer is C.    A. A certificate revocation list (CRL) is the list of certificates that can no longer be trusted.  B. A digital signature is used to ensure integrity of the message being sent and solve the nonrepudiation issue of message origination.  C. A digital certificate is an electronic document that declares a public key holder is who the holder claims to be. The certificates do handle data authentication as they are used to determine who sent a particular message.  D. The sender\'s public key cannot be opened by any key except the sender\'s private key.

Question 9

When performing a review of a business process reengineering (BPR) effort, which of the following choices would be the PRIMARY concern?   A. Controls are eliminated as part of the BPR effort.   Incorrect B. Resources are not adequate to support the BPR process.    C. The audit department is not involved in the BPR effort.    D. The BPR effort includes employees with limited knowledge of the process area.

Accepted Answer

You answered B. The correct answer is A.    A. A primary risk of business process reengineering (BPR) is that controls are eliminated as part of the reengineering effort. This would be the primary concern.  B. The BPR process can be a resource-intensive initiative; however, the more important issue is whether critical controls are eliminated as a result of the BPR effort.  C. While BPR efforts often involve many different business functions, it would not be a significant concern if audit were not involved, and, in most cases, it would not be appropriate for audit to be involved in such an effort.  D. A recommended best practice for BPR is to include individuals from all parts of the enterprise, even those with limited knowledge of the process area. Therefore, this would not be a concern.

Question 10

An IS auditor suspects an incident (attack) is occurring while an audit is being performed on a financial system. What should the IS auditor do FIRST?   A. Request that the system be shut down to preserve evidence.    B. Report the incident to management.    C. Ask for immediate suspension of the suspect accounts.   Incorrect D. Immediately investigate the source and nature of the incident.

Accepted Answer

You answered D. The correct answer is B.    A. The IS auditor should follow the incident response process of the organization. The auditor is not authorized to shut the system down.  B. Reporting the suspected incident to management will help initiate the incident response process, which is the most appropriate action. Management is responsible for making decisions regarding the appropriate response. It is not the IS auditor\'s role to respond to incidents during an audit.  C. The IS auditor is not authorized to lead the investigation or to suspend user accounts. The auditor should report the incident to management.  D. Management is responsible to set up and follow an incident management plan; that is not the responsibility of the IS auditor.

Question 11

Online banking transactions are being posted to the database when processing suddenly comes to a halt. The integrity of the transaction processing is BEST ensured by:   A. database integrity checks.    B. validation checks.    C. input controls.   Correct D. database commits and rollbacks.

Accepted Answer

You are correct, the answer is D.    A. Database integrity checks are important to ensure database consistency and accuracy. These include isolation, concurrency and durability controls, but the most important issue here is atomicityâthe requirement for transactions to complete entirely and commit or else roll back to the last known good point.  B. Validation checks will prevent introduction of corrupt data, but will not address system failure.  C. Input controls are important to protect the integrity of input data, but will not address system failure.  D. Database commits ensure that the data are saved after the transaction processing is completed. Rollback ensures that the processing that has been partially completed as part of the transaction is reversed back and not saved if the entire transaction does not complete successfully.

Question 12

Which of the following would be evaluated as a preventive control by an IS auditor performing an audit?   A. Transaction logs    B. Before and after image reporting   Correct C. Table lookups    D. Tracing and tagging

Accepted Answer

You are correct, the answer is C.    A. Transaction logs are a detective control and provide audit trails.  B. Before and after image reporting makes it possible to trace the impact that transactions have on computer records. This is a detective control.  C. Table lookups are preventive controls; input data are checked against predefined tables, which prevent any undefined data to be entered.  D. Tracing and tagging is used to test application systems and controls, but is not a preventive control in itself.

Question 13

As a driver of IT governance, transparency of IT\'s cost, value and risk is primarily achieved through:  Correct A. performance measurement.    B. strategic alignment.    C. value delivery.    D. resource management.

Accepted Answer

You are correct, the answer is A.    A. Performance measurement includes setting and monitoring measurable objectives of what the IT processes need to deliver (process outcome) and how they deliver it (process capability and performance). Transparency is primarily achieved through performance measurement because it provides information to the stakeholders on how well the enterprise is performing when compared to objectives.  B. Strategic alignment primarily focuses on ensuring linkage of business and IT plans, not on transparency.  C. Value delivery is about executing the value proposition throughout the delivery cycle. Value delivery ensures that IT investments deliver on promised values, but does not ensure transparency of investment.  D. Resource management is about the optimal investment in and proper management of critical IT resources, but does not ensure transparency of IT investments.

Question 14

Which of the following choices is the MOST effective control that should be implemented to ensure accountability for application users accessing sensitive data in the human resource management system (HRMS) and among interfacing applications to the HRMS?   A. Two-factor authentication    B. A digital certificate   Correct C. Audit trails    D. Single sign-on authentication

Accepted Answer

You are correct, the answer is C.    A. Two-factor authentication would enhance security while logging into the human resource management system (HRMS) application; however, it will not establish accountability for actions taken subsequent to login.  B. A digital certificate will also enhance login security to conclusively authenticate users logging into the application. However, it will not establish accountability because user ID and transaction details will not be captured without an audit trail.  C. Audit trails capture which user, at what time, and date, along with other details, has performed the transaction and this helps in establishing accountability among application users.  D. Single sign-on authentication allows users to log in seamlessly to the application, thus easing the authentication process. However, this would also not establish accountability.

Question 15

A decision support system (DSS) is used to help high-level management:   A. solve highly structured problems.    B. combine the use of decision models with predetermined criteria.   Correct C. make decisions based on data analysis and interactive models.    D. support only structured decision-making tasks.

Accepted Answer

You are correct, the answer is C.    A. A decision support system (DSS) is aimed at solving less structured problems.  B. A DSS combines the use of models and analytic techniques with traditional data access and retrieval functions, but is not limited by predetermined criteria.  C. A DSS emphasizes flexibility in the decision-making approach of management through data analysis and the use of interactive models, not fixed criteria.  D. A DSS supports semistructured decision-making tasks.

Question 16

A retail outlet has introduced radio frequency identification (RFID) tags to create unique serial numbers for all products. Which of the following is the PRIMARY concern associated with this initiative?   A. Issues of privacy   Incorrect B. Wavelength can be absorbed by the human body    C. RFID tags may not be removable    D. RFID eliminates line-of-sight reading

Accepted Answer

You answered B. The correct answer is A.    A. The purchaser of an item will not necessarily be aware of the presence of the tag. If a tagged item is paid for by credit card, it would be possible to tie the unique ID of that item to the identity of the purchaser. Privacy violations are a significant concern because radio frequency identification (RFID) can carry unique identifier numbers. If desired, it would be possible for a firm to track individuals who purchase an item containing an RFID.  B. That wavelength can be absorbed by the human body is a concern of less importance.  C. That RFID tags may not be removable is a concern of less importance than the violation of privacy.  D. RFID eliminates line-of-sight reading. This is a benefit of RFID, not a concern.

Question 17

An IS auditor discovers that developers have operator access to the command line of a production environment operating system. Which of the following controls would BEST mitigate the risk of undetected and unauthorized program changes to the production environment?   A. Commands typed on the command line are logged.   Correct B. Hash keys are calculated periodically for programs and matched against hash keys calculated for the most recent authorized versions of the programs.    C. Access to the operating system command line is granted through an access restriction tool with preapproved rights.    D. Software development tools and compilers have been removed from the production environment.

Accepted Answer

You are correct, the answer is B.    A. Having a log is not a control; reviewing the log is a control.  B. The matching of hash keys over time would allow detection of changes to files.  C. Because the access was already granted at the command line level, it will be possible for the developers to bypass the control.  D. Removing the tools from the production environment will not mitigate the risk of unauthorized activity by the developers.

Question 18

An IS auditor is reviewing a manufacturing company and finds that mainframe users at a remote site connect to the mainframe at headquarters over the Internet via Telnet. Which of the following is the BEST recommendation to ensure proper security controls?  Correct A. Use of a point-to-point leased line    B. Use of a firewall rule to allow only the Internet protocol (IP) address of the remote site    C. Use of two-factor authentication    D. Use of a nonstandard port for Telnet

Accepted Answer

You are correct, the answer is A.    A. A leased line will effectively extend the local area network (LAN) of the headquarters to the remote site, and the mainframe Telnet connection would travel over the private line, which would be less of a security risk when using an insecure protocol such as Telnet.  B. A firewall rule at the headquarters network to only allow Telnet connections from the Internet protocol (IP) address assigned to the remote site would make the connection more secure; however, there is the possibility that the source address could be spoofed by an attacker and, therefore, a dedicated leased line would be more secure.  C. While two-factor authentication would enhance the login security, it would not secure the transmission channel against eavesdropping, and, therefore, a leased line would be a better option.  D. Attacks on network services start with the assumption that network services use the standard transmission control protocol (TCP)/IP port number assigned for the service, which is port 23 for Telnet. By reconfiguring the host and client, a different port can be used. Assigning a nonstandard port for services is a good general security practice because it makes it more difficult to determine what service is using the port; however, in this case, creating a leased-line connection to the remote site would be a better solution.

Question 19

During which of the following phases in system development would user acceptance test plans normally be prepared?   A. Feasibility study   Correct B. Requirements definition    C. Implementation planning    D. Postimplementation review

Accepted Answer

You are correct, the answer is B.    A. The feasibility study is too early for such detailed user involvement.  B. During requirements definition, the project team will be working with the users to define their precise objectives and functional needs. At this time, the users should be working with the team to consider and document how the system functionality can be tested to ensure that it meets their stated needs. An IS auditor should know at what point user testing should be planned to ensure that it is most effective and efficient.  C. The implementation planning phase is when the tests are conducted. It is too late in the process to develop the test plan.  D. User acceptance testing should be completed prior to implementation.

Question 20

The MOST important point of consideration for an IS auditor while reviewing an enterprise\'s project portfolio is that it:   A. does not exceed the existing IT budget.    B. is aligned with the investment strategy.    C. has been approved by the IT steering committee.   Correct D. is aligned with the business plan.

Accepted Answer

You are correct, the answer is D.    A. It should be identified if the project portfolio exceeds the IT budget, but it is not as critical as ensuring that it is aligned with the business plan.  B. The project portfolio should be aligned with the investment strategy, but it is most important that it is aligned with the business plan.  C. Appropriate approval of the project portfolio should be granted. However, not every enterprise has an IT steering committee, and this is not as critical as ensuring that the projects are aligned with the business plan.  D. Portfolio management takes a holistic view of an enterprise\'s overall IT strategy, which, in turn, should be aligned with the business strategy. A business plan provides the justification for each of the projects in the project portfolio, and that is the major consideration for an IS auditor.

Question 21

During the review of data file change management controls, which of the following BEST helps to decrease the research time needed to investigate exceptions?   A. One-for-one checking    B. Data file security   Correct C. Transaction logs    D. File updating and maintenance authorization

Accepted Answer

You are correct, the answer is C.    A. One-for-one checking is a control procedure in which an individual document agrees with a detailed listing of documents processed by the system. It would take a long time to complete the research using this procedure.  B. Data file security controls prevent access by unauthorized users in their attempt to alter data files. This would not help identify the transactions posted to an account.  C. Transaction logs generate an audit trail by providing a detailed list of date of input, time of input, user ID, terminal location, etc. Research time can be reduced in investigating exceptions because the review can be performed on the logs rather than on the entire transaction file. It also helps to determine which transactions have been posted to an accountâby a particular individual during a particular period.  D. File updating and maintenance authorization is a control procedure to update the stored data and ensure accuracy and security of stored data. This does provide evidence regarding the individuals who update the stored data; however, it is not effective in the given situation to determine transactions posted to an account.

Question 22

The frequent updating of which of the following is key to the continued effectiveness of a disaster recovery plan (DRP)?  Correct A. Contact information of key personnel    B. Server inventory documentation    C. Individual roles and responsibilities    D. Procedures for declaring a disaster

Accepted Answer

You are correct, the answer is A.    A. In the event of a disaster, it is important to have a current updated list of personnel who are key to the operation of the plan.  B. Asset inventory is important and should be linked to the change management process of the organization, but having access to key people may compensate for outdated records.  C. Individual roles and responsibilities are important, but in a disaster many people could fill different roles depending on their experience.  D. The procedures for declaring a disaster are important because this can affect response, customer perception and regulatory issues, but not as important as having the right people there when needed.

Question 23

In addition to the backup considerations for all systems, which of the following is an important consideration in providing backup for online systems?  Incorrect A. Maintaining system software parameters    B. Ensuring periodic dumps of transaction logs    C. Ensuring grandfather-father-son file backups    D. Maintaining important data at an offsite location

Accepted Answer

You answered A. The correct answer is B.    A. Maintaining system software parameters is important for all systems, not just online systems.  B. Ensuring periodic dumps of transaction logs is the only safe way of preserving timely historic data. Because online systems do not have a paper trail that can be used to recreate data, maintaining transaction logs is critically important to prevent data loss. The volume of activity usually associated with an online system may make other more traditional methods of backup impractical.  C. Having generations of backups is best practice for all systems.  D. All backups should consider offsite storage at a location that is accessible but not likely to be affected by the same disaster.

Question 24

The PRIMARY purpose of a business impact assessment (BIA) is to:  Correct A. define recovery strategies.    B. identify the alternate site.    C. improve recovery testing.    D. calculate the annual loss expectancy (ALE).

Accepted Answer

You are correct, the answer is A.    A. One of the primary outcomes of a business impact assessment (BIA) is the recovery time objective (RTO) and the recovery point objective (RPO), which help in defining the recovery strategies.  B. A BIA, itself, will not help in identifying the alternate site. That is determined during the recovery strategy phase of the project.  C. A BIA, itself, will not help improve recovery testing. That is done during the implementation and testing phase of the project.  D. The annual loss expectancy (ALE) of critical business assets and processes is determined during risk assessment and will be reviewed in the BIA, but this is not the primary advantage.

Question 25

Which of the following is the MOST effective type of antivirus software to detect an infected application?   A. Scanners    B. Active monitors   Correct C. Integrity checkers    D. Vaccines

Accepted Answer

You are correct, the answer is C.    A. Scanners look for sequences of bits called signatures that are typical of virus programs. They examine memory, disk boot sectors, executable files and command files for bit patterns that match a known virus. Therefore, scanners need to be updated periodically to remain effective.  B. Active monitors interpret disk operating system (DOS) and read-only memory (ROM) basic input-output system (BIOS) calls, looking for virus-like actions. Active monitors can be misleading, because they cannot distinguish between a user request and a program or virus request. As a result, users are asked to confirm actions such as formatting a disk or deleting a file or set of files.  C. Integrity checkers compute a binary number on a known virus-free program that is then stored in a database file. This number is called a cyclical redundancy check (CRC). When that program is called to execute, the checker computes the CRC on the program about to be executed and compares it to the number in the database. A match means no infection; a mismatch means that a change in the program has occurred. A change in the program could mean a virus.  D. Vaccines are known to be good antivirus software. However, they need to be updated periodically to remain effective.

Question 26

A new database is being set up in an overseas location to provide information to the general public and to increase the speed at which the information is made available. The overseas database is to be housed at a data center and will be updated in real time to mirror the information stored locally. Which of the following areas of operations should be considered as having the HIGHEST risk?   A. Confidentiality of the information stored in the database   Correct B. The hardware being used to run the database application    C. Backups of the information in the overseas database    D. Remote access to the backup database

Accepted Answer

You are correct, the answer is B.    A. Confidentiality of the information stored in the database is not a major concern, because the information is intended for public use.  B. The business objective is to make the information available to the public in a timely manner. Because the database is physically located overseas, hardware failures that are left unfixed can reduce the availability of the system to users.  C. Backups of the information in the overseas database are not a major concern, because the overseas database is a mirror of the local database; thus, a backup copy exists locally.  D. Remote access to the backup database does not impact availability.

Question 27

A perpetrator looking to gain access to and gather information about encrypted data being transmitted over the network would use:   A. eavesdropping.    B. spoofing.   Correct C. traffic analysis.    D. masquerading.

Accepted Answer

You are correct, the answer is C.    A. In eavesdropping, which is a passive attack, the intruder gathers the information flowing through the network with the intent of acquiring message contents for personal analysis or for third parties.  B. Spoofing is an active attack. In spoofing, a user receives an email that appears to have originated from one source when it actually was sent from another source.  C. In traffic analysis, which is a passive attack, an intruder determines the nature of the traffic flow between defined hosts and through an analysis of session length, frequency and message length, the intruder is able to guess the type of communication taking place. This typically is used when messages are encrypted and eavesdropping would not yield any meaningful results.  D. In masquerading, the intruder presents an identity other than the original identity. This is an active attack.

Question 28

Which of the following IT governance best practices improves strategic alignment?   A. Supplier and partner risk is managed.   Incorrect B. A knowledge base on customers, products, markets and processes is in place.    C. A structure is provided that facilitates the creation and sharing of business information.    D. Top management mediates between the imperatives of business and technology.

Accepted Answer

You answered B. The correct answer is D.    A. Supplier and partner risk being managed is a risk management best practice, but not a strategic function.  B. A knowledge base on customers, products, markets and processes being in place is an IT value delivery best practice, but does not ensure strategic alignment.  C. An infrastructure being provided to facilitate the creation and sharing of business information is an IT value delivery and risk management best practice, but is not as effective as top management involvement in business and technology alignment.  D. Top management mediating between the imperatives of business and technology is an IT strategic alignment best practice.

Question 29

An IS auditor is evaluating management\'s risk assessment of information systems. The IS auditor should FIRST review:   A. the controls already in place.    B. the effectiveness of the controls in place.    C. the mechanism for monitoring the risk related to the assets.   Correct D. the threats/vulnerabilities affecting the assets.

Accepted Answer

You are correct, the answer is D.    A. The controls are irrelevant until the IS auditor knows the threats and risk that the controls are intended to address.  B. The effectiveness of the controls must be measured in relation to the risk (based on assets, threats and vulnerabilities) that the controls are intended to address.  C. The first step must be to determine the risk that is being managed before reviewing the mechanism of monitoring risk.  D. One of the key factors to be considered while assessing the information systems risk is the value of the systems (the assets) and the threats and vulnerabilities affecting the assets. The risk related to the use of information assets should be evaluated in isolation from the installed controls.

Question 30

An IS auditor is reviewing access to an application to determine whether the 10 most recent new accounts were appropriately authorized. This is an example of:   A. variable sampling.    B. substantive testing.   Correct C. compliance testing.    D. stop-or-go sampling.

Accepted Answer

You are correct, the answer is C.    A. Variable sampling is used to estimate numerical values such as dollar values.  B. Substantive testing substantiates the integrity of actual processing such as balances on financial statements. The development of substantive tests is often dependent on the outcome of compliance tests. If compliance tests indicate that there are adequate internal controls, then substantive tests can be minimized.  C. Compliance testing determines whether controls are being applied in compliance with policy. This includes tests to determine whether new accounts were appropriately authorized.  D. Stop-or-go sampling allows a test to be stopped as early as possible and is not appropriate for checking whether procedures have been followed.

Question 31

The MAJOR advantage of a component-based development approach is the:   A. ability to manage an unrestricted variety of data types.    B. provision for modeling complex relationships.   Incorrect C. capacity to meet the demands of a changing environment.    D. support of multiple development environments.

Accepted Answer

You answered C. The correct answer is D.    A. The data types must be defined within each component, and it is not sure that any component will be able to handle multiple data types.  B. Component-based development is no better than many other development methods at modeling complex relationships.  C. Component-based development is one of the methodologies that can be effective at meeting changing requirements, but this is not its primary benefit or purpose.  D. Component-based development that relies on reusable modules can increase the speed of development. Software developers can then focus on business logic.

Question 32

Which of the following factors should an IS auditor PRIMARILY focus on when determining the appropriate level of protection for an information asset?   A. Results of a risk assessment   Incorrect B. Relative value to the business    C. Results of a vulnerability assessment    D. Cost of security controls

Accepted Answer

You answered B. The correct answer is A.    A. The appropriate level of protection for an asset is determined based on the risk associated with the asset. The results of the risk assessment are, therefore, the primary information that the IS auditor should review.  B. The relative value of an asset to the business is one element considered in the risk assessment; this alone does not determine the level of protection required.  C. The results of a vulnerability assessment would be useful when creating the risk assessment; however, this would not be the primary focus.  D. The cost of security controls is not a primary factor to consider because the expenditures on these controls are determined by the value of the information assets being protected.

Question 33

The reason for establishing a stop or freezing point on the design of a new system is to:  Incorrect A. prevent further changes to a project in process.    B. indicate the point at which the design is to be completed.    C. require that changes after that point be evaluated for cost-effectiveness.    D. provide the project management team with more control over the project design.

Accepted Answer

You answered A. The correct answer is C.    A. The stop point is intended to provide greater control over changes, but not to prevent them.  B. The stop point is used for project control, but not to create an artificial fixed point that requires the design of the project to cease.  C. Projects often have a tendency to expand, especially during the requirements definition phase. This expansion often grows to a point where the originally anticipated cost-benefits are diminished because the cost of the project has increased. When this occurs, it is recommended that the project be stopped or frozen to allow a review of all of the cost-benefits and the payback period.  D. A stop point is used to control requirements, not systems design.

Question 34

In a risk-based IS audit, where both inherent and control risk have been assessed as high, an IS auditor would MOST likely compensate for this scenario by performing additional:   A. stop-or-go sampling.   Correct B. substantive testing.    C. compliance testing.    D. discovery sampling.

Accepted Answer

You are correct, the answer is B.    A. Stop-or-go sampling is used when an IS auditor believes few errors will be found in the population, and thus would not be the best type of testing to perform in this case.  B. Because both the inherent and control risk are high in this case, additional testing would be required. Substantive testing obtains audit evidence on the completeness, accuracy or existence of activities or transactions during the audit period.  C. Compliance testing is evidence gathering for the purpose of testing an enterprise\'s compliance with control procedures. While performing compliance testing is important, performing additional substantive testing would be more appropriate in this case.  D. Discovery sampling is a form of attribute sampling that is used to determine a specified probability of finding at least one example of an occurrence (attribute) in a population, typically used to test for fraud or other irregularities. In this case, additional substantive testing would be the better option.

Question 35

Which of the following should be included in a feasibility study for a project to implement an electronic data interchange (EDI) process?   A. The encryption algorithm format   Incorrect B. The detailed internal control procedures    C. The necessary communication processes    D. The proposed trusted third-party agreement

Accepted Answer

You answered B. The correct answer is C.    A. Encryption algorithms are too detailed for this phase. They would only be outlined and any cost or performance implications shown.  B. Internal control procedures are too detailed for this phase. They would only be outlined and any cost or performance implications shown.  C. The communications processes must be included because there may be significant cost implications if new hardware and software are involved, and risk implications if the technology is new to the organization.  D. Third-party agreements are too detailed for this phase. They would only be outlined and any cost or performance implications shown.

Question 36

What is the GREATEST risk of a bank outsourcing its data center?  Incorrect A. Loss or leakage of information    B. Noncompliance with regulatory requirements    C. Vendor failure or bankruptcy    D. Loss of internal knowledge and experience

Accepted Answer

You answered A. The correct answer is B.    A. The risk of loss or leakage of information is a serious risk because it will lead to financial and other penalties if it happens; however, that may happen even if the bank does not outsource. The greatest risk is noncompliance with regulations because it will subject the bank to fines and sanctions regardless of whether a breach happens.  B. The greatest risk is noncompliance with regulations because regulations are mandatory and a violation could lead to loss of the bank\'s charter to operate.  C. The risk of vendor failure or bankruptcy can be mitigated in the contract through such clauses as code escrow as well as a robust recovery process. Although this risk is inherent in any contractual relationship, if the correct controls are in place then it should not materially affect the bank as much as noncompliance or a loss or leakage of information.  D. The risk of a lack of internal IS staff knowledge through outsourcing, although valid, is not as great a risk as that resulting from noncompliance or a loss or leakage of information. Contractual controls, such as a turnover period in the event of contract termination, can also help mitigate the risk of loss of internal knowledge.

Question 37

Determining the service delivery objective (SDO) should be based PRIMARILY on:  Correct A. the minimum acceptable operational capability.    B. the cost-effectiveness of the restoration process.    C. meeting the recovery time objectives (RTOs).    D. the allowable interruption window (AIW).

Accepted Answer

You are correct, the answer is A.    A. The service delivery objective (SDO) is the level of service to be reached during the alternate process mode until the normal situation is restored. This is directly related to the business needs.  B. The cost-effectiveness of the restoration process is not the main consideration of determining the SDO.  C. Meeting the recovery time objectives (RTO) may be one of the considerations in determining the SDO, but it is a secondary factor.  D. The allowable interruption window (AIW) may be one of the factors secondary to determining the SDO.

Question 38

Use of asymmetric encryption in an Internet e-commerce site, where there is one private key for the hosting server and the public key is widely distributed to the customers, is MOST likely to provide comfort to the:   A. customer over the authenticity of the hosting organization.    B. hosting organization over the authenticity of the customer.   Incorrect C. customer over the confidentiality of messages from the hosting organization.    D. hosting organization over the confidentiality of messages passed to the customer.

Accepted Answer

You answered C. The correct answer is A.    A. Any false site will not be able to encrypt using the private key of the real site, so the customer would not be able to decrypt the message using the public key.  B. Many customers have access to the same public key so the host cannot use this mechanism to ensure the authenticity of the customer.  C. The customer cannot be assured of the confidentiality of messages from the host because many people have access to the public key and can decrypt the messages from the host.  D. The host cannot be assured of the confidentiality of messages sent out, because many people have access to the public key and can decrypt it.

Question 39

Involvement of senior management is MOST important in the development of:   A. strategic plans.    B. IT policies.    C. IT procedures.   Incorrect D. standards and guidelines.

Accepted Answer

You answered D. The correct answer is A.    A. Strategic plans provide the basis for ensuring that the enterprise meets its goals and objectives. Involvement of senior management is critical to ensuring that the plan adequately addresses the established goals and objectives.  B. IT policies are created and enforced by IT management and information security. They are structured to support the overall strategic plan.  C. IT procedures are developed to support IT policies. Senior management is not involved in the development of procedures.  D. Standards and guidelines are developed to support IT policies. Senior management is not involved in the development of standards, baselines and guidelines.

Question 40

An organization has implemented a disaster recovery plan (DRP). Which of the following steps should be carried out next?   A. Obtain senior management sponsorship.    B. Identify business needs.   Correct C. Conduct a paper test.    D. Perform a system restore test.

Accepted Answer

You are correct, the answer is C.    A. Senior management sponsorship should have been obtained prior to implementing the plan.  B. Business needs identification should have been obtained prior to implementing the plan.  C. A best practice would be to conduct a paper test. This tests the plan in a non-hazardous manner by stepping through the plan with key members of the recovery team.  D. A paper test should be conducted first, followed by system or full testing.

Question 41

An IS auditor of a health care organization is reviewing contractual terms and conditions of a third-party cloud provider being considered to host patient health information (PHI). Which of the follow contractual terms would be the GREATEST risk to the customer organization?   A. Data ownership is retained by the customer organization.   Correct B. The third-party provider reserves the right to access data to perform certain operations.    C. Bulk data withdrawal mechanisms are undefined.    D. The customer organization is responsible for backup, archive and restore.

Accepted Answer

You are correct, the answer is B.    A. The customer organization would want to retain data ownership and, therefore, this would not be a risk.  B. Some service providers reserve the right to access customer information (third-party access) to perform certain transactions and provide certain services. In the case of protected health information (PHI), regulations may restrict certain access. Organizations must review the regulatory environment in which the cloud provider operates because it may have requirements or restrictions of its own. Organizations must then determine whether the cloud provider provides appropriate controls to ensure that data are appropriately secure.  C. An organization may eventually wish to discontinue its service with a third-party cloud-based provider. The organization would then want to remove its data from the system and ensure that the service provider clears the system (including any backups) of its data. Some providers do not offer automated or bulk data withdrawal mechanisms, which the organization needs to migrate its data. These aspects should be clarified prior to using a third-party provider.  D. An organization may need to plan its own data recovery processes and procedures if the service provider does not make this available or the organization has doubts about the service provider\'s processes. This would only be a risk if the customer organization was unable to perform these activities itself.

Question 42

For a retail business with a large volume of transactions, which of the following audit techniques is the MOST appropriate for addressing emerging risk proactively?   A. Use of computer-assisted audit techniques (CAATs)    B. Quarterly risk assessment    C. Sampling of transaction logs   Correct D. Continuous auditing

Accepted Answer

You are correct, the answer is D.    A. Using software tools such as computer-assisted audit techniques (CAATs) to analyze transaction data can provide detailed analysis of trends and potential risk, but it is not as effective as continuous auditing, because there may be a time differential between executing the software and analyzing the results.  B. Quarterly risk assessment may be a good technique, but not as responsive as continuous auditing.  C. The sampling of transaction logs is a valid audit technique; however, risk may exist that is not captured in the transaction log, and there may be a potential time lag in the analysis.  D. The implementation of continuous auditing enables a real-time feed of information to management through automated reporting processes so that management may implement corrective actions more quickly.

Question 43

Which of the following tests performed by an IS auditor would be the MOST effective in determining compliance with an organization\'s change control procedures?   A. Review software migration records and verify approvals.   Correct B. Identify changes that have occurred and verify approvals.    C. Review change control documentation and verify approvals.    D. Ensure that only appropriate staff can migrate changes into production.

Accepted Answer

You are correct, the answer is B.    A. Software migration records may not have all changes listedâchanges could have been made that were not included in the migration records.  B. The most effective method is to determine what changes have been made (check logs and modified dates) and then verify that they have been approved.  C. Change control records may not have all changes listed.  D. Ensuring that only appropriate staff can migrate changes into production is a key control process but, in itself, does not verify compliance.

Question 44

Which of the following is the initial step in creating a firewall policy?  Incorrect A. A cost-benefit analysis of methods for securing the applications    B. Identification of network applications to be externally accessed    C. Identification of vulnerabilities associated with network applications to be externally accessed    D. Creation of an application traffic matrix showing protection methods

Accepted Answer

You answered A. The correct answer is B.    A. Identifying methods to protect against identified vulnerabilities and their comparative cost-benefit analysis is the third step.  B. Identification of the applications required across the network should be identified first. After identification, depending on the physical location of these applications in the network and the network model, the person in charge will be able to understand the need for, and possible methods of, controlling access to these applications.  C. Having identified the externally accessed applications, the second step is to identify vulnerabilities (weaknesses) associated with the network applications.  D. The fourth step is to analyze the application traffic and create a matrix showing how each type of traffic will be protected.

Question 45

When reviewing the development of information security policies, the PRIMARY focus of an IS auditor should be on assuring that these policies:   A. are aligned with globally accepted industry best practices.    B. are approved by the board of directors and senior management.   Correct C. strike a balance between business and security requirements.    D. provide direction for implementing security procedures.

Accepted Answer

You are correct, the answer is C.    A. An organization is not required to base its IT policies on industry best practices. Policies must be based on the culture and business requirements of the organization.  B. It is essential that policies be approved; however, that is not the primary focus during the development of the policies.  C. Information security policies must be first of all aligned with an organization\'s business and security objectives.  D. Policies cannot provide direction if they are not aligned with business requirements.

Question 46

An IS auditor is performing a review of the software quality management process in an organization. The FIRST step should be to:   A. verify how the organization follows the standards.    B. identify and report the controls currently in place.    C. review the metrics for quality evaluation.   Correct D. request all standards that have been adopted by the organization.

Accepted Answer

You are correct, the answer is D.    A. The auditor needs to know what standards the organization has adopted and then measure compliance with those standards. Determining how the organization follows the standards is secondary to knowing what the standards are. The other items listedâverifying how well standards are being followed, identifying relevant controls and reviewing the quality metricsâare secondary to the identification of standards.  B. The first step is to know the standards and what policies and procedures are mandated for the organization, then to document the controls and measure compliance.  C. The metrics cannot be reviewed until the auditor has a copy of the standards that describe or require the metrics.  D. Because an audit measures compliance with the standards of the organization, the first step of the review of the software quality management process should be to determine the evaluation criteria in the form of standards adopted by the organization. The evaluation of how well the organization follows their own standards cannot be performed until the IS auditor has determined what standards exist.

Question 47

An organization recently deployed a customer relationship management (CRM) application that was developed in-house. Which of the following is the BEST option to ensure that the application operates as designed?  Incorrect A. User acceptance testing (UAT)    B. Project risk assessment    C. Postimplementation review    D. Management approval of the system

Accepted Answer

You answered A. The correct answer is C.    A. User acceptance testing (UAT) verifies that the system functionality has been deemed acceptable by the end users of the system; however, a review of UAT will not validate whether the system is performing as designed because UAT could be performed on a subset of system functionality. The UAT review is a part of the postimplementation review.  B. While a risk assessment would highlight the risk of the system, it would not include an analysis to verify that the system is operating as designed.  C. The purpose of a postimplementation review is to evaluate how successfully the project results match original goals, objectives and deliverables. The postimplementation review also evaluates how effective the project management practices were in keeping the project on track.  D. Management approval of the system could be based on reduced functionality and does not verify that the system is operating as designed. Review of management approval is a part of postimplementation review.

Question 48

An IT executive of an insurance company asked an external auditor to evaluate the user IDs for emergency access (fire call ID). The IS auditor found that fire call accounts are granted without a predefined expiration date. What should the IS auditor recommend?   A. Review of the access control privilege authorization process    B. Implementation of an identity management system (IMS)    C. Enhancement of procedures to audit changes made to sensitive customer data   Incorrect D. Granting of fire call accounts only to managers

Accepted Answer

You answered D. The correct answer is A.    A. In this case, the IS auditor should recommend reviewing the process of access control management. Emergency system administration-level access should only be granted on an as-needed basis and configured to a predefined expiration date. Accounts with temporary privileges require strong controls to limit the lifetime of the privileges and use of these accounts should be closely monitored.  B. While implementing an identity management system (IMS) may solve the problem, it would be most cost-efficient to first review access privileges.  C. Enhancing procedures to audit changes made to sensitive customer data does not prevent the misuse of these accounts and should be performed after reviewing the process.  D. It is not realistic to grant fire call accounts only to managers.

Question 49

An IS auditor should recommend the use of library control software to provide reasonable assurance that:   A. program changes have been authorized.    B. only thoroughly tested programs are released.    C. modified programs are automatically moved to production.   Incorrect D. source and executable code integrity is maintained.

Accepted Answer

You answered D. The correct answer is A.    A. Library control software should be used to separate test from production libraries in mainframe and/or client server environments. The main objective of library control software is to provide assurance that program changes have been authorized.  B. Library control software is concerned with authorized program changes and cannot determine whether programs have been thoroughly tested.  C. Programs should not be moved automatically into production without proper authorization.  D. Library control software provides reasonable assurance that the source code and executable code are matched at the time a source code is moved to production. Access control will ensure the integrity of the software, but the most important benefit of version control software is to ensure that all changes are authorized.

Question 50

Which of the following is the BEST audit procedure to determine if a firewall is configured in compliance with an organization\'s security policy?   A. Review the parameter settings.   Incorrect B. Interview the firewall administrator.    C. Review the actual procedures.    D. Review the device\'s log file for recent attacks.

Accepted Answer

You answered B. The correct answer is A.    A. A review of the parameter settings will provide a good basis for comparison of the actual configuration to the security policy and will provide audit evidence documentation.  B. An interview with the firewall administrator will not ensure that the firewall is configured correctly.  C. Reviewing the actual procedures is good, but will not ensure that the firewall rules are correct and compliant with policy.  D. Recent attacks may indicate problems with the firewall, but will not ensure that it is correctly configured.

Question 51

To ensure message integrity, confidentiality and nonrepudiation between two parties, the MOST effective method would be to create a message digest by applying a cryptographic hashing algorithm against:  Correct A. the entire message, enciphering the message digest using the sender\'s private key, enciphering the message with a symmetric key and enciphering the key by using the receiver\'s public key.    B. any part of the message, enciphering the message digest using the sender\'s private key, enciphering the message with a symmetric key and enciphering the key using the receiver\'s public key.    C. the entire message, enciphering the message digest using the sender\'s private key, enciphering the message with a symmetric key and enciphering both the encrypted message and digest using the receiver\'s public key.    D. the entire message, enciphering the message digest using the sender\'s private key and enciphering the message using the receiver\'s public key.

Accepted Answer

You are correct, the answer is A.    A. Applying a cryptographic hashing algorithm against the entire message addresses the message integrity issue. Enciphering the message digest using the sender\'s private key creates a digital signature and addresses nonrepudiation. Encrypting the message with a symmetric key most efficiently addresses the confidentiality of the message, thereafter enciphering the symmetric key using the receiver\'s public key, which transports (distributes) the symmetric key securely to the receiver.  B. Only hashing a part of the message would only verify the integrity of that part of the message.  C. Enciphering the message with a public key would be much too slow to be practical.  D. Enciphering the entire message with a public key would be too slow to be practical.

Question 52

Which of the following is the MOST important for an IS auditor to consider when reviewing a service level agreement (SLA) with an external IT service provider?   A. Payment terms    B. Uptime guarantee   Incorrect C. Indemnification clause    D. Default resolution

Accepted Answer

You answered C. The correct answer is B.    A. Payment terms are typically included in the master agreement rather than in the service level agreement (SLA).  B. The most important element of an SLA is the measurable terms of performance, such as uptime agreements.  C. The indemnification clause is typically included in the master agreement rather than in the SLA.  D. The default resolution would only apply in case of a default of the SLA; therefore, it is more important to review the performance conditions of the SLA.

Question 53

When selecting audit procedures, an IS auditor should use professional judgment to ensure that:  Correct A. sufficient evidence will be collected.    B. all significant deficiencies identified will be corrected within a reasonable period.    C. all material weaknesses will be identified.    D. audit costs will be kept at a minimum level.

Accepted Answer

You are correct, the answer is A.    A. Procedures are processes an IS auditor may follow in an audit engagement. In determining the appropriateness of any specific procedure, an IS auditor should use professional judgment appropriate to the specific circumstances. Professional judgment involves a subjective and often qualitative evaluation of conditions arising in the course of an audit. Judgment addresses a grey area where binary (yes/no) decisions are not appropriate and the IS auditor\'s past experience plays a key role in making a judgment. The IS auditor should use judgment in assessing the sufficiency of evidence to be collected. ISACA\'s guidelines provide information on how to meet the standards when performing IS audit work.  B. The correction of deficiencies is the responsibility of management and is not a part of the audit procedure selection process.  C. Identifying material weaknesses is the result of appropriate competence, experience and thoroughness in planning and executing the audit and not of professional judgment. Professional judgment is not a primary input to the financial aspects of the audit. Audit procedures and use of professional judgment cannot ensure that all deficiencies/weaknesses will be identified and corrected.  D. Professional judgment will ensure that audit resources and costs are used wisely, but this is not the primary objective of the auditor when selecting audit procedures.

Question 54

This question refers to the following diagram.  Internet--Firewall1--Mail Gateway--Firewall2--IDS  Email traffic from the Internet is routed via firewall-1 to the mail gateway. Mail is routed from the mail gateway, via firewall-2, to the mail recipients in the internal network. Other traffic is not allowed. For example, the firewalls do not allow direct traffic from the Internet to the internal network. The intrusion detection system (IDS) detects traffic for the internal network that did not originate from the mail gateway. The FIRST action triggered by the IDS should be to:  Incorrect A. alert the appropriate staff.    B. create an entry in the log.    C. close firewall-2.    D. close firewall-1.

Accepted Answer

You answered A. The correct answer is B.    A. The first action taken by an intrusion detection system (IDS) will be to create a log entry and then alert the administrator.  B. Creating an entry in the log is the first step taken by a network IDS. The IDS may also be configured to send an alert to the administrator, send a note to the firewall and may even be configured to record the suspicious packet.  C. Traffic for the internal network that did not originate from the mail gateway is a sign that firewall-1 is not functioning properly. This may have been be caused by an attack from a hacker. After the IDS has logged the suspicious traffic, it may signal firewall-2 to close, thus preventing damage to the internal network. After closing firewall-2, the malfunctioning of firewall-1 can be investigated. The IDS should trigger the closing of firewall-2 either automatically or by manual intervention. Between the detection by the IDS and a response from the system administrator, valuable time can be lost, in which a hacker could also compromise firewall-2.  D. The IDS will usually only protect the internal network by closing firewall-2 and will not close the externally facing firewall-1.

Question 55

Which one of the following could be used to provide automated assurance that proper data files are being used during processing?  Correct A. Internal labeling, including file header records    B. Version usage    C. Parity checking    D. File security controls

Accepted Answer

You are correct, the answer is A.    A. Internal labeling, including file header records, is correct because it can provide assurance that proper data files are being used and it allows for automatic checking.  B. Version usage is not correct because this may not necessarily allow for automatic checking. This helps only in respect to assurance that the correct file and version are being used.  C. Parity checking is not correct because it is a data integrity validation method typically used by a data transfer program. While parity checking may help to ensure that data and program files are transferred successfully, it does not help to ensure that the proper data or program files are being used.  D. File security controls is not correct because they cannot be used to provide assurance that proper data files are being used and cannot allow for automatic checking. They can be used to provide assurance that unauthorized users do not have access to the application and/or access to read or alter the data in an unauthorized manner.

Question 56

Which of the following is MOST critical when creating data for testing the logic in a new or modified application system?  Incorrect A. A sufficient quantity of data for each test case    B. Data representing conditions that are expected in actual processing    C. Completing the test on schedule    D. A random sample of actual data

Accepted Answer

You answered A. The correct answer is B.    A. The quantity of data for each test case is not as important as having test cases that will address all types of operating conditions.  B. Selecting the right kind of data is key in testing a computer system. The data should not only include valid and invalid data but should be representative of actual processing; quality is more important than quantity.  C. It is more important to have adequate test data than to complete the testing on schedule.  D. It is unlikely that a random sample of actual data would cover all test conditions and provide a reasonable representation of actual data.

Question 57

An organization is implementing an enterprise resource planning (ERP) application. Of the following, who is PRIMARILY responsible for overseeing the project to ensure that it is progressing in accordance with the project plan and that it will deliver the expected results?  Incorrect A. Project sponsor    B. System development project team (SDPT)    C. Project steering committee    D. User project team (UPT)

Accepted Answer

You answered A. The correct answer is C.    A. A project sponsor is typically the senior manager in charge of the primary business unit that the application will support. The sponsor provides funding for the project and works closely with the project manager to define the critical success factors or metrics for the project. The project sponsor is not responsible for reviewing the progress of the project.  B. A system development project team (SDPT) completes the assigned tasks, works according to the instructions of the project manager and communicates with the user project team. The SDPT is not responsible for overseeing the progress of the project.  C. A project steering committee that provides an overall direction for the enterprise resource planning (ERP) implementation project is responsible for reviewing the project\'s progress to ensure that it will deliver the expected results.  D. A user project team (UPT) completes the assigned tasks, communicates effectively with the system development team and works according to the advice of the project manager. A UPT is not responsible for reviewing the progress of the project.

Question 58

An IS auditor is reviewing the backup strategy and the backup technology in use by an organization. The IS auditor would be MOST concerned if:  Correct A. data restoration tests are not being regularly performed.    B. disk subsystems are being backed up to other disks, and not to tape.    C. daily backup logs are purged quarterly.    D. backups of critical company data are not encrypted.

Accepted Answer

You are correct, the answer is A.    A. The only way to ensure with certainty that a backup is working is to perform a data restoration test. If this were not being done regularly, it would be a concern.  B. Current backup technology utilizes disk-to-disk backup technology, which is considered to be reliable and will have a faster recovery time than tape, so this would not be a concern.  C. While it is important to maintain logs to document that the backup process is operating effectively, not retaining the logs would not be a major concern.  D. Encrypting backup data may be required in certain cases to protect valuable data, but data that are critical may not necessarily be classified as being confidential. Because encryption adds time and expense to the backup process, it would only be used when required to meet the security requirements rather than in all cases.

Question 59

An IS auditor is reviewing a corporate web server. Which of the following should be of MOST concern to the IS auditor?  Correct A. System patches are not applied.    B. The server is not accessed through a virtual private network (VPN).    C. Server logs are not being captured.    D. The network address translation is not enabled.

Accepted Answer

You are correct, the answer is A.    A. Web servers should have up-to-date patches because they are accessible to the Internet and are prone to attack.  B. It is not typically required that the web server be accessed by a virtual private network (VPN) because the web server contains public information.  C. While logging is important, lack of system patching is a more significant issue.  D. Network address translation does not have any impact on server security and therefore is not a concern.

Question 60

In reviewing the IT short-range (tactical) plan, an IS auditor should determine whether:   A. there is an integration of IT and business personnel within projects.    B. there is a clear definition of the IT mission and vision.    C. a strategic information technology planning scorecard is in place.   Incorrect D. the plan correlates business objectives to IT goals and objectives.

Accepted Answer

You answered D. The correct answer is A.    A. The integration of IT and business personnel in projects is an operational issue and should be considered while reviewing the short-range plan. A strategic plan would provide a framework for the IT short-range plan.  B. A clear definition of the IT mission and vision would be covered by a strategic plan.  C. A strategic information technology planning scorecard would be covered by a strategic plan.  D. Business objectives correlating to IT goals and objectives would be covered by a strategic plan.

Question 61

Which of the following is the MOST common concern for an IS auditor regarding audit logs?   A. Logs can be examined only by system administrators.    B. Logs require special tools for collection and review.    C. Logs are typically not backed up regularly.   Correct D. Logs are collected but not analyzed.

Accepted Answer

You are correct, the answer is D.    A. Logs can be accessed and reviewed by authorized personnel with a minimal amount of training; however, in most cases no one is reviewing the logs on a regular basis.  B. Log analysis tools range from simple filters to complex security event and incident management (SEIM) systems.  C. Logs are rarely backed up and may be subject to alteration by administrators.  D. One of the most common problems with audit logs is that they are collected but not analyzed. In most circumstances, audit logs are reviewed only in the case of an incident, error or exception.

Question 62

Of the following alternatives, the FIRST approach to developing a disaster recovery strategy would be to assess whether:  Incorrect A. all threats can be completely removed.    B. a cost-effective, built-in resilience can be implemented.    C. the recovery time objective (RTO) can be optimized.    D. the cost of recovery can be minimized.

Accepted Answer

You answered A. The correct answer is B.    A. It is impossible to remove all existing and future threats.  B. It is critical to initially identify information assets that can be made more resilient to disasters, e.g., diverse routing, alternate paths or multiple communication carriers. Preventing a problem is always better than planning to address a problem when it happens.  C. The optimization of the recovery time objective (RTO) comes later in the development of the disaster recovery strategy.  D. Efforts to minimize the cost of recovery come later in the development of the disaster recovery strategy.

Question 63

Which of the following is the BEST reference for an IS auditor to determine a vendor\'s ability to meet service level agreement (SLA) requirements for a critical IT security service?   A. Compliance with the master agreement   Correct B. Agreed-on key performance metrics    C. Results of business continuity tests    D. Results of independent audit reports

Accepted Answer

You are correct, the answer is B.    A. The master agreement typically includes terms, conditions and costs, but does not typically include service levels.  B. Metrics allow for a means to measure performance. Service level agreements (SLAs) are statements related to expected service levels. For example, an Internet service provider (ISP) may guarantee that their service will be available 99.99 percent of the time.  C. If applicable to the service, results of business continuity tests are typically included as part of the due diligence review.  D. Independent audits report on the financial condition of an organization or the control environment. Reviewing audit reports is typically part of the due diligence review. Even audits must be performed against a set of standards or metrics to validate compliance.

Question 64

Which of the following is the MOST efficient way to test the design effectiveness of a change control process?  Incorrect A. Test a sample population of change requests    B. Test a sample of authorized changes    C. Interview personnel in charge of the change control process    D. Perform an end-to-end walk-through of the process

Accepted Answer

You answered A. The correct answer is D.    A. Testing a sample population of changes is a test of operating effectiveness to ensure that users submitted the proper documentation/requests. It does not test the effectiveness of the design.  B. Testing changes that have been authorized may not provide sufficient assurance of the entire process because it does not test the elements of the process related to authorization or detect changes that bypassed the controls.  C. Interviewing personnel in charge of the change control process is not as effective as a walk-through of the change controls process because people may know the process but not follow it.  D. Observation is the best and most effective method to test changes to ensure that the process is effectively designed.

Questions missed the first time – Flashcards

Unlock all answers in this set

Haven't found what you were looking for?

Search for samples, answers to your questions and flashcards