Full Flashcards
(896 cards)
1
Q
Most appropriate testing method for automated invoice controls to ensure exceptions are not made for specific users.
A
Stratified Random Sampling
2
Q
Most important skill that an IS auditor should develop to understand the constraints of conducting an audit.
A
Project Management (resource management, deliverables, scheduling, and deadlines, etc.)
3
Q
Primary advantage of a continuous audit approach.
A
Allows auditor to review and follow up on audit issues in a timely manner.
4
Q
First step of IS auditor after identifying findings.
A
Gain agreement with auditee on findings. Must be agreed upon by both parties to prevent issues during sign-off of final audit report or while discussing findings with management.
5
Q
IS auditor is reviewing access to an app to determine whether recently added accounts were appropriately authorized. This is an example of what type of testing?
A
Compliance testing. Testing whether controls are being applied in compliance with a policy.
6
Q
Main purpose of annual IS audit plan.
A
Allocate resources
7
Q
The key benefot of control self-assessment.
A
Management ownership of the internal controls supporting business objectives is reinforced. The objective of CSA is to have business management become more aware of the importance of internal control and their responsibility in terms of corporate governance.
8
Q
Best source of information when developing a risk-based audit plan.
A
Senior management identify key business processes. Development of a risk-based audit plan must start with this.
9
Q
Is auditor wants to analyze audit trails on critical servers to discover potential anomalies in user or system behavior. What is most suitable for performing this task?
A
Trend/variance detection tools. They look for anomalies in user or system behavior, such as invoices with increasing invoice numbers.
10
Q
IS auditor who was involved in designing an org’s business continuity plan (BCP) has been assigned to the audit plan. IS Auditor should…
A
Communicate the possibility of conflict of interest to Audit Management prior to starting the assignment. Independence is in jeopardy.
11
Q
Who is in the best position to approve changes to the audit charter?
A
The audit committee. A subgroup of the board of directors. The audit dept. should report to the audit committee and the audit charter should be approved by this committee.
12
Q
Main advantage of an IS auditor directly extracting data from a general ledger system.
A
Greater assurance of validity and completeness. Asking IT to extract the data exposes the risk of filtering out exceptions. Also, if the IS auditor extracts the data, all internal references correlating the various data tables/elements will be understood, which may reveal vital elements to completeness and correctness of overall audit activity.
13
Q
IS auditor noted that failed login attempts to a core financial system are automatically logged and the logs are retained for a year by the organization. This logging is…
A
not an adequate control. Generation of an activity log is not a control by itself. It is the review of such log that makes the activity a control (i.e., generation plus review).
14
Q
A long-term it employee with a strong technical background and broad managerial experience has applied for a vacant position in the IS auditor dept. Determining whether to hire this individual for this position should be PRIMARILY based on the auditor’s experience, and:
A
ability, as an IS auditor, to be independent of existing IT relationships/ Independence should be continuously assessed. This includes changes in personal relationships, financial interests, and prior job responsibilities and assignments.
15
Q
the Auditee disagrees with an audit finding. The BEST course of action for the IT auditor is…
A
To discuss the finding with the IT Auditor’s Manager. Other actions can weaken relationships with the auditee and auditor.
16
Q
Major benefit of conducting a control self-assessment over a traditional audit.
A
It detects risk sooner than later. CSAs require employees to assess the control stature of their own function, and help to increase the understanding of business risk and internal controls. Also, CSAs are conducted more frequently than audits, which helps to identify risks in a more timely manner.
17
Q
The primary requirement for reporting IS audit results.
A
backed by sufficient and appropriate audit evidence, as to demonstrate the application of the minimum standard of performance.
18
Q
IS auditor is testing employee access to a large financial system. IS auditor selected a sample from the current employee listing provided by the auditee. Which evidence is MOST reliable to support the testing?
A
A list of accounts with access levels Generated By The System.
19
Q
In planning an IS audit, the most critical step is…
A
Identification of the time allotted for the audit.
20
Q
Main reason to perform a risk assessment in the PLANNING phase of an audit.
A
To provide reasonable assurance material items will be addressed. Helps to focus the audit procedures on the highest risk areas included in the scope of the audit. The concept of reasonable assurance is also important.
21
Q
An audit charter should document…
A
the overall authority, scope, and responsibilities of the audit function.
22
Q
Out of statutory requirements, corporate standards, industry good practices, and org policies and procedures, which should have a priority when PLANNING the scope and objectives of an IS audit?
A
Applicable Statutory Requirements. No limit of scope. IS auditor has no options.
23
Q
Best technique to help IS auditor to determine whether there have been unauthorized program changes since the last authorized update.
A
Automated code comparison (because automation provides efficiency)
24
Q
An IS auditor is testing employee access to a large financial system, and is using a sample from the current employee list supported by the auditee. Which is most reliable to support the testing?
A
A list of accounts with access generated by the system (objective evidence).
25
In planning an IS audit, the most critical step is the identification of...
time allotted for the audit.
26
During risk analysis, an IS auditor identifies threats and potential impacts. Next the IS auditor should...
identify and evaluate the existing controls.
27
An IS auditor is validating a control that involves a review of system-generated exception reports. What is the best evidence of the effectiveness of the control?
A sample system-generated exception report for the review period, with follow-up actions noted by the reviewer.
28
What is the main reason to perform a risk assessment in the planning phase of the audit?
To provide reasonable assurance material items will be addressed.
29
An audit charter should:
Outline the overall authority, scope and responsibilities of the audit function.
30
The effect of which of the following should have priority in planning the scope and objectives of an IS audit is...
applicable statutory requirements.
31
Best technique to help IS auditor determine unauthorized program changes occurred since last update.
Automated code comparison (efficiency)
32
Best factor to determine the required extent of data collection during the planning phase of an IS compliance audit.
Purpose, objective, and scope of the audit.
33
After initial investigation, an IS auditor has reasons to believe that fraud may be present. The IS auditor should...
expand activities to determine whether an investigation is warranted.
34
Who approves the audit charter?
CEO
35
An IS auditor finds a small number of user access requests that were not authorized by managers through the normal predefined workflow steps and escalation rules. The IS auditor should...
perform additional analysis to determine why the approval and workflow processes are not operating as intended. Before making any recommendation, the IS auditor should gain an understanding of the scope of the problem and the factors that caused the incident(s). IS auditor should determine if caused by managers not following procedure, a problem with the workflow of the automated system, or a combination of both.
36
During an audit, the IS auditor notes the application developer also performs quality assurance testing on another application. What is the most appropriate course of action by the auditor?
Report the identified condition (separation of duties).
37
A centralized antivirus system determines whether each personal computer has the latest signature files and installs the latest signature files before allowing a PC to connect to the network. This is an example of what type of control?
Corrective control because it is designed to correct errors, omissions, and unauthorized uses and intrusions when they are detected.
38
Most appropriate action for an IS auditor to take when a shared user account is discovered...
Document the finding and explain the risk of using shared IDs.
39
Compliance tests to determine whether controls support management policies and procedures will assist the IS auditor to determine...
that the control is operating as designed.
40
The primary requirement that a data mining and auditing software tool should meet is...
to accurately capture data from the organization's systems without causing excessive performance problems.
41
Most effective audit practice to determine whether operational effectiveness of controls is properly applied to transaction processing
Substantive testing, such as document review of walkthrough are most effective for determining operational effectiveness.
42
In a small organization, the function of release manager and app programmer are performed by the same employee. What is the best compensating control in this scenario?
Verify that only approved program changes are implemented.
43
Which of the following attributes of evidence is MOST affected by the use of CAATs (computer-assisted audit techniques)?
Reliability
44
Most critical step in planning an IS audit?
Perform a risk assessment.
45
First step in an IT risk assessment for a risk-based audit is...
understand the business, its operating model, and key processes.
46
Most important reason for an IS auditor to obtain sufficient and appropriate audit evidence is to...
provide a basis for drawing reasonable conclusions.
47
During the planning stage of the IS audit, the primary goal of an IS auditor...
address audit objectives.
48
Which technique would best test for the existence of dual control when auditing the wire transfer systems of a bank?
Observation helps to ascertain whether two individuals do get involved in the execution of the operation and an element of oversight exists.
49
As part of audit planning, an IS auditor is designing various data validation tests to effectively detect transposition and transcription errors. What would be best in detecting these errors?
Check digit. This is a numeric value that has been calculated mathematically and is added to data to ensure that original data have not been altered, or that an incorrect, but valid, match has occurred.
50
A manager coordinates the creation of a new or revised plan DRP within a defined time limit. The primary concern is to establish a workable disaster recovery plan (DRP) that reflects current processing volumes to protect the organization from any disruptive incidents.
Was a lengthy scenario Q
51
During the course of an application software review, an IS auditor identified minor weaknesses in a relevant database environment that is out of scope for the audit, The best option is to...
report the weakness as observed.
52
An IS auditor reviewing the process of a log monitoring wants to evaluate the organization's manual review process. Which audit technique would most likely be employed to fulfill this purpoase?
Walkthrough. Usually includes a combination of inquiry, observation, inspection of relevant documentation, and reperformance of controls. Here, we follow the manual log review process from start to finish to a gain a thorough understanding of the overall process and identify potential control weaknesses.
53
When testing for compliance, which sampling method is most useful? Attribute, Variable, Stratified mean per unit, or Difference Estimation?
Attribute sampling is the primary method used for compliance testing. Attribute sampling is used to estimate the rate of occurrence in a population and is used in compliance testing to determine whether quality exists.
54
While reviewing sensitive electronic workpapers, the IS auditor noticed that they are not encrypted. This could compromise the what?
Confidentiality of the workpapers.
55
What is evaluated as a preventive control by an IS auditor? Transaction Logs, Before & After Image Reporting, Table Lookups, and Tracing & Tagging.
Table Lookups. Input data are checked against predefined tables, which prevent any undefined data to be entered.
56
An IS auditor wants to analyze audit trails on critical servers to discover potential anomalies in user or system behavior. Which of the following is most suitable? Computer aided software engineering tools, embedded data collection tools, Trend/Variance detection tools, or Heuristic Scanning tools?
Trend/Variance detection tools look for anomalies in user or system behavior, such as invoices with increasing invoice numbers.
57
When preparing an audit report the IS auditor should ensure that the results are supported by...
Sufficient and appropriate audit evidence.
58
What roles of implementation of specific functionality during an app development impair the independence of an IS auditor?
If he has been or is actively involved in the development, acquisition, and implementation of the system.
59
An IS audit is to identify payroll overpayments for previous year. What's the best technique?
Generalized audit software, which includes mathematical computations, stratification, statistical analysis, sequence checking, duplicate checking, and re-computations. An IS auditor can used generalized audit software to design appropriate tests to re-compute payroll, thereby determining whether overpayments were made, and to whom.
60
The primary advantage of a continuous audit approach is...
allows the IS auditor to review and follow up on audit issues in a timely manner, since audit findings are gathered in near real-time.
61
Of Re-performance, Process walkthrough, Observation, and Documentation Review, which is best ensures the effectiveness of controls related to interest calculation for an accounting system?
Re-performance, because it checks to see if the results are the same from an independent person, thus providing the strongest assurance.
62
When auditing an accounting app's internal data integrity controls, an IS auditor identifies a major control deficiency in the change management software supporting the accounting app. What's the most appropriate action for the IS auditor to take?
To continue to test the accounting app controls and include this deficiency in the final report. It is the responsibility of the IS auditor to repor5t on the findings that can have a material impact on the effectiveness of controls, whether or not they are within the scope of the audit.
63
Which of the following evidence is most reliable? An oral statement from the auditee...the results of a test performed by an external IS auditor...an internally generated computer accounting record...a confirmation letter received from an outside source?
The results of a test performed by an external IS auditor should always be considered more reliable evidence than a letter from a third party because of the audit techniques and standard methodologies that provide reasonable assurance that the controls are accurate.
64
What is the primary requirement for reporting IS audit results?
The report is backed by sufficient and appropriate audit evidence.
65
An external IS auditor issues an audit report pointing out the lack of a firewall protection feature at the perimeter network gateway and recommending a specific vendor product to address this vulnerability. The IS auditor has failed to exercise...
professional independence.
66
An IS auditor uses CAATs to collect and analyze data. Which of the following attributes of evidence is MOST affected by the use of CAATs? Usefulness, Reliability, Relevance, or Adequacy?
Reliability, because the data are directly collected by the IS auditor, the audit findings can be reported with an emphasis on the reliability of the records that are produced and maintained in the system. The reliability of the source of information used provides reassurance on the generated findings.
67
Which is the first step performed prior to creating a risk ranking for the annual IS audit plan?
Identify the critical controls.
68
In a small org, the function of release manager and app programmer are performed by the same employee. What's the best compensating control?
Verify that only approved program changes are implemented.
69
An IS auditor is reviewing access to an app to determine whether recently added accounts were appropriately authorized. This is an example of what type of testing?
Compliance testing. Checking to see if controls are being applied in alignment with the policy.
70
What's the best source of information when developing a risk-based audit plan?
Senior management identifies key business processes.
71
What most likely indicates that a customer data warehouse should remain in-house rather than be outsourced to an offshore operation?
Privacy laws can prevent cross-border flow of information.
72
Involvement of senior management is most important in the development of...
strategic plans.
73
As a result of profitability pressure, senior management decides to keep investments in information security at an inadequate level. What is the best recommendation of the IS audditor?
Request that senior management accepts the risk. Since senior management determines resource allocation, it is imperative that they accept the risk from their decision.
74
Which of the following is the most important element for the successful implementation of IT governance? implementing an IT scorecard, identifying org strategies, performing a risk assessment, or creating a formal policy?
Implementing an IT scorecard. The key objective of an IT governance program is to support the business.
75
An IS auditor reviews an organizational chart primarily for what reason?
Understanding the responsibility and authority of individuals.
76
A comprehensive and effective email policy should address the issues of small structure, policy enforcement, monitoring, and...
rebuilding.
77
An IS auditor identifies that reports on product profitability produced by an organization's finance and marketing departments give different results. Further investigation reveals that the product definition being used by the two departments is different. What should the IS auditor recommend?
Organization governance practices are put into practice. Standard definitions of data elements is part of a data governance initiative.
78
Effective IT governance requires organization structures and processes to ensure that...
the IT strategy extends the organization's strategies and objectives.
79
An enterprise's risk appetite is best established by...
the steering committee. It draws its representation from senior management.
80
Which of the following is a function of an IT steering committee?
Approving and monitoring the status of IT plans and budgets. Serves as a general review board for major IT projects and should not become involved in routine operations.
81
What reason best describes the purpose of a mandatory vacation policy?
To identify potential errors or inconsistencies in business processes. This helps uncover potential fraud or inconsistencies.
82
While evaluating software development practices in an organization, an IS auditor notes that the quality assurance (QA) function reports to project management. The most important concern for the IS auditor is the...
effectiveness of the QA function, because it should interact between project management and user management.
83
A decision support system is used to help high-level management...
make decisions based on data analysis and interactive models. A DSS emphasizes flexibility in the decision-making approach of management through data analysis and the use of interactive models, not fixed criteria.
84
An IS auditor reviewing the IT organization is most concerned if the IT steering committee is
responsible for determining business goals. This is a function of senior management, not the IT steering committee.
85
What best supports the prioritization of new IT projects?
Investment portfolio analysis, which also adds the most value to the strategic IT initiative decision-making process.
86
Most important to consider when reviewing the classification levels of information assets...
Potential Loss
87
By evaluating application development projects against the capacity maturity model (CMM), an IS auditor should be able to verify that...
Predictable software processes are followed.
88
By evaluating app development projects against the capacity maturity model (CMM), an IS auditor should be able to verify that...
predictable software processes are followed.
89
The best reason to implement a policy that places conditions upon secondary employment for IT employees.
To prevent conflicts of interest (i.e., releasing sensitive information)
90
From a control perspective, the key element is job descriptions is that they...
establish responsibility and accountability for the employee's actions.
91
The risk associated with electronic evidence gathering is most likely reduced by...
an email archive policy. With a policy of well-archived emails records, access to retrieval of specific email records to comply w/legal requirements is possible.
92
What should be considered first when implementing a risk management program?
A determination of risk priorities that are based on potential consequences.
93
AN IS auditor is evaluating management's risk assessment of information systems. The IS auditor should first review
threats/vulnerabilities affecting the assets.
94
The primary benefit of implementing a security program as part of a security governance framework is the...
enforcement of the management of security risk.
95
An IT steering committee should
maintain minutes of its meetings and keep the board of directors informed.
96
On which of the following factors should an IS auditor primarily focus when determining the appropriate level of protection for an information asset?
Results of a risk assessment.
97
Effective IT governance ensures the IT plan is consistent in the organization's...
business plan.
98
What is the best way to determine whether a contract for a vendor providing services is adhered to after it is signed?
Conduct periodic audit reviews of the vendor.
99
To address the risk of operations staff's failure to perform the daily backup, management requires that they systems administrator sign off on the daily backup. This is an example of
risk mitigation
100
The most important point of consideration for an IS auditor while reviewing an enterprise's project portfolio is that it...
is aligned with business plan.
101
Regarding the outsourcing of IT services, what is the greatest concern of the IS auditor?
Core activities that provide a differentiated advantage to the organization have been outsources. These should generally NOT be outsourced because they are what the organization does best. An IS auditor observing such a condition should be concerned.
102
An enterprise hosts its data center onsite and has outsourced the management of its key financial apps to a service provider. What control best ensures that the service provider's employees adhere to the security policies?
An indemnity clause is included in the contract with the service provider, which ensures compliance to the enterprise's security policies. Any violation discovered will lead to a financial liability for the service provider.
103
Which of the following IT governance good practices improves strategic alignment? Supplier and partner risk managed_a knowledge base of customers, products, markets, and processes is in place_a structure is provided that facilitates the creation and sharing of business information_top management between the imperatives of business and technology.
Top management between the imperatives of business and technology. This is an IT strategic alignment good practice.
104
An IS auditor finds that not all employees are aware of the enterprise's information security policy. This IS auditor should conclude that...
the lack of knowledge may lead to unintentional disclosure of sensitive information.
105
Which of the following is the best reference for an IS auditor to determine a vendor's ability to meet service level agreement (SLA) requirements for a critical IT security service? Compliance with the master agreement...Agreed-on key performance indicators...Results of business continuity tests...Results of independent audit reports
Agreed-on performance indicators that allow for a means to measure performance. SLAs are are statements related to expected service level.
106
A top-down approach to the development of operational policies helps to ensure
that they are consistent across the organization. Deriving low-level policies from corporate policies (i.e., a top-down approach) aids in ensuring consistency across the organization and consistency with other policies.
107
While reviewing a quality management system, the IS auditor should primarily focus on collecting evidence to show that
continuous improvement targets are being monitored.
108
A benefit of open system architecture is...
it facilitates interoperability within different systems. Open systems are those for which suppliers provide components whose interfaces are defined by public standards, thus facilitating interoperability between systems made by different vendors.
109
An IS auditor observes that an enterprise has outsourced software development to a third party that is a startup company. To ensure that the enterprise's investment in software is protected, which of the following should be recommended by the IS auditor?
There should be a source code escrow agreement in place. This is recommended primarily to help protect the investment in software, because the source code will be available through a trusted third party and can be retrieved if the start-up vendor goes out of business.
110
During an audit, the IS auditor discovers that HR uses a cloud-based app to manage employee records. The HR dept. engaged in a contract outside of the normal vendor management process and manages the app on its own. Which is the greatest concern?
Organization-defined security policies are not applied to the cloud app. Cloud apps should adhere to the org-defined security policies to ensure that the data in the cloud are protected in a manner consistent with internal apps, including password policies, user access management policies, data classification policies, et al.
111
An IS audit dept. is planning to minimize the risk of short-term employees. Activities contributing to this objective are:
documented procedures, knowledge sharing, cross training, and succession planning.
112
Succession planning ensures
that internal personnel with the potential to fill key positions in the org are identified and developed.
113
IT steering committee typically has the following responsibilities, since it provides insight to the board..
1. Approving IT project plans and budgets.
| 2. Approving IT project plans and budgets
114
IT strategy committee responsibilities include...
1. Aligning IT to business objectives.
2. Advising on compliance risk.
3. Promoting IT governance practices.
and other issues related to business objectives, risk and governance.
115
Auditing a service provider, find that service provider has outsourced part of the work. Because work involves confidential information, IS auditor's primary concern should be that...
risk that the requirement for protecting confidentiality of information can be compromised.
116
You discover several IT-based projects were not approved by the IT steering committee. What's the greatest concern?
The IT department may not be working toward a common goal. Steering committee provides direction and control over projects to ensure the company is making appropriate investments. Sans approval, projects may not be working toward the company's goals.
117
Enterprise seeks cloud hosting svcs from a cloud vendor with a high level of maturity. What's most imp for auditor to ensure continued alignment with the enterprise's security requirements?
The vendor agrees to provide annual reports in the contract. This is the only way to ensure that any potential risk is mitigated today and in the future, by including a clause within the contact that the vendor will provide future external audit reports. Sans this clause, the vendor can choose to forego future audits.
118
Orgs requiring mandatory vacation each year primarily want to ensure
that potential irregularities in processing are identified by the temporary replacements.
119
Two orgs merge. Multiple developed legacy apps from both orgs are to be replaced by a new common platform. What's the greatest risk?
The replacement effort consists of several independent projects without integrating the resource allocation in a portfolio management approach. The efforts should be consolidated to ensure alignment with the overall strategy of the postmerger org.
120
The primary objective of implementing corporate governance is...
to provide a strategic direction.
121
Corporate governance is...
a set of management practices to provide strategic direction to the organization as a whole, thereby ensuring that goals are achievable, risk is properly addressed, and org resources are properly used.
122
When reviewing an org's approved software product list, what is the most important thing to verify?
The risk associated with the use of the products is periodically assessed. Changes often occur with vendors.
123
The primary control purpose of required vacations or job rotations is to...
detect improper or illegal employee acts.
124
When auditing the IT governance framework and IT management practices that exist within an organization, the IS auditor identified some undefined responsibilities regarding IT management and governance roles. Which is most appropriate?
Implement accountability rules within the organization. IT risk is managed by embedding accountability rules to ensure that all responsibilities are defined within the organization. Note this question asks about the best recommendation, NOT about finding the risk.
125
Which if the following should be of primary concern to an IS auditor reviewing the management of external IT service providers?
Minimizing costs for the services provided. For the IS auditor, the primary objective of auditing the management of service providers should be to determine if the services requested were provided in a way that is acceptable, seamless, and in line with contractual agreements.
126
As a driver of IT governance, transparency of IT's cost, value, and risk is primarily achieved through...
Performance Management, which includes setting and monitoring measurable objectives of that which the IT processes need to deliver (process outcome), and how they deliver it (process capability and performance). Transparency is primarily achieved through performance measurement, because it provides information to the stakeholders on how well the enterprise is performing when compared to objectives.
127
Responsibility for the governance of IT should rest with the...
Board of Directors.
128
To aid management in achieving IT and business alignment, an IS auditor should recommend the use of...
an IT balanced scorecard.
129
In a review of the human resources policies and procedures within an organization, an IS auditor is most concerned with the absence of a...
termination checklist. A termination checklist is critical to ensure the logical and physical security of an enterprise.
130
During an audit, an IS auditor notices that the IT dept. of a medium-sized organization has no separate risk management function, and the organization's operational risk documentation only contains a few broadly described types of IT risk. What is the most appropriate recommendation in this situation?
Establish regular IT risk management meetings to identify and assess risk and create a mitigation plan as input to the organization's risk management. Establishing regular IT risk management meetings is the best way to identify and assess IT-related risk in a medium-sized organization, to address responsibilities to the respective management, and to keep the risk register and mitigation plans up to date.
131
An IS auditor reviewing an org that uses cross-training practices should assess the risk of...
one person knowing all parts of a system. Potential exposure related to abuse of privilege (not training in all aspects, or holding back, for example).
132
When reviewing the development of info security policies, the PRIMARY focus of an IS auditor should be on assuring all the policies...
strike a balance between business and security requirements. Info security policies must align with an org's business and security objectives. This should be the primary focus of an IS auditor when reviewing the "development" of info security policies.
133
Which of the following is normally a responsibility of the chief information security officer?
Periodically reviewing and evaluating the security policy. The role of the chief info security officer is the ensure the corporate security policy and controls are adequate to prevent unauthorized access to the enterprise assets, including data, programs, and equipment.
134
In reviewing risk management, what is most important to consider?
It risk is presented in business terms. (must be aligned with business objectives)
135
Poor choice of passwords and unencrypted data transmission over unprotected communication lines are examples of...
vulnerabilities.
136
Which sampling method is most appropriate for testing automated invoice authorization controls to ensure that exceptions are not made for specific users?
Stratified random sampling.
137
Which of the following the most important for an IS auditor to consider when reviewing an SLA with an external IT service provider?
Uptime guarantee (and other measurable terms of performance.
138
The rate of change in technology increases the importance of
implementing and enforcing sound processes. Change control requires that good change management process be implemented and enforced.
139
What is the primary consideration for an IS auditor reviewing the prioritization and coordination of IT projects and program management?
Projects are aligned with the organization's strategies, because their primary goal is to add value to the business.
140
Establishing the level of acceptable risk is the responsibility of?
Senior business management should establish the acceptable risk level because they have the ultimate or final responsibility for the effective and efficient operation of the organization as a senior manager of the business process. This person can be the quality assurance (QA), chief information officer (CIO), or the chief security officer (CSO), but the responsibility rests with the business manager.
141
Which factor is most critical when evaluating the effectiveness of an IT governance implementation?
Determine stakeholder requirements and involvement. This drives the success of the project. Based on this, the assurance scope and objectives are determined.
142
What is the most critical function to be performed by IT management when a service has been outsourced?
Monitoring the outsourcing provider's performance to ensure that services are delivered to the enterprise as required.
143
Value Delivery from IT to the business is most effectively achieved by
Aligning the IT strategy with the enterprise's strategy.
144
An employee who has access to highly confidential information resigned. Upon departure, which of the following should be done first?
Revoke access to all systems.
145
The ultimate purpose of IT governance is?
To encourage optimal use of IT. It is different for every enterprise.
146
Which type of situation is addressed by a software escrow agreement?
The vendor of custom=written software goes out of business. This is a legal agreement between a software vendor and a customer to guarantee access to source code. The code is held by a trusted third-party. according to the contract. This is necessary in case the vendor goes out of business or if a contractual dispute surfaces.
147
When reviewing an organization's strategic IT plan, an IS auditor should expect to find what?
An assessment of the fit of the organization's application portfolio with business objectives. This assessment supports the organization's business objectives, and is a key component of the overall IT strategic planning process. This assessment drives the demand side of IT planning, and should convert into a set of strategic IT intentions. The purpose of an IT strategic plan is to set out how IT will be used to achieve or support an org's business objectives.
148
When developing a security architecture, which of the following steps should eb considered first?
Defining a security policy is the first step toward building a security architecture. It communicates a coherent security standard to users, management, and technical staff. Security policies often set the stage in terms of the tools and procedures that are needed for an organization.
149
When developing a formal enterprise security program, the most critical success factor is the
Effective support of an executive sponsor. The executive sponsor is in charge of supporting the org's strategic security program and aids in directing the org's overall security management activities. Therefore, support by the executive level of management is the most critical success factor.
150
When an employee is terminated from service, the most important action is to
disable the employee's logical access.
151
What is the best enabler for strategic alignment between business and IT?
Goals and metrics. These ensure that IT goals are set based on business goals, and they are best enablers of strategic alignment.
152
What does an auditor consider the most relevant to short-term planning for an IT department?
Allocating resources. The IT dept. should specifically consider the manner in which resources are allocated in the short term. The IS auditor ensures that the resources are being managed adequately.
153
What should be of greatest concern to an IS auditor when reviewing an information security policy?
The policy is driven by an IT dept.'s objectives. Biz objectives drive the information security policy, and the information security policy drives the selection of IT dept. objectives. A policy that is driven by IT objectives is at risk of not being aligned with business goals.
154
What does a lack of adequate security controls represent?
A vulnerability. It exposes sensitive info and data to the risk of malicious damage, attack or unauthorized access by hackers.
155
An IS auditor was hired to review e-business security. The IS auditor's first task was to examine each existing e-business application, looking for vulnerabilities. What is the next task?
Identify threats and the likelihood of occurrence. Step order: 1) identify assets. 2) look for vulnerabilities. 3) identify the threat and likelihood of occurrence.
156
The most important objective when implementing an IT governance framework in an organization is
IT alignment with the business. The goals of IT governance are to improve IT performance, deliver optimum business value, and ensure regulatory compliance. The key practice pin support of these goals is the strategic alignment of IT with the business.
157
When performing a review of a business process reengineering (BPR) effort, the primary concern is
Controls are eliminated as part of the streamlining business process reengineering (BPR) effort. A primary risk of BPR is that controls are eliminated as part of the reengineering effort. This is the primary concern.
158
What is the best way to ensure that org policies comply with legal requirements?
Periodic review by subject matter experts.
159
The primary objective on an IT performance measurement process is
to Optimize Performance. Can also be used to measure and manage products/services, assure accountability, and make budget decisions.
160
When auditing a service provider for a government program involving confidential information, an IS auditor noted the service provider delegated a part of the IS work to another subcontractor. What provides the most assurance that the requirements for protecting confidentiality of information are being met?
Periodic independent audit of work delegated to the subcontractor. These audits provide reasonable assurance that the requirements for protecting confidentiality of information are not compromised.
161
The most important element for the effective design of an information security policy is the...
Enterprise risk appetite. This is the amount of risk on a broad level that an entity is willing to accept in pursuit of its mission to meet its strategic objectives. The purpose of the information security policy is to manage information risk to an acceptable level, so that the policy is principally aligned with the risk appetite.
162
To gain an understanding of the effectiveness of an organization's planning and management of investments in IT assets, an IS auditor should review the:
The IT balanced scorecard. This is the tool that provides the bridge between IT objectives and business objectives by supplementing the traditional financial evaluation with measures to evaluate customer satisfaction, internal processes, and the ability to innovate. In this way, the auditor can measure the success of the IT investment and strategy
.
163
What is the initial step in creating a firewall policy?
The identification of network application to be externally accessed. After identification depending on the physical location of these applications in the network and network model, the person in charge will be able to understand the need for, and possible methods of, controlling access to these applications.
164
As an outcome of information security governance, strategic alignment provides...
Security requirements driven by enterprise requirements. Information security governance should provide four basis outcomes: 1.) strategic alignment, 2.) value delivery, 3.) risk management, and 4.) performance measurement.
165
Which of the four basic outcomes provided by information security governance provides input for security requirements driven by enterprise requirements?
Strategic alignment
166
The output of the risk management process is an input for making what?
Security policy decisions.
167
Overall qualitative business risk for a particular threat can be expressed as...
A product of the likelihood and magnitude of the impact if a threat successfully exploits a vulnerability. Overall business risk takes into consideration the likelihood and magnitude of the impact when a threat exploits a vulnerability, and provides the best measure of the risk to an asset.
168
When reviewing the IT strategic planning process, an IS auditor should ensure that the plan...
articulates the mission and vision is correct. The strategic plan must include a clear articulation of the IT mission and vision.
169
In reviewing the IT short-range (tactical) plan, an IS auditor should determine whether what?
There is an integration of IT and business personnel within projects.
170
During an audit, which of the following situations are most concerning for an organization that significantly outsources IS processing to a private network?
If the contract does not contain a right-to-audit clause for the third party. Lack of this clause impacts the auditor's ability to perform the IS audit, so this should be of ultra concern.
171
Which of the following goals do you expect to find in an organization's strategic plan?
Approved suppliers for products offered by the company.
172
IT governance is primarily the responsibility of the what?
Board of Directors
173
An org has contracted with a vendor for a turnkey solution for their electronic toll collection system (ETCS). The vendor has provided its proprietary application software as part of the solution. The contract should require that...
The source code of the ETCS application is placed in escrow.
174
An organization has outsourced its help desk activities. An IS auditor's greatest concern when reviewing the contract and associated service level agreement between the org and vendor should be the provisions for what?
Independent audit reports or full audit access. A provision must be made for independent audit reports that cover all essential areas, or that the outsourcer has full audit access.
175
A financial services enterprise has a small IT dept., and individuals perform more than one role. What practices represent the greatest risk?
The developers promote code into the production environment.
176
What should the IS auditor recommend to best enforce alignment of an IT project portfolio with strategic organizational priorities?
Select projects according to the business benefits and risk. This is the best measure for achieving alignment of the project portfolio to an organization's strategic priorities.
177
What is of the most interest to an IS auditor reviewing an organization's risk strategy?
That all likely risk is identified and ranked. Without knowing the risk, there is no risk strategy.
178
In the context of effective information security governance, the primary objective of value delivery is to what?
Optimize security investments in support of business objectives.
179
When segregation of duties concerns exist between IT support staff and end users, what would be a suitable compensating contro
Reviewing transaction and application logs directly addresses the threat posed by poor segregation of duties. This review is a means of detecting inappropriate behavior and also discourages abuse, because people who may otherwise be tempted to exploit the situation are aware of the likelihood of being caught.
180
Third party application purchased. Org made significant mods. While auditing the development process for this critical, customer-facing app, the auditor noted the vendor has only been in business one year. What helps to mitigate the risk related to the continued app support?
A software escrow agreement is secured for the source code, in case the vendor goes out of business.
181
The initial step in establishing an information security program is
adoption of a corporate information security policy statement. It reflects the intent and support provided by executive management for proper security and establishes a starting point for developing the security program.
182
From an IT governance perspective, what is the primary responsibility of the board of directors?
To ensure that the IT strategy is aligned with the business strategy.
183
An IS auditor is verifying IT policies and finds that some of the policies have not been approved by management (as required by policy), but the employees strictly follow the policies. What should the auditor do first?
Report the absence of documented approval is correct. The auditor must report the finding. Unapproved policies may present a potential risk to the organization, even if they are being followed, because this technicality may prevent management from enforcing the policies in some cases and may present legal issues. For example, if an employee was terminated as a result of violating an org policy, and it was discovered that the policies had not been approved, the org may face an expensive lawsuit.
184
haring risk is a key factor in which of the following methods of managing risk?
Transferring risk.
185
A LAN administrator is normally restricted from
having programming responsibilities.
186
An IS auditor is reviewing a contract management process to determine the financial viability of a software vendor for a critical business application. An IS auditor should determine whether the vendor being considered...
Can support the organization in the long term.
187
Which of the following is most critical for the successful implementation and maintenance of a security policy?
Assimilation of the framework and intent of a written security policy by all appropriate parties. If not assimilated into daily action, the policy will not be effective.
188
What is the primary benefit of requiring a steering committee to oversee IT investment?
To ensure that investments are made according to business requirements. A steering committee consists of representatives from the business and IT and ensures that IT investment is based on business objectives rather than on IT priorities.
189
What best provides assurance of the integrity of new staff?
Background screening.
190
What is the most important IS audit consideration when an org outsources a customer credit review system to a third-party?
Agrees to be subject to external security reviews, because this is critical since customer credit info will be kept with the vendor.
191
An IS auditor is performing a review of the software quality management process in an org. The first step should be
To request all standards adopted by the org. An audit measures compliance with the standards of the organization.
192
An IS auditor is reviewing an IT security risk management program. Measures of security risk should
consider the entire IT environment. When assessing IT security risk, it is important to consider the entire IT environment.
193
What does an IS auditor consider to be most important when evaluating an org's IT strategy?
Supports the business objectives of the org. Both short and long term strategic plans should be consistent with the org's broader plans and business objectives for attaining these goals.
194
Which of the following insurance types provide for a loss arising from fraudulent acts by employees?
Fidelity coverage covers the loss arising from dishonest or fraudulent acts by employees.
195
A team conducting a risk analysis is having difficulty projecting the financial losses that could result from a risk. To evaluate the potential impact, the team should
Apply a qualitative approach in which the manager affected by the risk defines the impact in terms of a weighted factor. (such as 1 for low and 5 for high)
196
An org is considering making a major investment in upgrading technology. What is most important to consider?
A risk analysis. Once performed, this is presented to business unit management for review and acceptance.
197
Which of the following does an IS auditor first reference when performing an IS audit?
Approved policies.
198
Errors in audit procedures primarily impact which of the following risk types?
Detection risk, which is the possibility that the audit procedures may fail to detect the existence of a material error or fraud.
199
Corporate IT policy for a call center requires all users must be assigned unique user accounts. On discovering that this is not the case for all current users, what is the most appropriate recommendation?
Implement individual user accounts for all staff.
200
The most likely effect of the lack of senior management commitment to IT strategic planning is what?
Technology not aligned with org objectives. A steering committee should exist to ensure that the IT strategies support the org's goals. The absence of an info technology committee, or one not comprised of senior managers is an indication of a lack of top-level management commitment. This condition increases the risk that IT is aligned with the org's strategy.
201
an IS auditor is assigned to review IT structures and activities recently outsourced to various providers. Which of the following should the IS auditor determine first?
The contractual warranties of the providers support the business needs of the organization. The primary requirement is meet the business needs.
202
A small org had only one DBA and one system administrator. The DBA has root access to the Unix server, which hosts the DB app. How should segregation of duties be enforced in this scenario?
Ensure the DB logs are forwarded to a UNIX server where the DBA does not have root access. By creating logs that the DBA cannot erase or modify, segregation of duties is enforced.
203
To support an org's goals, an IT department should have
Long-term and Short-term plans.
204
An enterprise selected a vendor to develop and implement a new software system. To ensure that the enterprise's investment in software is protected, which of the following security clauses is most important to include in the master services agreement?
Software escrow, as it ensures the software source code will still be available to the org in the event of an issue with the vendor.
205
Which of the following should be the most important consideration when deciding on areas of priority for IT governance implementations?
Business risk.
206
An IS auditor is evaluating the IT governance framework of an organization. Which of the following is the greatest concern?
Senior management has limited involvement.
207
During a feasibility study regarding outsourcing IT processing, the relevance for the auditor of reviewing the vendor's business continuity plan is to...
Evaluate the adequacy of the service levels that the vendor can provide in a contingency.
208
An IS auditor is evaluating a newly developed IT policy for an org. Which of the following factors does the IS auditor consider most important to facilitate compliance with the policy upon its implementation?
Existing mechanisms enabling compliance. The org should be able to comply with a policy when it is implemented.
209
After an organization completed a threat and vulnerability analysis as part of a risk assessment, the final report suggested that an intrusion prevention system (IPS) should be installed at the main internet gateways and all business units should be separated via a proxy firewall. Which of the following is the best method to determine whether the controls should be implemented?
A cost-benefit analysis.
210
An IS auditor reviewing an outsourcing contract of IT facilities expects it to define the...
ownership of intellectual property. The contract must specify who owns the intellectual property.
211
Which of the following is responsible for the approval of an information security policy?
Board of directors (top mangement)
212
Auditor find that the enterprise architecture (EA) recently adopted by an organization has an adequate current-state representation. However, the organization has started a separate project to develop a future-state representation. The IS auditor should...
report this issue as a finding in the audit report. It is critical for the EA to include the future state because the gap between the current and future state will determine IT strategic and tactical plans. If the EA does not include future state representation, it is not complete. This issue should be reported as a finding.
213
IS control objectives are useful to IS auditors because they provide the basis for understanding the...
desired result or purpose of implementing specific procedures. An IS objective is defined as the the statement of the desired result or purpose to be achieved by implementing control procedure in any particular IS activity.
214
An organization is migrating from a legacy system to an enterprise resource planning system. While reviewing the data migration activity, the most important concern for the auditor is to determine that there is a...
correlation of semantic characteristics of the data migrated between the two systems. The structure of the data should be the same in the new system as in the old system.
215
Which of the following is an advantage of an integrated test facility (ITF)?
Periodic testing does not require separate test processes. An ITF creates a fictitious entity in the DB to process test transactions simultaneously with live input. Its advantage is that periodic testing does not require separate test processes. Careful planning is necessary, and test data must be isolated form production data.
216
Which of the following data validation edits is effective in detecting transposition and transcription errors?
Check digit. A check digit is a numeric value that is calculated mathematically and is appended to data to ensure that the original data have not been altered (e.g., an incorrect, but valid, value substituted for the original). This control is effective in detecting transposition and transcription errors.
217
An IS auditor is reviewing the software development process for an organization Which of the following functions are appropriate for the end users to perform?
Program output testing. A user can test program output by checking the program input and comparing it with the system output. This task, although usually done by the programmer, can also be done effectively by the user.
218
An IS auditor performing a review of a major software development project finds that it is on schedule and under budget even though the software developers have worked considerable amounts of unplanned overtime. The IS auditor should...
investigate further to determine whether the project plan may not be accurate.
219
An org is implementing a new system to replace legacy system. Which if the following conversion practices created the greatest risk?
Direct cutover. This implies switching the new system immediately, usually sans the ability to revert back. All other alternatives are done gradually.
220
Auditor performs review of major software development project and finds that it is on schedule and under budget, even though the software developers have worked considerable amounts of unplanned overtime. The auditor should...
Investigate further to determine whether the project plan may not be correct. Although the dates on which key projects are completed is important, there may be an issue with the project plan if an extraordinary amount of overtime is required to meet those dates.
221
Which of the following is a characteristic of timebox management?
Prevents cost overruns and delivery delays. Timebox management sets specific time and cost boundaries. Ensures that each segment of the project is divided into small controllable time frames.
222
While evaluating the "out of scope" section specified in the project plan, an IS auditor should ascertain whether the section...
Effectively describes project boundaries.
223
When a new system is to be implemented within a short time frame, it is most important to...
perform user acceptance testing to ensure it is working effectively.
224
Which of the following should be developed during thee requirements phase of a software development project to address aspects of software testing?
User Acceptance Test Specifications. The users should be involved in the requirements definition phase of a project and user-acceptance test specifications should be developed during this phase.
225
Regression testing is undertaken primarily to ensure
Applied changes have not introduced new errors.
226
During which phase of software application testing should an org perform the testing of architectural design?
Integration testing
227
When identifying an earlier project completion time (for premium payment), the activities that should be selected are those...
that have zero slack time.
228
What kind of path's activity time is longer than that for any other path in the network?
A critical path.
229
The knowledge base of an expert system that uses questionnaires to lead the user through a series of choices before a conclusion is reached is known as...
Decision trees. These use questionnaires to leas a user through a series of choices until a conclusion is reached.
230
Which of the following should be included in a feasibility study for a project to implement an electronic data interchange process?
The necessary communication protocols.
231
The greatest advantage of rapid application development (RAD) over the traditional system development life cycle is that it...
shortens the development time frame.
232
When reviewing an active project, the auditor observed that the business case was no longer valid because of a reduction in anticipated benefits and increased costs. The auditor should recommend that the...
Business case be updated and possible corrective actions be identified.
233
During the requirements definition stage of a proposed enterprise resource planning system, the project sponsor requests that the procurement and accounts payable modules be linked. What test method would be best ot perform?
Integration testing.
234
What technique is used to identify specific program logic that has not been tested?
Mapping
235
The phases and deliverables of a system development life cycle project should be determined...
throughout the work stages, based on the risk and exposures.
236
What best helps an IS auditor evaluate the quality of programming activities related to future maintenance capabilities?
Program coding standards
237
What is the best time for an auditor to assess the control specifications of a new application software package being considered for acquisition?
The requirements gathering process.
238
The main purpose of a transaction audit trail is to...
determine accountability and responsibility for processed transactions.
239
Information for detecting unauthorized input from a user workstation would be best provided by the...
Transaction Journal.
240
Which of the following controls helps prevent duplication of vouchers during data entry
A sequence check. Involves increasing the order of numbering and would validate whether the vouchers are in sequence and thus, prevent duplicate vouchers.
241
When planning to add personnel to tasks imposing time constraints on the duplication of a project, which of the following should be revalidate first?
The critical path for the project.
242
During the audit of an acquired software package, an IS auditor finds that the software purchase was based on information obtained through the Internet, rather than from responses to a request for proposal. The auditor should first...
ensure the procedure has been approved.
243
Following good practices, formal plans for implementation systems are developed during the...
design phase.
244
The primary objective of performing a post-incident review is that it presents an opportunity to...
improve internal control procedures by examining both the cause and response to an incident.
245
The use of object-oriented design and development techniques would most likely be...
to facilitate the ability to reuse modules.
246
Many IT projects experience problems because the development time and/or resource requirements are underestimated. Which of the following techniques provides the greatest assistance in developing an estimate of project duration?
A program evaluation review technique chart.
247
What's the best method of controlling scope creep in a system development project?
Establishing a software baseline.
248
What is a software baseline?
A cutoff point in the design phase which occurs after a rigorous view of user requirements. Any changes thereafter will undergo strict formal change control and approval procedures. Scope creep refers to uncontrolled change within a project resulting from improperly managed requirements.
249
An org sell books and music online at its secure website. Transactions are transferred to the accounting and delivery systems every hour to be processed. Which control best ensures that sales processed on the secure website are transferred to both the delivery and accounting systems?
Transactions are automatically numerically sequenced. Then the sequence is checked for gaps.
250
An IS auditor finds that user acceptance testing of a new system is being repeatedly interrupted by defect fixes from the developers. Which would be the best recommendation for the auditor to make?
Consider the feasibility of a separate acceptance environment.
251
A proposed transaction processing application will have many data capture sources and outputs in paper and electronic form. To ensure that transactions are not lost during processing, an IS auditor should recommend the inclusion of...
Automated systems balancing would be the best way to ensure that no transactions are lost as any imbalance between total inputs and total outputs would be reported form investigation and correction.
252
Which testing approach is most appropriate to ensure that internal application interface errors are identified as soon as possible?
Top-down testing. This approach ensures that interface errors are detected early and that testing of major functions is conducted early.
253
When implementing an app software package, which of the following presents the greatestrisk?
Incorrectly set parameters. These are an immediate problem that could lead to system breach, failure, or noncompliance.
254
Which of the following should an IS auditor review to gain an understanding of the effectiveness of controls over management of multiple projects?
Project portfolio database
255
An auditor assesses the project management process for an internal software development project. On respect to the software functionality, the auditor should look for sign-off by:
Business unit management
256
What is the best way to ensure that tested code (development) that is moved into production (change control management) is the same?
Release management software moves code into production without any manual intervention.
257
What is most relevant to an auditor evaluating how the project manager has monitored the progress of the project?
Gantt charts help to identify activities that have been completed early or late through comparison to a baseline.
258
What is the best method to facilitate successful user testing and acceptance of a new enterprise resource planning payroll system?
Parallel testing because it allows users to compare the results and system behavior before decommissioning the legacy system.
259
What is the most cost-effective recommendation for reducing the number of defects encountered during software development projects?
To implement formal software inspections (of code and design) to reduce the cost associated with corrections and rework.
260
A rapid app development methodology has been selected to implement a new ERP system. All of the project activities have been assigned to the contracted company because internal employees are not available. What is the auditor's first step to compensate for the lack of resources?
Review the project plan and approach.
261
The editing/validation of data entered at a remote site is performed most effectively at the...
remote processing site prior to transmission of the data to the central processing site.
262
What is a major advantage of prototyping?
Prototype systems can provide significant time and cost savings. Disadvantages include loss of overall security focus, project oversight and implementation of a prototype that is not yet ready for production.
263
What is the most important consideration while evaluating a business case for the acquisition of a new accounting application?
Return on Investment
264
What kind of software app testing is considered the final stage of testing and typically includes users outside of the development team?
Beta testing (final stage of testing and typically includes users from outside the development area).
265
An IS auditor finds that a system under development has 12 linked modules and each item of data can carry up to 10 definable attribute fields. The system handles several million of transactions every year. Which technique could an auditor use to estimate the size of the development effort?
Function point analysis is technique used to determine the size of a development task on the number of function points. These are factors such as inputs, outputs, inquiries and logical internal sites.
266
An auditor has been asked to participate in project initiation meetings for a critical project. The main concern should be that the...
Complexity and risk associated with the project have been analyzed.
267
An auditor has been asked to participate in project 's initiation meetings for a critical project. The auditor's main concern should be that...
complexity and risk associated with the project have been analyzed.
268
An auditor to a project development meeting notes that no project risk has been documented. When the IS auditor raises the issue, the project manager responds that it is too early to identify risk and that, if risk starts impacting the project, a risk manager will be hired. The appropriate response of the auditor is to...
Stress the importance of spending time at this point in the project to consider and document risk and develop contingency plans.
269
An enterprise is developing a new procurement system, and things are behind schedule. As a result, it is proposed that the time originally planned for the test phase be shortened. The project manager asks the IS auditor for recommendations to mitigate the risk associated with reduced testing. Which of the following is a suitable strategy?
Testing and release a pilot with reduced functionality reduces the risk in a number of ways. Reduced functionality should result in fewer overall test cases to run and defects to fix and retest, and in less regression testing. A pilot release made available to a select group of user will reduce the risk associated with a full implementation. All of the benefits of releasing the system to the full user population will not be realized, but some benefits should start to flow. Additionally, some useful comments from real users should be obtained to guide what extra functionality and other improvements need to be included in a full release.
270
An org is replacing a payroll program that it developed in-house, with the relevant subsystem of a commercial enterprise resource planning (ERP) system. Which if the following represent the highest potential risk? 1. Undocumented approval of some project changes...2. Faulty mitigation of historical data from the old to new system...3. incomplete testing of the standard functionality of the ERP subsystem...4. Duplication of existing payroll permissions on the new ERP subsystem.
Faulty mitigation of historical data from the old system to the new system is the most significant risk after a payroll system conversion is loss of data integrity and not being able to pay employees in a timely and accurate manner or have records of past payments. As a result, maintaining data integrity and accuracy during migration is paramount.
271
Which of the following best helps ensure that deviations from the project plan are identified?
Project performance criteria. To identify deviations from the project plan, project performance criteria must be established as a baseline. Successful completion of the project plan is indicative of project success.
272
An IS audit group has been involved in the integration of an automated audit tool kit with an existing enterprise resource planning system. Due to performance issues, the audit tool kit is not permitted to go live. What should the IS auditor's best recommendation be?
The appropriate recommendation is to review the results of stress tests during user acceptance testing that demonstrated the performance issues.
273
Which of the following helps an auditor evaluate the quality of new software that is developed and implemented?
The first report of the mean time between failures. This report represents flaws in the software that are reported by users in the production environment. This information helps the auditor when evaluating the quality of the software that has been developed and implemented.
274
An org is replacing a payroll program that it developed in-house, with the relevant subsystem of a commercial ERP system. Which of the following would represent the highest potential risk? undocumented change approval? Faulty migration of historical data? incomplete testing of standard functionality? Duplication of existing payroll permissions on the new system?
Faulty migration of historical data.
275
Which of the following best helps ensure that deviations from the project plan are identified?
Project performance criteria.
276
Which of the following system and data conversion strategies provides the greatest redundancy?
Parallel run. These are the safest (though most expensive) approach because both the old and new system are run, thus incurring what might appear to be double costs.
277
An enterprise is developing a new procurement system, and things are behind schedule. As a result, it is proposed that the time originally planned for the test phase be shortened. The project manager asks the IS auditor for recommendations to mitigate the risk associated with reduced testing. Which of the following is a suitable risk mitigation strategy?
Test and release a pilot with reduced functionality.
278
Which of the following helps an IS auditor evaluate the quality of new software that is developed and implemented?
The first report of the mean time between failures.
279
An IS audit group has been involved in the integration of an automated audit tool kit with an existing enterprise resource planning system. Due to performance issues, the audit tool kit is not permitted to go live. What should the IS auditor's best recommendation be?
Review the results of stress tests during user acceptance testing. These demonstrate the performance issues.
280
Due to a reorganization, a business application system will be extended to other departments. Which of the following should be of the greatest concern for an IS auditor?
Process owners have not been identified. When one app is expanded to multiple departments, it is important to ensure the mapping between the process owner and system functions. The absence of a defined process owner may cause issues with monitoring or authorization controls.
281
Normally, it would be essential to involve which of the following stakeholders in the initiation stage of a project?
System owners. These are the information system (project) sponsors or chief advocates.
282
What is the primary reason that an auditor would verify that the process of post-implementation review of an application was completed after a release?
To check that the project meets expectations. The objective of a post-implementation review is to reveal whether the implementation of a system has achieved planned objectives (i.e., meets business objectives and risk acceptance criteria).
283
Management observed that the initial phase of a multiphase implementation was behind schedule and over budget. Prior to commencing with the next phase, an IS auditor's primary suggestion for a postimplementation focus should be to...
Review the impact of program changes made during the first phase on the remainder of the project. Because management is aware that the project had problems, reviewing the subsequent impact will provide insight into the types and potential causes of the project issues. This will help to identify whether IT has adequately planned for those issues in subsequent projects.
284
The project steering committee is ultimately responsible for
Project deliverables, costs, and timetables.
285
Day to day management and leadership of a project is the responsibility of...
the project manager.
286
Providing funding for the project is the function of the
Project sponsor
287
Ensuring system controls are in place for a project is the responsibility of the...
Project security officer
288
During a postimplementation review, what should be performed?
Return on investment analysis (cost benefit) should be performed to verify the original business case benefits are delivered.
289
When should the activation of audit trails be performed?
Implementation
290
User acceptance testing is performed...
before implementation.
291
Which of the following is the most important element in the design of a data warehouse?
The quality of the metadata.
292
What is a copy of transaction data specifically structured for query and analysis?
A data warehouse
293
What describes the data in the warehouse and aims to provide a table of contents to the stored information?
Metadata
294
What's the most important component of a data warehouse?
Metadata
295
At the completion of a system development project, a post-project review should include what?
Identifying lessons learned that may be applicable to future projects.
296
Assignment of process ownership is essential in system development projects because it...
ensures that system design is based on business needs.
297
The most common reason for the failure of information systems to meet the needs of users is...
User participation in defining the system's requirements was inadequate.
298
The waterfall life cycle model of software development is most appropriately used when...
Requirements are well understood and are expected to remain stable, as is the business environment in which the system will operate. It's best with stable environments that have well-defined requirements.
299
What is the greatest risk to the effectiveness of application system controls?
Collusion between employees. Difficult to identify, and even well thought out controls can be circumvented.
300
What is the best indicator that a newly developed system will be used after it is production?
User acceptance testing
301
An auditor is reviewing a proposed app software acquisition. What nis one thing he should ensure?
The product is compatible with the current or planned OS.
302
An auditor is reviewing the software development capabilities of an org that has adopted an AGILE methodology. The auditor would be most concerned if
certain project iterations produce proof-of-concept deliverables and unfinished code.
303
The major consideration for a IS auditor reviewing an org's IT project portfolio is...
Business plan, and how well a project needs an org's strategic objectives.
304
The reason for establishing a stop or freezing point on the design of a new system is to...
require that changes after that point be evaluated for cost effectiveness.
305
An org recently deployed a customer relationship management application that was developed in-house. What is the best option to ensure that the application operates as designed?
Post-implementation review, which also evaluates how well the project managers kept the project on track.
306
Change control for bus app systems being developed can be complicated by the...
rapid pace of modifications in requirements and design.
307
An auditor recommends that an internal valuation control be programmed into a credit card transaction capture application. The initial validation process would most likely
verify the format of the number entered, then locate it in the database.
308
From a risk management point of view, the BEST approach when implementing a large and complex IT infrastructure is:
A deployment plan based on sequenced phases. When developing a large and complex IT infrastructure, a good practice is to use a phased approach to fit the entire system together. This will provide greater assurance of quality results.
309
An auditor has found time constraints and expanded needs to be the root causes for recent violations of corporate data definition standards in a new business intelligence project. Which of the following is the most appropriate suggestion for the auditor to make?
Achieve standards alignment through an increase of resources devoted to the project. Provided that the data architecture, technical and operational requirements are sufficiently documented, the alignment to standards could be treated as a specific work package assigned to new project resources.
310
An auditor who is auditing the software acquisition process will ensure that the...
contract is reviewed and approved by the legal counsel before it is signed. One of the most imp steps of the software acquisition process.
311
An auditor is reviewing a project for the implementation of a mission-critical system and notes that, instead of parallel implementation, the team opted for an immediate cutover to the new system. which is of greatest concern?
The implementation phase of the project has no back out plan. With parallel implementation, the original system can always be used as a back out plan.
312
An advantage in using a bottom-up versus top-down approach to software testing is that...
errors in critical modules are detected earlier. Bottom-up begins with testing of atomic units, such as programs and modules, and works upward until a complete system testing has taken place. The advantages of using a bottom-up approach to software testing are the fact that errors in critical modules are found earlier.
313
What has the most significant impact on the success of application systems implementation?
The overall org environment, which includes alignment between IT and business, the maturity o development processes, and the use of change control and other project management tools.
314
An auditor is assigned to audit a software development project, which is more than 80% complete, but has already overrun time by 10% and costs by 25%. Which action should the auditor take first?
Review the business case and project management. Before making any recommendations, the auditor needs to understand the project and the factors that have contributed to bringing the project over budget and over schedule.
315
The major advantage of a component-based development approach is the...
Support of multiple environments. Component-based development that relies on reusable modules can increase the speed of development. Software developers can then focus on business logic.
316
The major auditor is involved in the reengineering process that aims to optimize IT infrastructure. Which of the following will best identify the issues to be resolved?
Gap analysis. This would be the best method to identify issues that need to be addressed in the reengineering process. Gap analysis indicates which part of current processes conform to good practices (desired state) and which do not.
317
When reviewing input controls, an auditor observes that, in accordance with corporate policy, procedures allow supervisory override of data validation edits. The auditor should...
ensure that overrides are automatically logged and subject to review.m When overrides are allowed, automatic logging should should occur. A management individual who did not initiate the overrides should review them.
318
Which type of risk could result from inadequate software baselining?
Scope creep.
319
What carries the lowest risk when managing failures during a transition from legacy to new apps?
Parallel changeover, which involves first running the old system, then running both new and old in parallel, and finally fully changing over.
320
During a system development life cycle audit of human resources and payroll application, the auditor notes that the data used for user acceptance testing have been masked. The purpose of masking the data is to ensure the...
Confidentiality of the data.
321
A project development team is considering using production data for its test deck. The team removed sensitive data elements from the bed before loading it into the test environment. Which of the following additional concerns should an IS auditor have to practice?
Not all functionality will be treated. A primary risk of using production data in a test deck is that not all transactions or functionality may be treated if there are no data that meet the requirement.
322
What is most critical when creating data for testing the logic in a new or modified application system?
Data representing conditions that are expected in actual processing. Quality over quantity approach.
323
An auditor is reviewing a project that is using an agile software development approach. Which of the following should the auditor expect to find?
Post iteration reviews that identify lessons learned for future use in the project.
324
A failure discovered in which of the following testing stages would have the greatest impact on the implementation of new application software?
Acceptance testing, which is the final stage before the software is installed and available for use. Failures here could result in delays and cost overruns.
325
To minimize the cost of a software project, quality management techniques should be applied how?
Continuously throughout the project, with an emphasis on finding defects primarily through testing to maximize the defect detection rate. The major source of unexpected costs on most software projects is rework.
326
While reviewing an ongoing project, the auditor motes that the development team has spent eight hours of activity on the first day against a budget of 24 hours (over three days). The project time to complete the remaining activity is 20 hours. The auditor should report what?
That the project is behind schedule. Earned value analysis (EVA) is based on the premise that if a project task id assigned 24 hours for completion, it can be reasonably completed during this time frame. According to EVA, the project is behind schedule because the value of 8 hours spent on the task should only be 4, considering that 20 of the 24 budgeted hours remain.
327
An auditor is reviewing a recently completed conversion to a new enterprise planning system. In the final stage of the conversion process, the org ran the old and new systems in parallel for 30 days before allowing the new system to run on its own. What is the most significant advantage to the org by using this strategy?
Assurance that the new system meets functional requirements, which is why parallel conversion is the safest form of system conversion.
328
Which of the following should an auditor review to understand project progress in terms of time, budget, and deliverables for early detection of possible overruns and for project estimated at completion?
Earned value analysis. (EVA) This is the industry standard method for measuring a project's progress and any given point in time, forecasting its completion date and final cost, and analyzing variances in the schedule and budget as the project proceeds.
329
An org implemented a distributed accounting system, and the auditor is conducting a postimplementation review to provide assurance of the data integrity controls. Which of the following choices should the auditor preform first?
Review the data flow diagram to understand the flow of data within the application and to other systems. This enables the auditor to evaluate the design and effectiveness of the data integrity controls.
330
An auditor is reviewing an enterprise's system development testing policy. Which of the following statements concerning use of production data for testing would the auditor consider to be the most appropriate?
Senior IS and business management must approve use before production data can be used for testing.
331
Which of the following BEST helps an auditor assess and measure the value of a newly implemented system?
Post-implementation review. One key objective of a post-implementation review is to evaluate the project cost-benefits ot the return on investment measurements.
332
When two or more systems are integrated, the auditor must review input/output controls in the what?
Systems sending and receiving data, because the output for one system is the input for the other.
333
When reviewing a project where quality is a major concern, an auditor should use the project management triangle to explain that...
...
334
Three primary dimensions of the project management triangle are:
1. budget/cost, 2. time/schedule, 3. scope
335
Before implementing controls in a newly developed su\ystem, management should primarily ensure that the controls:
satisfy a requirement in addressing a risk.
336
Which is an advantage of the top down approach to software testing?
Interface errors are identified early.
337
Which of the following is of greatest concern to an auditor performing for a client relationship management (CRM) system migration project?
A single implementation is planned, immediately decommissioning the legacy system.
338
During which of the following phases in system development would user acceptance test plans normally be prepared?
Requirements definition.
339
An advantage of using sanitized live transactions in test data is that...
test transactions are representative of live processing.
340
An org is implementing an enterprise resource planning app. Who is primarily responsible for overseeing the project to ensure that it is in accordance with the project plan and that it will deliver the expected results?
Project steering committee.
341
Which of the following software testing methods provides the best feedback on how software will perform in the live environment?
Beta Testing. This follows alpha testing and involves real-world exposure with external user involvement. Beta testing is the last stage of testing and involves sending the beta version of the product to independent beta test sites or offering it free to interested users.
342
During development of an application, quality assurance testing and user acceptance testing were combined. The major concern for an IS auditor reviewing the project is that there will be...
improper acceptance of a program. Users may apply pressure to to accept a program that meets their needs even if it doesn't meet quality assurance standards.
343
A large industrial org is replacing an obsolete legacy system and evaluating whether to buy a custom solution or develop a system in-house. Which of the following will most likely influence the deicsion?
Technical skills and knowledge within the org related to sourcing and software development.
344
At the end of the testing phase of software development, an IS auditor observes that an intermittent software error has not been corrected. No action has been taken to resolve the error. The auditor should...
Recommend that the problem resolution be escalated. It's best to fully apprise the auditee and suggest that further problem resolutions be attempted including escalation, if necessary.
345
Which of the following best helps to prioritize project activities and determine the time for a project?
Program evaluation review technique (PERT). The PERT method works on the principle of obtaining project timelines based on project events for three likely scenarios - worst, best case, and normal. The timeline is calculated by a predefined formula and identifies the critical path, which identifies the key activitism that must be prioritized.
346
An auditor needs to review the procedures used to restore a software app to its state prior to an upgrade. Therefore, the auditor needs to assess...
backout procedures.
347
An IS auditor observed that multiple apps are hosted on the same new server. The recovery time objective (RTO) for the server will be...
independent of the RTO and based on the criticality of the application. When several apps are hosted on a server, the server's RTO must be determined b y taking the RTO of the most critical app, which is the shortest RTO.
348
Which scenario provides the best disaster recovery plan to implement for critical apps?
Daily data backups that are stored offsite and a hot site located 140 kilometers from the main data center. Not having real-time backups may be a problem depending on the recovery point objective (RPO).
349
An auditor discovers that developers have operator access to the command line of a production environment operating system. Which of the following controls would best mitigate the risk of undetected and unauthorized program changes to the production environment?
Hash keys are calculated periodically for programs and matched against hash keys calculated for the most recent authorized versions of the programs. The matching of hash keys over the time would allow detection of changes to files.
350
During maintenance of a relational database, several values of the foreign key in a transaction have been corrupted. The consequence is that...
The detail of involved transactions may no longer be associated with master data, causing errors when these transactions are processed.
351
The purpose of code signing is to provide assurance that...
The software has not been subsequently modified. Code signing ensures that the executable code came from a reputable source and has not been modified after being signed.
352
The responsibility for authorizing access to a business app system belongs to the..
Data owner. When a business app is developed, a good practice is to assign an information or data owner to the application. The information owner should be responsible for authorizing access to the application itself or to beck-end databases for queries.
353
The application systems of an organization using open-source software have no single recognized developer producing patches. Which of the following would be the most secure way of updating open-source sofware?
Identify and test suitable patches before applying them. Suitable patches from the existing developers should be selected and tested before applying them.
354
The cost of ongoing operations when a disaster recovery plan (DRP) is in place, compared to not having a DRP, will most likely...
Increase - due to additional costs for testing, maintaining, and implementing the DRP measures.
355
Business units are concerned about the performance of a newly implemented system. Which of the following should an IS auditor recommend?
Develop a baseline and monitor system usage. The auditor should recommend the development of a performance baseline and monitor the system's performance against the baseline to develop empirical data upon which decisions for modifying the system can be made.
356
The best audit procedure to determine if unauthorized changes have been made to production code is to...
Examine object code to find instances of changes and trace them back to change control records.
357
An auditor reviewing an org's disaster recovery plan should primarily verify that it is...
Regularly reviewed and updated. The plan should be reviewed at appropriate intervals. Otherwise it may be out of date and ineffective.
358
Which of the following is widely accepted as one of the critical components in networking management?
Configuration and change management. Configuration management is widely accepted as one of the key components of any network because it established how the network will function internally and externally.. It also deals with the management of configuration and monitoring performance. Change management ensures that the setup and management of the network is done properly, including managing changes to the configuration, removal of default passwords, and possibly hardening the network by disabling unneeded services.
359
If the recovery time objective increases...
The disaster tolerance increases. The longer the recovery time objective (RTO), the higher disaster tolerance. The disaster tolerance is the amount of time the business can afford to be disrupted before resuming critical operations.
360
A large chain of shops with electronic funds transfer at point-of-sale devices has central communications processor for connecting to the banking network. Which of the following is the best disaster recovery Plan for the communications processor?
Having an alternative standby processor at another network node would be the best solution. The unavailability of the central communications processor would disrupt all access to the banking network, resulting in the disruption of operations for all the shops. This could be caused by the failure of equipment, power, or communications.
361
Which of the following is the best reason for integrating the testing of noncritical systems in disaster recovery plans (DRPs) with business continuity plans (BCPs)?
BCPs may assume the existence of capabilities that are not in DRPs, such as allowing employees to work from home during the disaster, however, IT may not have made sufficient provisions for these capabilities. While noncritical systems are important, it is possible that they are not part of the DRPs.
362
During an audit of a small enterprise, the IS auditor noted that the IS director has superuser access that allows the director to process requests for changes to the application access roles (access types). Which of the following should the auditor recommend?
Implement a properly documented process for application role change requests, which could prevent or detect improper changes from being made to the major application roles. This application request process should start with, and be approved by, the business owner, then the IS director can make the changes to the application.
363
Which of the following controls would provide the greatest assurance of database integrity?
Table/link reference checks to detect table linking errors (such as completeness and accuracy of the contents of the database) provides the greatest assurance of database integrity.
364
Which of the following stakeholders is the most important in terms of developing a business continuity plan?
Process owners. These people are essential in identifying the critical business functions, recovery times and resources needed.
365
Which of the following is the best method to ensure that critical IT system failures do not recur?
Perform root cause analysis. This determines the key reason an incident has occurred and allows for appropriate corrections that will help prevent the incident from recurring.
366
An auditor is reviewing an org's disaster recovery plan (DRP) implementation. The project was completed on time and on budget. During the review, the auditor uncovers several areas of concern. Which of the following presents the greatest risk?
The business impact analysis (BIA) was conducted, but the results were not used. In this case, the DRP may not be designed to recover the most critical assets in the correct order. As a result, the plan may not be adequate to allow the org to recover from a disaster.
367
During an assessment of software development practices, an IS auditor finds that open software components were used in an application designed for a client. What is the greatest concern the auditor would have about the use of open source software?
The org and client must comply with open source license terms to avoid legal risks.
368
When performing a database review, an auditor notices that some tables in the DB are not normalized. The auditor should next...
review the justification, because in some cases, denormalization is recommended for performance reasons.
369
The process of structuring a database, usually a relational database, in accordance with a series of so-called normal forms in order to reduce data redundancy and improve data integrity is called...
Data normalization
370
Two months after a major app implementation, management, who assume that the project went well, requests that the auditor perform a review of the completed project. The primary focus for the auditor should be:
Review controls built into the system to assure they are operating as designed.
371
After a disaster declaration, the media creation date at a warm recovery site is based on the:
Recovery point objective. RPO Determined based upon acceptable data loss in case of disruption of ops.
372
Which database control would ensure that the integrity of transactions is maintained in an online transaction processing system's database?
Commitment and rollback controls. These are directly relevant to integrity.
373
Which is the most effective method for disposing of magnetic media that contains confidential information?
Destroying
374
A database administrator (DBA) who needs to make emergency changes to a database after normal working hours should log in...
with their named account to make changes.
375
Which of the following is a network diagnostic tool that monitors and records network information?
Protocol analyzer. These monitor and record network information from packets traveling in the link to which the analyzer is attached.
376
Which of the following would best support 24/7 availability?
Mirroring. Mirroring of critical elements is a tool that facilitates immediate (fallover) recoverability.
377
Which of the following represents the greatest risk created by a reciprocal agreement for disaster recovery made between two companies?
Developments may result in hardware and software incompatibility.
378
What strategy is most appropriate for a business having multiple offices within a region and a limited recovery budget?
A reciprocal arrangement between its offices. Each office would be designated as a recovery site for some other office. This would be the least expensive approach, and would provide an acceptable level of confidence.
379
Which of the following is most important to determine the recovery point objective for a critical process in an enterprise?
Extent of data loss that is acceptable.
380
Which of the following would contribute most to an effective business continuity plan?
Planning involves all user departments in the business continuity plan (BCP) is crucial for the identification of the business processing priorities and the development of an effective plan.
381
An auditor finds that the data warehouse query performance decreases significantly at certain times of the day. Which control would be the most relevant to review?
User spool and database limit controls.
382
What limit restricts the space available for running user queries?
User spool limits
383
The frequent updating of which of the following is key to the continued effectiveness of a disaster recovery plan?
Contact information of key personnel.
384
Which of the following inputs would primarily help in designing the data backup strategy in case of potential natural disasters?
Recovery point objective (RPO)
385
An auditor discovers that the disaster recovery plan (DRP) for a company does not include a critical application hosted in the cloud. Management's response states that the cloud vendor is responsible for disaster recovery and DR-related testing. What is the net course of action for the auditor?
Review the vendor contract to determine its DR capabilities.
386
While reviewing the IT infrastructure, an auditor notices that storage resources are continuously being added. The auditor should...
Review the capacity management process.
387
Which is the best way to ensure that incident response activities are consistent with the requirements of business continuity?
Develop a scenario and perform a structured walk-through.
388
What is an important consideration in providing backup for online systems?
Ensuring periodic dumps of transaction logs.
389
Which of the following is a major concern during a review of help desk activities?
Resolved incidents are closed without reference to end-users.
390
Which of the following ensures the availability of transactions in the event of a disaster?
Transmit transactions offsite in real-time.
391
Responsibility and reporting lines cannot always be established when auditing automated systems because:
ownership is difficult to establish where resources are shared.
392
When an organization's disaster recovery plan has a reciprocal agreement, which of the following risk treatment approaches is being applied?
Mitigation.
393
Vendors have released patches fixing security flaws in their software. Which of the following should an auditor recommend?
Assess the impact of patches prior to installation. Patches must be tested as much as possible before installation in order to prevent ill-effects to other systems.
394
A company with a limited budget has a recovery time objective of 72 hours and a recovery point objective of 24 hours. Which type of disaster recovery site best meets these requirements?
Warm site.
395
Which database controls would ensure that the integrity of transactions is maintained in an online transaction processing system's database?
Commitment and rollback controls are directly relevant to integrity. They ensure that database operations that form a logical transaction unit will be completed entirely or not at all.
396
A database administrator (DBA) who needs to make changes to a database after normal working hours should log in...
with their named account to make changes.
397
Which of the following is a network diagnostic tool that monitors and records network information?
Protocol analyzer. These are network diagnostic tools that monitor and record network information from packets traveling in the link to which the analyzer is attached.
398
What best supports 24/7 availability?
Mirroring. Mirroring of critical elements is a tool that facilitates immediate (fallover) recovery.
399
What represents the greatest risk created by a reciprocal agreement for disaster recovery made between two companies?
Developments may result in hardware and software incompatibility.
400
An IS auditor observed that users are occasionally granted the authority to change system data. This elevated access yet is required for smooth functioning of business operations. Which controls would the auditor most likely recommend for a long-term solution?
Review policy to see if a formal exception process is required.
401
An org is considering using a new IT service provider. From an audit perspective, which of the following would be the most important item to review?
The proposed service level agreement with the service provider.
402
Vendors have released patches fixing security flaws in their software. What should the auditor recommend?
Assess the impact of patches prior to installation. Installation should occur only after this evaluation. Testing the patches as much as possible before rollout is important to prevent negative effects.
403
What test performed by an auditor would be the most effective in determining compliance with change control procedures in an org?
Identify changes that have occurred and verify approvals.
404
Auditor observes that it takes a significantly long time for users to log on the a system during peak hours. Once logged on, the response time is acceptable. WhWhat should the auditor recommend?
Establish performance measurement criteria for authentication of servers. This would help to quantify acceptable thresholds for system performance, which can be measured and remediated?
405
What security measure best ensures the integrity of information stored in a data warehouse?
A read-only restriction
406
To verify the correct version of a data file was used for a production run, an IS auditor should review what?
System logs. These are automated reports which identify most activities performed on a computer.
407
Which of the following is a continuity plan test that simulates a system crash and uses actual resources to cost-effectively obtain evidence about the plan's effectiveness?
A preparedness test. This is a localized version of a full test. Resources are expended in the simulation of a system crash. Performed regularly. Cost-effective.
408
The most appropriate recovery strategy for a sensitive system with a high recovery time objective (RTO)?
Cold Site would be the most cost-effective.
409
For effective implementation after a business continuity plan (BCP) has been developed, it is most important that
The BCP be communicated to appropriate personnel.
410
An enterprise uses privileged accounts to process configuration changes for mission-critical apps. What is the best and most appropriate control to limit risk in this situation?
Ensure that supervisory approval and review (by accountable managers) are performed for critical changes.
411
During a data center audit, an auditor observes that some parameters in the tape management system are set to bypass or ignore tape header records. What's the best compensating control?
Staging and job setup.
412
What does the usage of structured query language help facilitate in an application connected to a database?
Structured query language facilitates portability of the application because it is an industry standard used by many systems.
413
A programmer maliciously modified a production program to change data and then restored it back to the original code. What would most effectively detect this activity?
Reviewing system log files. This is the only trail that may provide information about the unauthorized activities in the production library.
414
In reviewing an in-house application, the greatest concern for the auditor is if what?
If a manager initiates a change request and subsequently approves it. This violates the principle of SOD and no person should have this ability to approve their own requests.
415
What is the primary objective of the business continuity and disaster recovery plan (BCP)?
To protect human life.
416
What is the purpose of a check digit when reviewing a monthly AP register?
To detect data transportation errors. A check digit is a numeric value added to data to ensure that original data are correct and have not been altered.
417
The objective of concurrency control in a DB system is
To ensure integrity when two processes attempt to update the same data at the same time. Concurrency controls prevent data integrity problems.
418
As part of the BCP process, what should be identified first in the business impact analysis?
Critical business processes for ascertaining the priority for recovery. This should be addressed first so that the priorities and time lines for recovery can be documented.
419
While designing the BCP for an airline reservation system, the most appropriate method of data transfer/backup at an offsite location would be what?
Shadow file processing, where exact duplicates of the files are maintained at the same site or a remote site. The two files are processed concurrently. This is used for critical data files such as airline booking systems.
420
When reviewing the disaster recovery test, what is of greatest concern to the auditor?
During the test, some of the backup systems were defective or not working, causing the test of these systems to fail.
421
What is the purpose of the disaster recovery test?
To test the backup plan.
422
During the audit of a DB server, what is the greatest exposure?
Default global security setting for the DB remain unchanged. These settings could allow issues such as blank user passwords, or passwords that were the same as the username.
423
Which of the following should an auditor recommend for the protection of specific sensitive information stored in a data warehouse?
Implement column- and row- level permissions. These control what users can access.
424
What prevents users from seeing one or more attributes on a table?
Column-level security
425
What restricts a certain grouping of information on a table, such as salaries?
Row-level security
426
How is column-level and row-level security achieved on a DB?
Users can only access logical representations of data, or views, rather than physical tables.
427
Which of the following is MOST directly affected by network performance monitoring tools?
Availability. These allow an administrator to take corrective action when network problems are observed.
428
A new patch is available for an app. The IT dept has decided it is not needed because of other security controls that are in place. What should the auditor recommend?
Assess the overall risk, then recommend whether to deploy the patch. A risk assessment is necessary, then the patch would only be applied if the risk of circumventing the the existing controls is great enough to warrant it.
429
What is the best method to ensure that the BCP remains up to date?
The group walks through the different scenarios of the plan from beginning to end. This is called a structured walk-through test.
430
What are data flow diagrams used for by IS auditors?
To graphically summarize data paths and storage. They trace data from from their origination to their destination, highlighting the paths and storage of data.
431
What is most helpful when evaluating the effectiveness and adequacy of a preventive computer maintenance program?
A system downtime log. This provides evidence regarding the effectiveness and adequacy of computer preventive maintenance programs. It validates a preventive control.
432
When is it most appropriate to implement an incremental backup scheme?
When there is limited media capacity. After a full backup, only files that are changed are backed up, thus minimizing media storage.
433
In a small org, developers may release emergency changes directly to production. What best controls the risk in this situation?
Approve and document the change the next business day.
434
To optimize a BCP, an auditor should recommend a business impact analysis to determine what?
The business processes that must be recovered following a disaster to ensure the org's survival.
435
In a relational DB with referential integrity, what keys would prevent deletion of a row from a customer table as long as the customer number of that row is stored with live orders on the orders table?
A foreign key.
436
What is the best method to determine the criticality of each application system in the production environment?
Perform a business impact analysis. BIA will give the impact of the loss of each application.
437
Who is the Business Impact Analysis (BIA) conducted with?
A BIA is conducted with representatives of the business that can accurately describe the criticality of a system and its importance to the business.
438
The main purpose for periodically testing offsite disaster recovery facilities is to what?
Ensure the continued compatibility of the contingency facilities. The main purpose of offsite hardware testing is to ensure the continued compatibility of the contingency facilities so that assurance can be gained that the contingency plans would work in an actual disaster.
439
Auditor assess services provided by an ISP (internet service provider) during a compliance audit of a nationwide corp that operates a governmental program. What is most important to do?
Review the SLA (service level agreement). The SLA provides the basis for an adequate assessment of the degree to which the provider is reaching the agreed-upon service.
440
An auditor is reviewing the application change management process for a large multinational company. What is a big concern?
The configuration management database must be maintained. This is used to track configuration items and the dependencies between them. An outdated CMDB could result in incorrect approvals being obtained or leave out critical dependencies during the test phase.
441
The best method for assessing the effectiveness of a BCP is to review the what?
Results from previous tests. This will provide evidence of the BCP effectiveness.
442
Disaster recovery planning addresses the what?
Technical aspect of business continuity planning.
443
In an online transaction processing system, data integrity is maintained by ensuring that a transaction is either completed in its entirety or not at all. This principle of data integrity is called...
Atomicity
444
Verify an org's BCP is effective by reviewing what?
results of business continuity tests performed by IS and end-user personnel.
445
During an app audit, an auditor is asked to provide assurance of the DB referential integrity. In this case what should be reviewed?
The foreign key structure.
446
In a relational DB, what is the consistency between coupled (linked) tables called?
Referential Integrity.
447
What do we use to determine the acceptable time period for resumption of a critical business process?
Both, downtime costs and recovery costs need to be evaluated. Seeking an optimal balance between the two.
448
Reviewing a hardware maintenance program, an auditor should assess whether...
the program is validated against vendor specifications.
449
A DBA has detected a performance problem with some tables, which could be solved through denormalization. This situation will increase the risk of what?
A loss of data integrity. Normalization is the removal of redundant data elements from the DB. To disable this in a relational DB redundancy and the risk of not maintaining consistency of data, and a consequent loss of data integrity.
450
What do we use to determine if unauthorized modifications were made to production programs?
Compliance Testing. This would require that the change management process is reviewed to evaluate the existence of a trail of documentary evidence. Compliance testing would help to verify that the change management process has been applied consistently.
451
What is a major concern when reviewing a BCP?
Test results must be adequately docuemented.
452
Which function should a DB administrator never perform?
Installing patches or upgrades to the OS. This should be performed by the systems administrator.
453
If a DBA has read and write access to a production environment, the auditor should do what?
Assess the controls relevant to the DBA function. When reviewing privileged accounts, look for compensating controls that may address a potential exposure.
454
IT manager recently changed a vendor responsible for maintenance on critical systems in order to cut costs. The new vendor is less expensive but the contract specifies a change resolution time the same as the prior vendor. What's the greatest concern?
Application owners were not informed of the change.
455
If management states otherwise, but the auditor has reasons to believe the org is using unlicensed software, what should we do first?
Verify the software is in use via testing.
456
For some reason, a developer requires full access to production data to support certain problems. What is a good compensating control to prevent unauthorized changes to production?
Provide and monitor separate developer login IDs for programming and for production support. Must be backed up by monitoring.
457
During an implementation review of a recent app deployment, several incidents were assigned incorrect priorities and as a result, failed to meet the SLA. What's the greatest concern?
The support model was not properly developed and implemented.
458
IT management decided to install a level 1 Redundant Array of Inexpensive Disks (RAID) system in all servers to compensate for the elimination of offsite backups. You should recommend what?
Reinstating the offsite backups. RAID systems will not protect against a natural disaster. This problem will not be alleviated without offsite backups.
459
What is the best evidence of an org's disaster recovery capability readiness?
Results of tests and exercises
460
There is a major incident at an information processing facility. What should the response team address first?
Containment of the incident at the facility to minimize the spread of damage and gain control of the situation.
461
While performing the review of a critical third-party app, an IS auditor would be most concerned with discovering what?
An inadequate software escrow agreement.
462
It is most appropriate to implement an incremental backup scheme when
there is limited media capacity
463
To optimize an org's business continuity plan, an auditor should recommend a business impact analysis to determine
the business process that must be recovered following a disaster to ensure the org's survival.
464
In a relational DB with referential integrity, the use of which of which keys would prevent deletion of a row from a customer table as long as the customer number of that row stored with live the orders table?
Foreign key. In this type of DB a foriegn key would prevent events such as primary key changes and record deletions, resulting in orphaned relations within the database.
465
What is referential integrity?
Referential integrity refers to the relationship between tables. Because each table in a database must have a primary key, this primary key can appear in other tables because of its relationship to data within those tables. When a primary key from one table appears in another table, it is called a foreign key.
466
What is the best method for determining the criticality of each application system in the production environment?
Perform business impact analysis (BIA). Gives the impact of loss of each app.
467
Main purpose for periodically testing offsite disaster recovery facilities is what?
ensure the continued compatibility of contingency facilities.
468
Assessing services provided by an Internet Service Provider (ISP) during a compliance audit of a nationwide corp that operates a governmental program. What is most important?
Review the service level agreement (SLA), which provides the basis for an adequate assessment of the degree to which the provider is meeting the level of the agreed-upon service.
469
When it is most appropriate to implement an incremental backup scheme?
WHen there is limited capacity. In an incremental backup, after the full backup, only the files that have changed are backed up, thus minimizing media storage.
470
In a small org, developers may release emergency changes directly to production. What would best control the risk of this situation?
Approve and document the change the next business day. They must be approved and documented after the fact, if the programmers have this ability.
471
To optimize an org's BCP, an auditor should recommend a business impact analysis to determine what?
which business processes must be recovered following a disaster to ensure the org's survival.
472
In a relational database with referential integrity, the use of which keys would prevent deletion of a row from a customer table as long as the customer number of that row is stored with live order on the orders table?
Foreign key
473
A batch transaction job failed in production, but the same job returned no issues during user acceptance testing (UAT). Analysis of the production batch job indicates that it was altered after UAT. Which of the following ways would be best to mitigate this risk in the future?
Answer not provided
474
What is the best method for determining the criticality of each application system in the production environment?
Perform a business impact analysis (BIA). A BIA will give the impact of the loss of each application. A BIA is conducted with representatives of the business that can accurately describe the criticality of a system and its importance to the business.
475
The main purpose for periodically testing offsite disaster recovery facilities is to...
ensure the (continued) compatibility of the contingency facilities.
476
An IS auditor is assessing services provided by an ISP during an IS compliance audit of a nationwide corporation that operates a governmental program. Which of the following is MOST important?
To review the SLA to find a basis for adequate assessment.
477
An IS auditor reviewing the application change management process for a large multinational company should be MOST concerned when...
the configuration management database is not maintained. The CMDB is used to track configuration items (CIs) and the dependencies between them. An out-of-date CMDB in a large multinational company could result in incorrect approvals being obtained or leave out critical dependencies during the test phase.
478
The BEST method for assessing the effectiveness of a business continuity plan is to review the...
results from previous tests. This review will provide evidence of the effectiveness of the BCP.
479
Disaster recovery planning addresses the...
technological aspect of business continuity planning that focuses on IT systems and operations.
480
In an online transaction processing system, data integrity is maintained by ensuring that a transaction is either completed in its entirety or not at all. This principle of data integrity is known as what?
Atomicity
481
A hard disk containing confidential data was damaged beyond repair. If the goal is to positively prevent access to the data by anyone else, what should be done to the hard disk before it is discarded?
Destruction.
482
An auditor can verify that an org's BCP is effective by reviewing the what?
results business continuity tests performed by IS and end-user personnel.
483
During an application audit, an IS auditor is asked to provide assurance of the database referential integrity. Which of the following should be reviewed?
Foreign key structure.
484
In determining the acceptable time period for the resumption of critical business processes, which costs need to be evaluated?
Both, downtime costs and recovery costs.
485
When reviewing a hardware maintenance program, the auditor should assess whether...
the program is validated against vendor specifications.
486
a DB administrator has detected a performance problem with some tables, which could be solved through denormalization. This situation will increase the risk of what?
A loss of data integrity.
487
An auditor analyzing the audit log of a database management system finds that some transactions were partially excluded as a result of an error and have not been rolled back. Which of the following transaction Processing features have been violated.
Atomicity
488
If unauthorized modifications were made to production programs, what would the auditor use to determine this?
Compliance testing.
489
Which of the following should be a MAJOR concern for an auditor reviewing a BCP?
The results are not adequately documented. The effectiveness of the BCP can best be determined through tests. If the results are not documented, there is no basis for feedback, updates, etc.
490
In auditing a DB environment, the auditor will be MOST concerned if the DB administrator is performing which of the following functions?
Installation of patches or upgrades to the operating system. These functions should be preformed by the systems administrator, not the database administrator. Huge violation of SOD.
491
An auditor finds that a DBA has read and write access to production data. The auditor should///
Assess the controls relevant to the DBA function. When reviewing privileged accounts, the auditor should look for compensating controls that may address a potential exposure.
492
If an IT manager switches vendors for performing maintenance, and the resolution has changed, what is the greatest risk to the auditor?
That the application managers were not informed of the change.
493
Even though IT management states that they are not using unlicensed software, if suspected by the auditor, he should first do what?
Verify software is in use through testing to obtain evidence before including this in the report.
494
When auditing a BCP, an auditor finds that each dept has a separate BCP. THe auditor recommends these BCPs be reconciled. Which areas should be reconciled first?
The evacuation plan. Protecting human resources should always be addressed first.
495
Due to resource constraints, a developer requires full access to production data. What would be a good compensating control for controlling unauthorized changes in production?
Provide and monitor separate developer login IDs for programming and for production support.
496
During an implementation review of a recent app deployment, it was determined that several incidents were assigned incorrect priorities, which failed to meet the SLA. What is the greatest concern?
The support model was not properly developed and implemented.
497
IT management has decided to install a level 1 Redundant Array of inexpensive disks (RAID) system in all servers to compensate for the elimination of offsite backups. The auditor should recommend what?
Reinstating the offsite backups. RAIDs at any level will not protect against a natural disaster.
498
What provides the best evidence of an org's disaster recovery capability readiness?
Results of tests and exercises.
499
What should an incident response team address first after a major incident in an information processing facility?
Containment at the facility to gain control of the situation and prevent spread of damage.
500
If performing a review of a critical third-party application, an auditor should be MOST concerned with discovering what?
An inadequate software escrow agreement.
501
When a conducting a disaster recovery audit, what is most important to review?
Data backups are performed and stored offline.
502
When developing a disaster recovery plan, the criteria for determining the acceptable downtime should be the what?
Maximum allowable outage.
503
What is the primary objective of the BCP process?
To manage risk while recovering from an event that adversely affected operations.
504
Emergency changes that bypass the normal change control process are MOST acceptable if what?
Management reviews and approves the changes after they have occurred.
505
When patches for the OS are deployed by the IT department as advised by the vendor, what is the MOST significant concern the auditor should have for this practice that IT has not considered?
Delaying deployment until testing the impact of the patch.
506
What is MOST effective in reducing the risk that unauthorized software on a backup server is distributed to the production server?
Review changes in the software version control system.
507
When software changes are tracked and controlled using version control software, what should the IS auditor do?
Review reports or logs from this system to identify the software that is promoted to production.
508
What BEST helps prioritize the recovery of IT assets when planning for a disaster?
Business Impact Analysis
509
During review of data file change management controls, what BEST helps to decrease the research time needed to investigate exceptions?
Transaction logs. These generate an audit trail by providing a detailed list of date of input, user ID, terminal location, etc.
510
What is a key consideration when implementing a new application purchased from a vendor?
Ensuring the vendor default accounts and passwords have been disabled.
511
An organization has outsourced its help desk. What NEEDS to be included in the SLA?
First call resolution rate. This is a good way to measure the effectiveness of the support org.
512
When reviewing DB controls, auditor discovers that during normal hours, changes followed a standard set of procedures, but after hours, followed an abbreviated set of procedures. What is an adequate compensating control?
Use the DBA user account to make changes, log the changes, and review the changes on the following day.
513
What is the greatest risk to a customer org when a third-party cloud vendor is used to host patient health information?
The third-party svc provider reserves the right to access data to perform certain operations.
514
What BEST mitigates the risk of backup media containing irreplaceable information from being lost or stolen while in transit?
Maintain a duplicate copy.
515
A BCP does not adequately address info confidentiality during the recovery process. What should auditor recommend as a plan modification?
The level of information security required when business recovery procedures are invoked.
516
What is of MOST concern to an auditor reviewing a BCP?
The responsibility for declaring a disaster is not identified.
517
What DB activities should be performed by a different person than the DBA?
Deleting DB activity logs.
518
Assessing the suitability of a SLA between the org and outsourced svc provider. What should the auditor make sure the SLA contains?
A transition clause from the old supplier to the new supplier or back to internal in the case of expiration or termination. Prevents "pull the plug" event by old supplier.
519
During peak production hours, what is one event that could result in unexpected downtime?
Performing preventative maintenance on electrical systems.
520
What is the name of the test method that is appropriate to apply to a BCP?
The paper test (sometimes called deskcheck). This is a walk-through of the entire BCP (or in part).
521
What should be implemented as a recovery strategy when disaster downtime tolerance is low?
A hot site
522
What is disaster downtime tolerance?
The time gap during which the business can accept non-availability of IT facilities.
523
What is the recovery point objective?
The RPO is the earliest point in time at which it is possible to recover data.
524
What should be implemented as a recovery strategy when the recovery point objective is low?
Data Mirroring.
525
An org has implemented an online customer help desk app using a "software as a service" (SaaS) operating model. Recommend the best control to monitor the SLA with the SaaS vendor as it relates to availability.
Implement an online polling tool to monitor the application and record any outages. Compare internal reports with SLA reports to ensure the vendor's monitoring of the SLA is accurate and that all conflicts are resolved.
526
If an org has a business process with a recovery time objective (RTO) equal to zero, and recovery point objective (RPO) close to one minute, what does this imply that the process can tolerate?
A data loss of up to one minute, but the processing must be continuous.
527
What's the GREATEST risk of an org using reciprocal agreements for disaster recovery between two business units?
Both entities are vulnerable to the same incident.
528
The accuracy of source data is most critical to what aspect of data in a data warehouse?
quality
529
What is the greatest advantage of using web services for the exchange of information between two systems?
Efficient interfacing
530
While drafting a disaster recovery plan, what can be said about downtime costs?
They increase with time.
531
T/F Downtime costs are related to RPO?
False
532
Do recovery costs increase or decrease with the time allowed for recovery?
Decrease Recovery costs are higher when the recovery time is shorter (more expensive to recover in 2 days than it is to recover in 5).
533
T/F With good planning, recovery costs can be predicted and contained?
True
534
When restoring data after a disaster what is the best indicator of effectiveness of the backup and restore procedures?
That recovery time objectives were met.
535
What is the primary objective of the SLA?
To define, agree on, record, and manage the required levels of service.
536
Millions of transactions processed daily at an org with a central communications processor (switch) for connecting to automated teller machines. What is the best contingency plan for this processor?
Have an alternate processor at another network node.
537
A disaster recovery plan should address the early recovery of what?
Processing in priority order, as defined by business management.
538
What should the auditor do first to find the root cause of a slow server during disaster recovery?
Check the configurations and alignment of the primary recovery sites.
539
While reviewing the process for continuous monitoring of the capacity and performance of IT resources, an auditor should PRIMARILY ensure that the process is focused on what?
Providing accurate feedback on IT resource capacity.
540
What is the best backup strategy for a large database with data supporting online sales?
Mirrored hard disks, because they ensure all data are backed up to more than one disk, so that a failure of one disk will not result in a loss of data.
541
What would best ensure uninterrupted operations in an org with IT ops centers in several countries?
Employee training on the BCP.
542
Code erroneously excluded from a production release was subsequently moved into production, bypassing normal change procedures. When performing a postimplementation review, what is of most concern?
The change did not have management approval.
543
For disaster recovery requirements, backup intervals should NOT exceed the...
Recovery point objective.
544
Why apply a retention date to a file?
Ensure that the data will not be deleted before that date.
545
Comparing job run logs to computer job schedules, what observation is the greatest concern?
That there were instances when some jobs were overridden by computer operations. Could lead to unauthorized changes to data or programs. Critical.
546
An organization having a number of offices across a wide geographical area has developed a disaster recovery plan. Using actual resources, which of the following is MOST cost-effective test of disaster recovery plan?
Preparedness test. This is performed by the local office/area to test the adequacy of the preparedness of local operations for disaster recovery.
547
If a database is restored using before-image dumps, where should the process begin following an interruption?
Before the last transaction, which would not have updated the database prior to the dump being taken.
548
A live test of a mutual agreement for IT system recovery has been carried out, including a four-hour test of intensive usage by the business units. The test has been successful, but gives only partial assurance that the...
System and IT operations team can sustain operations in the emergency environment.
549
Which of the following business continuity plan tests involve participation of relevant members of the crisis management/response team to practice proper coordination?
Tabletop
550
What best ensures that users have uninterrupted access to critical, heavily-used web-based application?
Load balancing
551
You find out-of-range data in some tables of a DB. What control should you recommend?
Implement integrity constraints in the database.
552
When you interview key stakeholders in an org to determine whether they understand their roles and responsibilities in business continuity operations, what are you evaluating?
The clarity and simplicity of the BCPs
553
Authorizing access to application data is who's responsibility?
Data owner
554
When reviewing a disaster recovery hot site, what is of utmost concern?
Make sure disk space utilization rates are kept current. Have to know what is in use, and what is available at the hot site.
555
An optimized disaster recovery plan should do what to recovery time and cost of recovery?
Reduce length of recovery time and cost of recovery.
556
When storage growth in a critical file server is not managed properly, what is the greatest risk?
Server recovery work may not meet the Recovery Time Objective (RTO).
557
Best source for an auditor to use to validate that an ISP is in compliance with the SLA for the availability of outsourced telecommunications services?
Downtime reports on the telecommunication services generated by the ENTERPRISE.
558
During an application audit, you fins several problems related to corrupt data in the DB. What is a corrective control you should recommend?
Proceed with restore procedures.
559
What should you use to check compliance with an SLA's requirement for uptime?
Availability reports
560
A first approach to developing a disaster recovery strategy is to assess whether...
A cost-effective, built-in resilience can be implemented.
561
The primary benefit of an IT manager monitoring technical capacity is to ensure what?
That the SLA requirements are met.
562
Auditing e-commerce architecture, note that customer master data are stored on the web server for six months after the transaction date, then purged to inactivity. Primary concern is...
Confidentiality of customer data. Due to exposure to Internet, too long of a period.
563
Org annual risk assessment completed. Regarding the BCP, what do you recommend as a next step for the org?
Review and evaluate the BCP for ADEQUACY
564
When preparing a BCP, what should be done first?
Perform business impact analysis
565
What's the best source of information for determining the criticality of application systems as part of a business impact analysis?
Business processes owners.
566
During a change control audit of a production system, find the change management process is not formally documented and that some migration procedures failed. What's next?
Gain more assurance on the findings through Root Cause Analysis
567
What should a business continuity manager perform first after the replacement of hardware at the primary information processing facility?
Update the IT asset inventory
568
What is MOST likely to ensure that a disaster recovery effort is successful?
Data restoration was completed.
569
If you're reviewing an org's recovery from disaster and all critical data needed to resume business operations was not successfully retained, what was incorrectly defined?
The recovery point objective
570
When performing an application maintenance audit, you would review the log of program changes for the what?
Authorization of program changes.
571
Determining the service delivery objective should be primarily based upon...
The minimum acceptable operational capacity
572
Th activation of a business continuity plan should be based on predetermined criteria that address the...
duration of the outage
573
What is the most critical element to effectively execute a disaster recovery plan?
Offsite storage of backup data
574
Due to changes in IT, the disaster recovery plan of a large organization has been changed. What is the PRIMARY risk if the new plan is not tested?
Catastrophic service interruption
575
I evaluating programmed controls over password management, what should the auditor primarily rely upon?
A validity check
576
What is the most important criterion when selecting a location for an offsite storage facility of IS backup files?
The offsite facility must be physically separated from the data center and not subject to the same risk.
577
After completing the business impact analysis, what is the NEXT step in the business continuity planning process?
Develop recovery strategies.
578
To ensure disaster recovery, it is most important that the disaster recovery plan and the BCP are what?
Tested regularly
579
An auditor discovers that some users have installed personal software on their PCs. This is not explicitly forbidden by the security policy. The best approach is to recommend what?
Security policy be updated to include a specific language regarding unathorized software.
580
What BEST mitigates the risk arising from using reciprocal agreements as a recovery alternative?
Ensure that partnering organizations are separated gepgraphically.
581
In reviewing a new outsourcing contract with a service provider, what would be a huge concern is missing?
A clause providing "right to audit" the service provider.
582
A new DB is set up overseas to provide information to the public. Biggest concern/highest risk is
Hardware being used to run the application. Because it's overseas, a hardware failure left unfixed can reduce availability of the system to is users.
583
During a change control audit of a production system, you find that a change management process is not formally documented and that some migration procedures failed. What should you do next?
Gain more assurance on the findings through root cause analysis.
584
What should the business continuity manager perform first after the replacement of hardware at the primary information processing facility?
Update the IT inventory. An IT assets inventory is the basic input for the business continuity/disaster recovery plan, and the plan must be updated to reflect changes in the IT infrastructure.
585
What would most likely ensure that a disaster recovery effort is successful?
Data restoration was completed.
586
Your reviewing an org's recovery from a disaster where not all the critical data to resume business operations were retained. In this case, what was incorrectly defined?
The recovery point objective
587
Performing a maintenance audit, you would review the log of program changes for what?
Authorization of program changes.
588
What should determining the service delivery objective be based on?
The minimum acceptable operational capability.
589
The activation of an enterprise's BCP should be based on predetermined criteria that addressed what?
The duration of the outage.
590
What is the most critical element to effectively execute a disaster recovery plan?
Offsite storage of backup data.
591
Evaluating programmed controls over password management, what is the auditor most likely to rely on?
A validity check. (several types of characters, etc.)
592
Most important criterion when selecting a location for offsite storage?
physically separated from the data center and not subject to the same risk.
593
After completing the business impact analysis, what is the next step in the BCP process?
Develop recovery strategies.
594
To ensure structured disaster recovery, it is most important that the BCP and disaster recovery plan are what?
Tested regularly.
595
What best mitigates the risk arising from using reciprocal agreements as a recovery alternative?
Ensure that partnering organizations are separated geographically.
596
An auditor would be most concerned when reviewing a new outsourcing contract with a service provider if what was missing?
A clause providing a "right to audit" the service provider.
597
What is the most important control an auditor should look for to ensure system availability when evaluating the effectiveness of the change management process in an organization?
Test plans and procedures exist and are closely followed.
598
When reviewing a disaster recovery plan, the auditor should be most concerned with the lack of what?
Process owner involvement.
599
A lower recovery time objective results in what?
Higher costs.
600
When reviewing the desktop software compliance of an organization, the auditor should be most concerned if the installed software...
Is not listed in the approved software standards document.
601
In a disaster recovery situation, what is the most important metric to ensure that data are synchronized between critical systems?
Recovery point objective, Should be common to ensure that systems do not contain data from a different point in time.
602
What is the first step in the execution of a problem management mechanism?
Exception reporting. It's the first step in tracking problems.
603
Your evaluating the network performance for an org that is considering increasing Internet bandwidth due to a performance degradation during business hours. What is most likely the cause of the degradation?
Unauthorized network activities. Like unauthorized music sites, etc.
604
What is an IS auditor's primary concern when reviewing system parameters?
They are set to meet both security and performance requirements (balance)
605
What is the most efficient and sufficiently reliable way to test the design effectiveness of a change control process?
Perform an end-to-end walkthrough of the process.
606
What should an IS auditor recommend to assist in the recording of baselines for software releases?
Configuration management. Should a new release fail, the baseline will provide a point to which to return.
607
Your reviewing the change management process for an enterprise resource planning application. What is the best method for testing program changes?
Trace a sample of modified programs to supporting change tickets.
608
During an IS audit of the disaster recovery plan of a global enterprise, the auditor observes that some remote offices have very limited local IT resources. What observation would be most critical for the auditor?
A test has not been made to ensure that local resources could maintain security and service standards when reviewing from a disaster or incident.
609
Some hard drives disposed of were not sanitized in a manner that would reasonably ensure the data could not be recovered. In addition, the enterprise does not have a written policy on data disposal. The auditor should first...
determine the sensitivity of the information on the hard drives.
610
What is the best way to detect errors in data processing?
Hash totals indicate an error in data integrity.
611
What is a prevalent risk in the development of end-user computing applications?
Applications may not be subject to testing and IT general controls.
612
What best ensures accountability when updating data directly in a production database?
Review of audit logs. These contain the user ID of the individual who performed the change as well as the data before and after the change, which is the best evidence of database changes. Reviewing the logs evidences not only who made the change, but also the correctness of the change.
613
An advantage of using unshielded twisted-pair (UTP) cable for data communications over other copper-based cables is what?
These reduce the risk of crosstalk between pairs.
614
Reviewing an org's preventive maintenance process for systems at a data center. You determine adequate maintenance is being performed on all critical computing, power, and cooling systems. In addition, what is most important for you to ensure?
That the org performs maintenance suring noncritical processing times.
615
The primary purpose of implementing Redundant Array of Inexpensive Disks level 1 in a file server is to...
ensure availability of data. Provides disk mirroring.
616
What best shows that disaster recovery procedures meet the requirements?
A tabletop exercise using the procedures was conducted. (Paper-based test) This test can identify missing or incorrect procedures because representatives responsible for performing the tasks are present.
617
What is the most effective control for enforcing accountability among database users accessing sensitive information?
Implementing a log management process. Allows to know what was done, and by whom.
618
An offsite information processing facility with electrical wiring, air conditioning, and flooring but no computer or communications equipment is called a...
Cold Site - ready to receive equip, but does not offer any components in advance of the need.
619
Depending on complexity of the BCP, it may be developed as a set of plans to address various aspects of business continuity and disaster recovery. In such an environment, what is essential?
Each plan is consistent with one another.
620
What is most important for an auditor to verify while conducting a business continuity audit?
Human safety procedures are in place.
621
What is the major risk of a BCP where a crisis situation in not defined?
Execution of the disaster recovery plan could be impacted.
622
Reviewing most recent disaster recovery plan of an org. Which approval is the most important when determining the availability of system resources required for the plan?
IT management, above all else.
623
In the business continuity strategy, what are four considerations?
A business continuity strategy. This identifies the best way to recover. The criticality of the business process, the cost, the time required to recover, and security.
624
What is the next step after completing the business impact analysis as part of business continuity planning?
A business continuity strategy.
625
After a IT disaster recovery measures are in place and regularly tested for years, an org has just developed a formal BCP. A basic BCP tabletop exercise has been performed successfully. What should you recommend be done next?
A functional test of a scenario with limited IT involvement.
626
Which disaster recovery testing technique is the most efficient way to determine the effectiveness of the plan?
Preparedness tests. These involve a simulation of the entire environment in phases.
627
When evaluating the resilience of a high-availability network, what is of most concern?
The servers are clustered on one site. This would make the entire network vulnerable to natural disasters or other disruptive events.
628
You find out-of-range data in some table of a database. What control should you recommend to avoid this situation?
Implement integrity constraints in the database. Data are checked against predefined tables or rules, which prevents any undefined data from being entered.
629
In an HR audit, you're informed there is a verbal agreement between the IT and HR departments as to the level of IT services expected. What should you do first in this situation?
Confirm the content of the agreement with both departments. You must confirm first and understand the current practice before you can make a recommendation.
630
A clerk changed the interest rate for a loan on a master file. The rate entered is outside the normal range. What control is the most effective in providing reasonable assurance that the change was authorized?
The system will not process the change until the clerk's manager confirms the change by entering an approval code.
631
An auditor should recommend the use of library control software to provide reasonable assurance of what?
That program changes have been authorized. Library control software should be used to separate test from production libraries in mainframe and/or client server environments.
632
What is the main objective of library control software?
To provide assurance that program changes have been authorized.
633
The main criterion for determining the severity level of a service disruption is what?
Downtime. The longer the period of time a client cannot be serviced, the greater the severity (impact) of the incident.
634
Which backup techniques is most appropriate when an org requires extremely granular data restore points, as defined in the RPO?
Continuous data backup.
635
What is the most important consideration for database hardening?
The default configurations are changed, such as default passwords and services.
636
In a contract with a hot, warm, or cold site, contractual provisions should primarily cover which of the following considerations?
Number of subscribers permitted to use a site at one time (should be specified in the contract). Note: the contract can state a preference to certain subscribers.
637
What best helps to define disaster recovery strategies?
Maximum tolerable downtime and data loss.
638
Integrating the business continuity plan into IT project management aids in what?
The development of a more comprehensive set of requirements.
639
A recently installed security patch crashed the server.. What should you do to minimize the probability of this occurring again?
You should ensure that a good change management process is in place.
640
You find that the latest security-related software patches for a critical system were released two months ago, but not installed yet. What should you do next?
Review the patch management policy and determine the risk associated with this condition.
641
The DB administrator suggests that database efficiency can be improved by denormalizing some tables. This would result in what?
Increased redundancy.
642
Normalization reduces redundancy. Redundancy is usually considered positive when it comes to resource availability. Why is it negative in a database environment?
Because it demands additional and otherwise unnecessary data handling efforts. Denormalization is sometimes advisable for functional reasons.
643
Segmenting a highly sensitive database results in what?
Reduced exposure (to a particular vulnerability).
644
What is the most important consideration when defining a RPO?
Acceptable loss of data.
645
When a company places a public computer for guests to use the Internet, what presents the greatest risk for identity theft?
Session timeout is not activated.
646
Long term, what has the greatest potential to improve the security incident response process?
Simulation exercises performed by the incident management response team.
647
Find mainframe users of a manufacturing company at a remote site connect to the mainframe at headquarters over the Internet via Telnet. What offers the strongest security?
Use a point-to-point leased line. This extends the LAN of the headquarters to the remote site, and the mainframe Telnet connection would travel over the private line, which would be less of a security risk when using an insecure protocol such as Telnet.
648
The best overall quantitative measure of the performance of biometric control devices is what?
A low Equal-error rate. A low ERR This is a combination of a low false-rejection rate (FRR) and a low false-acceptance rate (FAR). ERR is expressed as a percentage. This is a measure of the number of times that the FRR and FAR are equal. A low ERR is the measure of the more effective biometrics control device.
649
What is the best control to prevent the deletion of audit logs by unauthorized individuals in an org?
Only select personnel should have the rights to view or delete audit logs.
650
The first step in a successful attack to a system is...
Gathering information
651
The main reason that an org should have an incident response plan is that it helps to...
Minimize the duration and impact of system outages and security incidents.
652
What is the most important security consideration for an org that wants to move a business app to external cloud services (PaaS) provided by a vendor?
Classification and categories of data process by the application. Types of data and its sensitivity is a primary consideration.
653
Why does a digital signature contain a message digest?
To show if the message has been altered after transmission.
654
Distributed denial-of-services attacks on Internet sites are typically evoked by hackers using which of the following?
Botnets
655
In transport mode, the use of the Encapsulating Security Payload protocol is advantageous over the authentication header protocol because it provides what?
Confidentiality
656
IT director approves the installation of a wireless LAN access point in a conference room for Internet access. What's the best control to protect the org servers from unauthorized access?
Make the conference room network on a separate virtual local area network (VLAN). The installation presents a risk to the servers from both, authorized and unauthorized users. A separate VLAN ensures that both are prevented from gaining network access to database servers, while allowing Internet use to authorized users.
657
You suspect an incident is occurring while an audit is being performed on a financial system. What should you do first?
Report the incident to management.
658
What can a certificate authority (CA) delegate the proceeses of?
Establishing a link between the requesting entity and its public key is a function of a regulation authority. This may or may not be performed by a CA, therefore, this function can be delegated.
659
During an access control review for a mainframe application, an IS auditor discovers user security groups without designated owners. The primary reason that this is a concern to the IS auditor is that without ownership, there is no one with clear responsibility for what?
Approval of user access.
660
In what capacity would an IS auditor most likely see a hash function applied?
Authentication.
661
Producing a "fingerprint" of data that can be used to ensure integrity and authentication is the purpose of what?
A hash function.
662
Java applets and Active X controls are distributed programs that execute in the background of a client web browser. This practice is considered reasonable when...
the source of the execute file is certain.
663
The primary purpose of installing data leak prevention software is to what?
Control confidential documents leaving the internal network.
664
Which of the following features of a public key infrastructure is most closely associated with proving that an online transaction was authorized by a specific customer?
Nonrepudiation. A digital algorithm prevents the senders from later denying that they generated and sent the message.
665
What most effectively detects the loading of illegal software packages onto a network?
Periodic checking of hard drives.
666
The most likely explanation for a successful social engineering attack is what?
Judgment errors.
667
Obtaining a level of trust from someone that is not warranted is considered what?
Social Engineering.
668
The review of router access control lists should be conducted during which review?
A network security review.
669
What review includes reviewing router access control lists, port scanning, and internal and external connections to the system?
A network security review.
670
Company A outsourced support to company B located in another country. Co B remotely connects to the corp network using an Internet connection. What best provides assurance that only authorized users connect?
Two-factor authentication. \A password is insufficient for this scenario.
671
A network log shows that an employee ran elevated commands on their PC by invoking the task scheduler to launch restricted apps. This is an example of what?
A privilege escalation.
672
A new business app has been designed in a large, complex org. The business owner requested that the various reports be viewed on a "need to know" basis. Which access control methods would best achieve this requirement?
Role-based.
673
During the collection of forensic evidence, which action would most likely result in the destruction or corruption of evidence on a compromised system?
Rebooting the system.
674
Which network component is primarily set up as a security measure by preventing unauthorized traffic between different segments of the network?
Firewalls.
675
When reviewing an intrusion detection system, an IS auditor should be most concerned about what?
Low coverage of network traffic. Cybersecurity attacks might not be timely identified if only a small portion of network traffic is analyzed.
676
An IT auditor is reviewing an org's information security policy, which requires encryption of all data placed on universal serial bus (USB) drives. Which encryption algorithm would provide the greatest assurance that data placed on USB drives is protected from unauthorized disclosure?
Advanced Encryption Standard
677
What best encrypts data on mobile devices?
Elliptical curve cryptology
678
The main reason for requiring that all computer clocks across an org are synchronized is to what?
Support the incident investigation process.
679
What is best for overall control for an Internet business looking for confidentiality reliability and integrity of data
Secure Sockets Layer (SSL).
680
What is Secure Sockets Layer (SSL)?
A combination of public and symmetric key encryption and integrity through hash message authentication code. Sets up a secure channel for communications, providing confidentiality.
681
hat is the most reliably effective method for dealing with the spread of a network worm that exploits vulnerability in a protocol?
Stop the services that the protocol uses.
682
Implementing what would most effectively prevent unauthorized access to a system administration account of a web server?
two-factor authentication.
683
When auditing security for a data center, an IS auditor should look for the presence of a voltage regulator to ensure that what?
That the hardware is protected against power surges.
684
Two-factor authentication can be circumvented by which attack?
Man-in-the-middle
685
Neural networks are effective in detecting fraud because they can do what?
Address problems that require consideration of a large number of input variables. They can capture relationships and patterns often missed by other statistical methods, but they cannot discover new trends.
686
What best describes the role of a directory server in a public key infrastructure?
Makes other users' certificates available to applications.
687
What is the best audit procedure to determine if a firewall is configured in compliance with an org's security policy?
Review the parameter settings.
688
Web application developers sometimes use hidden fields on web pages to save information about a client session. This technique is used, in some cases, to store session variables that enable persistence across web pages, such as maintaining the contents of a shopping cart on a retail web site application. The most likely web-based attack due to this practice is what?
Parameter Tampering
689
What is the first step in data classification?
Establish ownership. The data owner is responsible for defining the access rules; therefore, establishing ownership is the first step in data classification.
690
During a logical access controls review, you observe that user accounts are shared. What's the greatest risk of this?
User accountability may not be established, since there is no way to logically hold one person accountable for a specific system access.
691
Your performing a review of a network. Users report that the network is slow and web pages periodically time out. You confirm these findings to the network manager. The most appropriate first action for the network team is what?
Use a protocol analyzer to perform network analysis and review error logs of local area network equipment.
692
During the review of a biometric system operation, the auditor should first review the stage of what?
Enrollment. Users of a biometric device must first be enrolled in the device.
693
What best ensures continuity of a wide area network across the organization?
Built-in alternative routing. Alternative routing would ensure that the network would continue if a communication device fails or is a link is severed because message rerouting could be automatic.
694
A key IT systems developer has suddenly resigned from an enterprise. What would be a most important action?
Terminate the developer's logical access to IT resources.
695
Inadequate programming and coding practices increase the risk of what?
Buffer overflow exploitation.
696
What is the best criterion for evaluating the adequacy of an organization's security awareness program?
Job descriptions contain clear statements of accountability for information security.
697
The implementation of access controls first requires what?
An inventory of IS resources.
698
The reliability of an application system's audit trail may be questionable if what?
Users can amend audit trail records when correcting system errors.
699
What is a passive attack to a network?
Traffic analysis.
700
What is traffic analysis?
Allows a watching threat actor to determine the nature of the flow of traffic between defined hosts, which may allow the threat actor to guess the type of communication taking place without taking an active role.
701
An Internet-based attack using password sniffing can be used for what?
TO GAIN ACCESS TO SYSTEMS CONTAINING PROPRIETARY INFORMATION.
702
An org discovers that the comp of a CFO has been infected with malware that includes a keystroke logger and rootkit. What is the first action to take?
Disconnect the PC from the network to prevent further data compromise.
703
What is the primary objective of classifying information assets from a control perspective?
To establish guidelines for the level of access that should be assigned.
704
What is the best way to protect against identity theft in an online banking application?
Two-factor authentication. This requires two independent methods for establishing identity and privileges.
705
A virtual private network hides information from sniffers on the net by using what method?
Tunneling. Tunneling works based on encapsulation and encryption of sensitive traffic.
706
What kind of cryptography option increases overhead/costs?
A long asymmetric encryption key is used. Computer processing time is increased for longer asymmetric encryption keys, and the increase may be disproportionate. Ex, one benchmark showed that doubling the length of an RSA key from 512 to 1,024 bits cause the decrypt time to increase by nearly six-fold.
707
What is an RSA key?
An RSA key is a private key based on RSA algorithm.
708
You're reviewing an org's HR DB implementation, and discover the DB servers are clustered for high availability, that all default accounts have been removed, and that the DB audit logs are kept and reviewed on a weekly basis. What other area should you check to ensure that the DBs are appropriately secured?
Database initialization parameters must be appropriate.
709
Which of the following public key infrastructure (PKI) elements describes procedure for disabling a compromised private key?
Certification practice statement. This is the how-to document used in policy-based public key infrastructure (PKI).
710
How does the Secure Sockets Layer (SSL) protocol ensure confidentiality of a message?
By symmetric encryption. SSL uses a symmetric key for message encryption.
711
What is a symmetric key?
a symmetric key is one that is used both to encrypt and decrypt information. This means that to decrypt information, one must have the same key that was used to encrypt it. The keys, in practice, represent a shared secret between two or more parties that can be used to maintain a private information link. This requirement that both parties have access to the secret key is one of the main drawbacks of symmetric key encryption, in comparison to public-key encryption.
712
What is the most secure method (and economical) for connecting a private network over the Internet in a small- to medium-sized org?
A VPN. It uses encryption, authentication, and tunneling to allow data to travel securely from a private network to the Internet. A dedicated line is very expensive, and only needed when there are specific confidentiality and availability needs.
713
What should an org be most concerned with when conducting a penetration test of an IT system?
Restoring systems to the original state.
714
A review of wide area network (WAN) usage discovers that traffic on one communication line between sites, synchronously linking the master and standby database, peaks at 96 percent of the line capacity. What should you conclude?
Analysis is required to determine if a pattern emerges that results in a service loss for a short period of time. The peak of 96% could be the result of a one-off incident like a user downloading a large amount of data. Analysis should be performed to establish whether there is a regular pattern before expenditure on a larger capacity should be recommended.
715
What do validated digital signatures achieve in an email software application?
Help detect spam.
716
When conducting a post implementation review of an enterprise's network, what type of finding would be of most concern?
Default passwords are not changed when installing the network devices.
717
What is the greatest risk from an improperly implemented intrusion prevention system (IPS)?
Blocking of critical systems of services due to false triggers.
718
A firm has created a File Transfer Protocol (FTP) site for the purpose of receiving financial data, and has communicated the site's address, user ID, and password to the financial services company is separate emails. The company is to transmit its data to the FTP site after manually encrypting it. What is the greatest concern?
The users may not remember to manually encrypt the data before transmission.
719
You find that employees are emailing sensitive company information to public-based email domains. What is the best remediation option?
Data loss prevention. This is an automated preventative tool that can block sensitive information from leaving the network, while at the same time, logging offenders. Trumps training because it works when the intent to steal data is present.
720
In a small org, an employee performs computer ops. and, when the situation demands, program mods. What should you recommend?
Procedures should be in place that verify only approved program changes are implemented. (A formal change control process)
721
Computers on the network located where would be of most concern to the auditor reviewing a VPN implementation?
Employees' homes. Once a computer is hacked and "owned," any network that trusts that computer is at risk.
722
You're reviewing security incident management procedures for a company. Why is the preservation of the chain of custody of electronic evidence the most important consideration in regard to security incident management?
If data and evidence are not collected properly, valuable information could be lost and would not be admissible in a court of law should the company decide to pursue litigation.
723
What is the most important consideration when reviewing security incident mangement?
Chain of custody of electronic evidence.
724
An org with extremely high security requirements is evaluating the effectiveness of biometric systems. Which of the following performance indicators is MOST important?
False-acceptance rate. (FAR) This is the frequency of accepting an unauthorized person as authorized, thereby granting access when it should be denied.
725
What is the primary purpose of audit trails?
To establish accountability for processed transactions.
726
Why would an org want to remove a lock-in clause from a cloud service contract?
Portability. When drawing up a contract with a cloud service provider, the ideal practice is to remove the customer lock-in clause. This might be important for the client to secure portability of their system assets (i.e., the right to transfer from one vendor to another).
727
What type of penetration test effectively evaluates the incident handling and response capability of the systems administrator?
Double-blind testing.
728
What type of penetration testing does the tester have little or limited knowledge about the target system, and personnel at the target site have not been informed that a test is being performed?
Double-blind testing
729
What should be done first by an auditor evaluating logical access controls?
Obtain an understanding of the security risk to information processing.
730
In what type of penetration testing are testers provided with information related to the target and network design and the target's IT team is aware of the testing activities?
Targeted testing
731
What type of penetration testing refers to attacks and control circumvention attempts on the target from within the perimeter, and the system administrator is typically aware of the testing?
Internal testing.
732
What generic term refers to attacks and control circumvention attempts on the target from outside the target system, and the system administrator may or may not be aware of the testing??
External testing.
733
When management of an org decides to establish a security awareness program, what would likely be part of the program?
Training provided on a regular basis to all current and new employees.
734
The assignment of criticality levels to data is the responsibility of whom?
Information asset owners.
735
What is most important when installing an intrusion detection system?
Properly locating it in the network architecture. A poorly located IDS could leave areas of the network unprotected.
736
A smart card and personal identification number is what type of user authentication?
Two-factor
737
Why is a unique user IS and complex, non-dictionary password considered a single-factor user authentication?
Both an ID and password are something the user knows.
738
Why is an iris scan and fingerprint not considered a two-factor user authntication?
Both are something the user is.
739
Why is a magnetic strip and proximity badge not considered a two-factor user authentication?
Both are something the user has.
740
An org is proposing to establish a wireless LAN. Management asks the audio to recommend security controls for the WLAN. What would be a most appropriate recommendation?
Physically secure wireless access points to prevent tampering.
741
What is the most important factor in planning a black box penetration test?
Knowledge by management staff of the client organization.
742
What type of penetration testing assumes no prior knowledge of the infrastructure to be tested, and testers simulate an attack from someone who is unfamiliar with the system?
Black box testing
743
What is a most important action in recovering from a cyberattack?
Activating an incident response team.
744
Your reviewing findings from a previous IT audit of a hospital. One finding indicates that the org was using email to communicate sensitive patient issues. The IT manager indicates that to address this finding, the org has implemented digital signatures for all email users. What should your response be?
Digital signatures are not adequate to protect confidentiality.
745
Why are digital signatures inadequate for protecting confidentiality?
Digital signatures are designed to provide authentication and nonrepudiation for email and other transmissions. They do not encrypt message contents. This means an attacker who intercepts can read the message the message in plain text.
746
What are digital watermarks used for?
Digital watermarks are used to protect intellectual property rights for documents rather than confidentiality.
747
The management of a multi-national company is considering upgrading its existing VPN to support Voice-over Internet Protocol communication via tunneling. What consideration should be primarily addressed?
Reliability and quality of service (QoS).
748
A hacker could obtain passwords without the use of computer tools or programs through what technique?
Social engineering.
749
What is social engineering?
The divulgence of private information through dialogue, interviews, inquiries, etc., in which a user may be indiscreet regarding their or someone else's personal data.
750
What specifically addresses how to detect cyberattacks against an org's IT systems and how to recover from such an attack?
An incident response plan.
751
What does TCP/IP stand for?
Transmission Control Protocol/Internet Protocol.
752
What best ensures that complete encryption and authentication protocols exist for protecting information while transmitting over a TCP/IP-based environment that is exposed to the Internet?
Work is completed in tunnel mode with IP security. This provides encryption and authentication of the complete IP package. To accomplish this, the authentication header and encapsulating security payload services can be nested, which is known as IP security.
753
Granting access to data is the responsibility of whom, with help from whom?
Granting access to data is the responsibility of the data owners with help from the security officer.
754
What is an object-oriented technology characteristic that permits an enhanced degree of security over data?
Encapsulation.
755
What is encapsulation?
In object-oriented programming (OOP), encapsulation refers to the bundling of data with the methods that operate on that data, or the restricting of direct access to some of an object's components.[1] Encapsulation is used to hide the values or state of a structured data object inside a class, preventing direct access to them by clients in a way that could expose hidden implementation details or violate state invariance maintained by the methods.
756
What is the primary reason for using digital signatures to ensure data?
Integrity.
757
What three benefits are provided by a digital signature?
message integrity, nonrepudiation, and proof of origin.
758
What is meant by nonrepudiation?
Nonrepudiation is a method of guaranteeing message transmission between parties via digital signature and/or encryption. It is one of the five pillars of information assurance (IA). The other four are availability, integrity, confidentiality and authentication.
759
How can an org can ensure that the recipients of emails from its employees can authenticate the identity of the sender?
Digitally signing all email messages.
760
How can you mitigate the risk of dumpster diving?
Implement security awareness training.
761
Web and email filtering tools are valuable to an org primarily because...
They protect the org from viruses and nonbusiness materials such as spam, mail chains, recreational surfing, and recreational email.
762
Switching from a wired LAN to a wireless infrastructure increases the risk of what kind of attack?
War Driving.
763
What attack uses a wireless Ethernet card, set in promiscuous mode, and a powerful antenna to penetrate wireless systems?
War Driving.
764
What is promiscuous mode?
In computer networking, promiscuous mode is a mode for a wired network interface controller (NIC) or wireless network interface controller (WNIC) that causes the controller to pass all traffic it receives to the central processing unit (CPU) rather than passing only the frames that the controller is specifically programmed to receive.
765
You find a ip of an org is using a wireless broadband modem using global system for mobile communications (GSM) technology. This modem is being used to connect the CIO's laptop to the corporate VPN when the CIO travels. What should you do?
Nothing. The inherent security features of GSM technology (Global Security for Mobile Communications) are appropriate. Combined with a VPN, this is appropriate.
766
An auditor reviewing access controls for a client-server environment should be do what?
Identify the network's access points.
767
What type of transmission media provides the best security against unauthorized access?
Fiber-optic cables.
768
What is the most effective control that should be implemented to ensure accountability of application users accessing sensitive data in a human resource management system (HRMS) and among interfacing applications to the HRMS?
Audit trails. These capture which user, at what time, and data, along with other details, has performed the transaction and this helps in establishing accountability among other users.
769
A Transmission Control Protocol/Internet Protocol (TCP/IP)-based environment is exposed to the Internet. What BEST ensures that complete encryption and authentication protocols exist for protecting information while transmitted?
Work is completed in tunnel mode with IP security. This provides encryption and authentication of the complete IP package. To accomplish this, the authentication header and encapsulating security payload services can nested. This is known as IP security.
770
With the help of a security officer, granting access to data is whose responsibility?
Data Owners
771
Which object-oriented technology characteristic permits an enhanced degree of security over data?
Encapsulation. This is a property of objects. It prevents accessing either properties or methods that have not been previously defined as public. This means that any implementation of the behavior of an object is not accessible. An object defines a communication interface with the exterior and only that which belongs to that interface can be accessed.
772
The primary reason for using digital signatures is to ensure what?
Integrity
773
The risk of dumpster diving is best mitigated by what?
Implementing security awareness training.
774
Web and email filtering tools are valuable to an org primarily because they what?
Protect the org from viruses and nonbusiness materials.
775
IS management recently replaced its existing wired local area network with a wireless infrastructure to accommodate the increased use of mobile devices within the org. This will increase the risk of which type of attacks?
War diving.
776
When application programmers are implementing changes to production programs, this increases the likelihood of what?
Fraud.
777
Your reviewing a new web-based order entry system the week before it goes live. You've identified that the application, as designed, may be missing several critical control regarding how the system stores customer credit card information. What should you do first?
Verify that security requirements have been properly specified in the project plan. Any recommendation you would make would be based upon whether the requirements were included in the plan.
778
What is the greatest benefit of having well-defined data classification policies and procedures?
A decreased cost of controls. It lowers the cost of protecting data by ensuring the appropriate controls are applied with respect to the sensitivity of data.
779
What is protected by a raised floor in the computer machine room?
Damage to wires around computers and servers.
780
A benefit of quality of service is what?
Participating apps will have guaranteed bandwidth.
781
What is the main function of Quality of Service (QoS)?
To optimize network performance by assigning priority to business applications and end users through the allocation of dedicated parts of the bandwidth to specific traffic.
782
An organization has requested that an IS auditor provide a recommendation to enhance the security and reliability of its voice-over Internet protocol (VoIP) system and data traffic. What would help meet this objective?
VoIP infrastructure needs to be segregated using virtual local area networks.
783
The purpose of a mantrap controlling access to a computer facility is primarily what?
Prevent piggybacking
784
Whtem?at would most effectively enhance the security of a challenge-response based authentication sys
Implementing measures to prevent session hijacking (man-in-the-middle) attacks. Security management should be aware of this and engage in risk assessment and control design such as periodic authentication when they employ this technology.
785
What is the greatest concern associated with the use of peer-to-peer computing?
Data leakage. Peer-to-peer computing can share the contents of a user hard drive over the Internet. The risk that sensitive data could be shared with others is the greatest concern.
786
The most effective biometric control system is the one with what?
The lowest error rate.
787
An org is developing a new web=based app to process orders from customers. Which of the following security measures should be taken to protect this app from hackers?
Perform a web app security review. This is a necessary effort that would uncover security vulnerabilities that could be exploited by hackers.
788
A network intrusion detection system is useful between what?
The org network and the firewall.
789
WHAT BEST HELPS SECURE A WEB APP?
Developer training: teaching developers to write secure code is the best way to secure a web app.
790
An IS auditor is reviewing an org's network operations center (NOC). Which of the following choices is off the greatest concern?
A carbon dioxide-based fire suppression system. These will cause suffocation, and personal safety comes first.
791
An IS auditor performing an audit of a newly installed voice-over Internet Protocol (VoIP) system was inspecting the wiring closets on each floor of the building. What would be of greatest concern?
The LAN switches are not connected to uninterruptible power supply units.
792
An org is planning to deploy an outsourced cloud-based app that is used to track job applicant data for HR. Which should be of greatest concern?
The cloud provider's data centers are in multiple cities and countries. (PII)
793
What would be of greatest concern for an IS auditor reviewing an org's cloud computing strategy which is based on a software as a service (SaaS) model with an external provider?
Incident handling procedures with the provider are not well-defined.
794
An IS auditor is reviewing system access and discovers an excessive number of users with privileged access. The auditor discusses the situation with the systems administrator, who states that some personnel in other depts need privileged access and management has approved this access. Which is of greatest concern?
Determine whether compensating controls are in place.
795
What is most indicative of the effectiveness of an information security awareness program?
Employees report more information regarding security incidents.
796
What presents an inherent risk with no identifiable preventative controls?
Data diddling.
797
What is it called when data is changed prior to being entered into a computer?
Data diddling. It's exempt from computer security system since it's done prior to being entered into the computer.
798
An IS auditor reviewing a cloud computing environment that is managed by a third party should be most concerned when what?
The service level agreement does not address the responsibility of the vendor in the case of a security breach.
799
When planning an audit of a network setup, an auditor should give highest priority to obtaining which network documentation?
The wiring and schematic diagram is necessary to carry out the audit. Need to know what equipment configuration and addressing is used on the network in order to perform an audit of the network setup.
800
What firewall would best protect a network from an Internet attack?
Screened subnet firewall. The screening router can be a commercial router or a node with routing capabilities and the ability to allow or avoid traffic between the nets or nodes based on addresses, ports, protocols, interfaces, etc. The subnet would isolate Internet-based traffic from the rest of the corporate network.
801
What is most effective in reducing risk of loss due to fraudulent online payment requests?
Transaction monitoring.
802
What is the role of the certificate authority (CA) as a third party?
To confirm the identity of the entity owning a certificate issued by that certificate authority (CA). This is the primary role of the CA.
803
When reviewing a digital certificate verification process, what finding would represent the most significant risk? 1. No registration authority, 2. the certificate revocation list is not current, 3. digital certs containing a public key that is used to encrypt mssgs and verify signatures, subscribers report key compromises to the certificate authority (CA)?
The certificate revocation list is not current.
804
Which antivirus software implementation strategy is MOST effective in an interconnected corporate network?
Enterprise-based antivirus software. It provides a layered defense mode that is more likely to detect malware regardless of how it comes into the organization - whether through a universal serial bus (USB) or portable storage, a network, an internal download or malicious web app.
805
What manages the digital certificate life cycle to ensure adequate security and controls exist in digital signature applications related to e-commerce?
Certificate authority (CA) The CA maintains a directory of digital certs for the reference of those receiving them. It manages the cert life cycle, cert maintenance, and cert revocation list (CRL) maintenance, and publication.
806
A characteristic of user Datagram Protocol in network communications is what?
Packets may arrive out of order.
807
Company XYZ has outsourced production support to service provider ABC, located in another country. ABC service personnel remotely connect to the corporate network of XYZ over the Internet. What would provide the best assurance that transmission of information is secure while the production support team at ABC is providing support to XYZ?
Virtual private network tunnel.
808
What is the most secure way to remove data from obsolete magnetic tapes during disposal?
Degaussing the tapes. It leaves a very low residue of magnetic induction, essentially erasing the data completely.
809
When protecting an org's IT systems, what is normally the next line of defense after the network firewall has been compromised?
Intrusion Detection System (IDS) detects anomalies in the network/server activity and try to detect the perpetrator.
810
During a bank audit, your assessing whether the enterprise properly manages staff member access to the operating system. The IS auditor should determine whether the enterprise performs what?
Periodic review of user activity logs.
811
What is the most effective control when granting temporary access to vendors?
User accounts are created with expiration dates and are based on services provided.
812
The potential for unauthorized system access by way of terminals or workstations within an organization's facility is increased when what is present?
Connecting points are available in the facility to connect laptops to the network. Any person with wrongful intentions can connect a laptop to the network. All the user would need is a valid password and user ID to connect.
813
Which firewall provides the greatest degree of granularity control?
Application gateway. This is similar to a circuit gateway, but it has specific proxies for each service. To handle web services, it has a Hypertext Transmission Protocol (HTP) proxy that acts as an intermediary between externals and internals but is specifically for HTTP. This means that it not only checks the packet Internet Protocol (IP) addresses (Open Systems Interconnection [OSI] Layer 3) and the ports it is directed to (in this case port 80, or layer 4), it also checks every HTTP command (OSI Layers 5 and 7). Therefore, it works in a more detailed (granularity) way than other choices.
814
What best limits the impact of server failures in a distributed environment?
Clustering. Clustering allows two or more servers to work as a unit so that when one of them fails, the other takes over.
815
An information security policy stating that "the display of passwords must be masked or suppressed" addresses what method of attack?
Shoulder surfing
816
Performing a computer forensic investigation, in regard to the evidence gathered, what should an IS auditor be most concerned with?
Preservation. Preservation and documentation of evidence for review by law enforcement and judicial authorities are of primary concern when investigating.
817
Applying a digital signature to data traveling in a network provides what?
Integrity and nonrepudiation. The integrity is provided through the hash, proof of origin (nonrepudiation) is also provided.
818
The best filter rule for protecting a network from being used as an amplifier in a denial-of-service attack is to deny all of what?
Outgoing traffic with source addresses external to the network.
819
An organization has created a policy that defines the types of web sites that users are forbidden to access. What is the most effective technology to enforce this policy?
Web content filter. This accepts or denies web communications according to the configured rules.
820
In a public key infrastructure implementation properly configured to provide confidentiality, email is configured how?
Encrypted with the sender's PUBLIC key and encrypted with the recipient's PRIVATE key.
821
Can a message encrypted with a sender's private key be decrypted by a recipient's private key?
No
822
What indicates the effectiveness of a computer security incident response team?
Financial impact per security incident.
823
Which of the following types of penetration tests simulates a real attack and is used to test incident handling and response capability of the target?
Double-blind test.
824
the information security policy that states "each individual must have his/her badge read at every controlled door" addresses which attack method?
Piggybacking
825
What is the MOST prevalent security risk when an org implements remote virtual private network (VPN) access to its network?
Malicious code could spread across the network from the remote client.
826
Confidentiality of the data transmitted in a wireless local area network is best protected if the session is what?
Encrypted using dynamic keys. When using dynamic keys, the encryption key is changed frequently, thus reducing the risk of the key being compromised and the message being decrypted.
827
What is the primary goal of a web site certificate?
Authentication of the web site that will be surfed.
828
When transmitting a payment instruction, which of the following will help verify that the instruction was not duplicated?
Using a sequence number and a time stamp.
829
An IS auditor is reviewing Secure Sockets Layer (SSL) enabled web sites for the company. What choices would be of highest risk?
Self-signed digital certificates can be used by hackers to impersonate a web site, which could lead to data theft or a man-in-the-middle attack.
830
What type of drive prevents modification or deletion of transaction logs?
Write Once and Read Many drives
831
If you find that the configuration settings for password controls are more stringent for business users than developers, what action should you take?
Determine whether this is a policy violation and document it.
832
Company has implemented an electronic signature scheme based on a public key infrastructure. The user's private key is stored on a computer's hard drive and is protected by a password. The most significant risk is what?
Use of the user's electronic signature by another person if the password is compromised.
833
What is the best control to mitigate the risk of pharming attacks to an Internet banking application?
Domain name system server security hardening. (DNS) The pharming attack redirects the traffic to an unauthorized web site by expploiting vulnerabilities of the DNS server.
834
What is the most important logical access security measure to a remote system?
Encrypted passwords must be used.
835
Why should an auditor be concerned if the intrusion detection system (IDS) detects encrypted traffic?
Even though an IDS cannot detect attacks within encrypted traffic, detecting encrypted packets flowing past the firewall could indicate improper configuration or even a compromise of the firewall itself.
836
What is the purpose of a registration authority in a public key infrastructure?
It verifies information supplied by the subject requesting a certificate to determine whether the request is on behalf of themselves or their organization.
837
What is the best control over a guest wireless ID that is given to vendor staff?
Assignment of a renewable user ID which expires daily.
838
A firewall is being deployed at a new location. What is the most important factor in ensuring a successful deployment?
Testing and validating the rules.
839
An HR company offers wireless Internet access to its guests, after authenticating with a generic user ID and password. This generic ID and PWD are requested from the reception desk. What control addresses this situation best?
The public wireless network is physically segregated from the company network.
840
A web server is attacked and compromised. Org policy states that an incident response should balance the containment if an attack with retaining the freedom for later legal action against the attacker. In this situation, what should be performed first?
Disconnect the web server from the network to secure the device for investigation, contain the damage, and prevent more actions by the attacker.
841
An auditor has determined that developers have been granted administrative access to the virtual machine management console to manage their own servers used for software development and testing. What would be of most concern to the auditor?
Developers have the ability to create or deprovision servers. Virtualization offers the ability to create or destroy virtual machines (Vms) through the administrative interface with administrative access. While a developer would be unlikely to de-provision a production server, the administrative console would grant the ability to do this, which would be a significant risk.
842
An org has established a guest network for visitor access. What's the greatest concern?
The guest network is not segregated from the production network.
843
What is the most significant function of a corporate public key infrastructure and certificate authority employing x.509 digital certificates?
It binds a digital certificate and its public key to an individual subscriber's identity. Public key infrastructure (PKI) is primarily used to gain assurance that protected data or services originated from a legitimate source. The process to ensure the validity of the subscriber identity by linking to the digital certificate/public key is strict and vigorous.
844
What method best mitigates the risk of disclosing confidential information through the use of social network sites?
Providing security awareness training.
845
Confidentiality of transmitted data can best be delivered by encrypting what?
Session key with the Receiver's public key.
846
Data transmitted by encrypting the message digest with the sender's private key would do what to the message?
Ensure authentication and nonrepudiation.
847
Data transmitted encrypting the session key with the sender's public key would do what to the message?
Message would only be accessible by the sender.
848
If a message is encrypted by the receiver's private key, who could decrypt it?
Anyone using the receiver's private key.
849
What control most effectively detects the presence of bursts of errors in network transmissions?
Cyclic redundancy check (CRC). CRC can generally detect all single-bit and double-bit errors.
850
The most serious challenge in the operation of an intrusion detection system is what?
Filtering False Positive Alerts.Related controls such as IDS tuning and incident handling procedures (such as the screening process) to know if an event is a security incident or false positive.
851
What will best maintain the integrity of a firewall log?
Sending log information to a dedicated third-party server.
852
During an IS audit of a global organization, the auditor discovers that the org uses Voice-over Internet Protocol (VoIP) over the Internet as the sole means of voice connectivity among all offices. What present the most significant risk for the org's VoIP infrastructure?
Distributed denial-of-service attack. (DDoS) This would potentially disrupt the org's ability to communicate among its offices and have the highest impact. In a traditional voice network, a DDoS attack would only affect the data network, not voice communications.
853
What control would be the most comprehensive in a remote access network with multiple and diverse subsystems?
Virtual Private Network The best way to secure remote access is through the use of encrypted VPNs. This would allow remote users a secure connection to the main systems.
854
What is an isolated network used to permit outsiders to access certain corporate information in a semi-trusted environment. Demilitarized zone (DMZ)
Demilitarized zone (DMZ)
855
While firewalls are the Primary line of defense, what do they require to secure remote access traffic?
Encryption and a VPN
856
During an audit of a telecommunications system, an IS auditor finds that the risk of intercepting data transmitted to and from remote sites is very high. What is the most effective control for reducing this exposure?
Encryption of data is the most secure method of protecting confidential data from exposure.
857
An IS auditor finds that conference rooms have active network ports. What would prrevent this discovery from causing a concern?
This part of the network is isolated from the corporate network.
858
During the review of intrusion detection logs, an IS auditor notices traffic coming from the Internet, which appears to originate from the internal IP address of the company payroll server. What malicious activity would most likely cause this type of result?
Spoofing.
859
An auditor has been asked by management to review a potentially fraudulent transaction. The primary focus of an IS auditor while evaluating the transaction should be what?
Assure that the integrity of the evidence is maintained.
860
An online stock trading firm is in the process of implementing a system to provide secure email exchange with its customers. What is the best option to ensure confidentiality, integrity, and nonrepudiation?
Digital certificates.
861
A laptop belonging to a company database administrator and containing a file of production DB passwords has been stolen. What is the first thing the org should do?
Change the database password immediately because there is no way to know whether it has been compromised.
862
An org is considering connecting a critical PC-based system to the Internet. What would prevent the best protection against hacking?
An application-level gateway.
863
A company is planning to install a network-based intrusion detection system to protect the web site that it hosts. Where should the device be installed?
In the demilitarized zone.
864
If inadequate, which of the following would be the most likely contributor to a denial-of-service attack?
Router configuration and rules.
865
The use of Ping (ping of death) with a packet higher than 65 KB and no fragmentation flag on will cause what type of attack?
DoS - Denial of Service
866
What type of attack exhausts a;; possible key combinations used against encryption keys?
Brute Force Attack
867
What can be used to allow authorized users on the wireless network to access a wired network?
Install a firewall between the networks.
868
An IS auditor selects a server for a penetration test that will be carried out by a technical specialist. What is most important?
Permission from the data owner of the server. The data owner should be informed of the risk of the penetration test, the timing of the test, what types of tests are to be conducted, and all other relevant details.
869
What criteria is most needed to ensure that log information is admissible in court?
Ensure the data have been verified to ensure log integrity.
870
When performing a telecommunication access control review, a primary concern should be what?
The authorization and authentication of the user prior to granting access to systems resources.
871
An org is planning to replace its wired networks with wireless networks. What would best secure the wirelss network from unauthorized access?
Implement Wi_Fi Protected Access (WPA) 2.
872
A cyclic redundancy check is commonly used to determine...
Validity of transfer. The accuracy of blocks of data transfers, such as data transfer from hard disks, is validated by a cyclic redundancy check.
873
What component is responsible for the collection of data in an intrusion detection system?
Sensor.
874
During a logical access controls review, an IS auditor observes that user accounts are shared. What's the greatest risk?
User accountability is not established.
875
What provides the most relevant information for proactively strengthening security settings?
Honeypot - Honeypots lure hackers and provide clues as the their methods and strategies, as well as the resources required to address such attacks. It allows the attack to continue while obtaining information about the hacker's strategies and methods.
876
What's the first step taken by a network IDS?
Create an entry in the log.
877
When ensuring that an org is complying with privacy requirements, what is the first thing an auditor should review?
Legal and regulatory requirements.
878
What is a risk associated with attempting to control physical access to sensitive area such as computer rooms using card keys or locks?
Unauthorized individuals wait for controlled doors to open and walk in (Piggybacking).
879
What is the most effective control over visitor access to a data center?
Escort
880
What is the best way for an auditor to determine the effectiveness of a security awareness training program?
Interview a sample of employees.
881
Which type of antispam filtering method has the lowest possibility of false-positive alerts?
Check-sum based.
882
What is the most appropriate approach for implementing access control to facilitate security management of a VoIP web app?
Role-based access control
883
What validates the source of a message?
The use of digital signatures.
884
Explain the function of the keys when using public key encryption to secure data being transmitted across a network
The key used to encrypt is public, but the key used to decrypt the data is private.
885
What control can be implemented to reduce the risk of internal fraud when app programmers are allowed to move programs into the production environment in a small org?
Registration and review of changes.
886
What is the most reliable form of single factor personal identification?
Iris scan
887
Internal auditing is reviewing an internally developed common gateway interface script for a web app. The auditor discovers that the script was not reviewed and tested by the QC function. What risk type is of greatest concern?
Unauthorized access.
888
An auditor reviewing a software-based firewall configuration. What represents the greatest vulnerability?
Installation on an operating system configured with default settings.
889
What is an advantage of elliptic curve encryption over RSA encryption?
Computation speed
890
A business application system accesses a corporate database using a single ID and password embedded in a program. What would provide efficient access control over the org's data?
Apply role-based permissions within the app system.
891
What is the greatest concern when reviewing the network infrastructure of a call center and see that the internal telephone system is based on VoiP technology?
Ethernet switches are not protected by uninterrupted power supplies.
892
What would be a weakness when performing an audit of an org that uses public key infrastructure with digital certificates for its business-to-consumer transactions via the Internet?
The organization is the owner of the certificate authority (CA).
893
An org has experienced a large amount of traffic being re-routed from its VoIP Internet Protocol packet network. It believes it is the victim of eavesdropping. What could result from eavesdropping of VoIP traffic?
Corruption of the Address Resolution Protocol cache in Ethernet switches.
894
A data center has a badge-entry system. What is most important to protect the computing assets in the center?
A process for promptly deactivating lost or stolen badges must be followed.
895
Why is the certification and accreditation process performed on critical systems?
Ensures that security compliance has been technically evaluated.
896
What type of media would provide the best security for a telecommunication network?
Dedicated lines
