IT Flashcards

Question

Which of the following audit tests should be performed by an internal auditor who is reviewing controls over user authentication procedures? A. Verify password masking at data terminals. B. Review how proper separation of duties is established using access control software. C. Review procedures concerning revocation of inactive users. D. Review password procedures.

Answer 1

A. Verify password masking at data terminals. User authentication basically seeks to determine if the person seeking access is who they say they are. Password masking is a part of this process. Password masking is the technique of either hiding the password as it is typed or displaying other characters so that observers cannot see what characters the user is actually entering. Separation of duties relates to access to certain application areas. Reviewing procedures concerning revocation is an identification issue designed to deny access to inactive users.

Answer 2

A. When transactions are transmitted over local area networks Encryption protection is least likely to be used when transactions are transmitted over local area networks. Such protection makes it difficult for intercepted transmissions to be understood or modified. Encoding is important when confidential data are transmitted between geographically separated locations that can be electronically monitored. Although LANs may need encryption protection, the type of data and the described communication media make the other options appear more vulnerable. Encryption is often used when wire transfers are made between banks, confidential data are sent by satellite transmission, and financial data are sent over dedicated leased lines.

Answer 3

C. a disaster recovery plan. A disaster recovery plan should include a risk assessment, recommendation (and implementation) of safeguards, and recovery plans.

Answer 4

C. Identify inputs and outputs. The implementation phase of an accounting software application would include obtaining and installing hardware, documenting user procedures, training users, and entering and verifying test data. Identifying inputs and outputs would occur in the systems design and development phase, preceding implementation.

Answer 5

B. utility software functions. Data access security related to applications cannot be enforced through utility software functions. Utility programs are one of the more serious “holes” in data access security since some of them can actually bypass normal access controls. Data access security related to applications may be enforced through user identification and authentication functions incorporated in the application. Although there is a migration of control of this type away from applications to other software, most of these controls still reside in application software. Data access security related to applications may be enforced through user identification and authentication functions in access control software. Access control software has as one of its primary objectives improving data access security for all data on the system. Data access security related to applications may be enforced through security functions provided by a database management system. In fact, most database management systems provide for improved data access security while they are running.

Answer 6

B. run-to-run control totals and error lists. Use of control totals ensure that all transactions affecting inventories are accounted for and all valid orders processed accurately. The error lists are used to reconcile any differences in control totals.

Answer 7

C. computer operations unit. Help desks are usually a responsibility of computer operations because of the operational nature of their functions, e.g., assisting users with systems problems involving prioritization and obtaining technical support/vendor assistance. Applications development is responsible for developing systems. After formal acceptance by users, developers typically cease having day-to-day contact with a system's users. The responsibility of systems programming is to implement and maintain system-level software such as operating systems, access control software, and database systems software. The responsibility of user departments is to interact with application systems as planned. User departments typically do not have the expertise necessary to solve their own systems problems.

Answer 8

C. assembly language. All of the answer choices except assembly language are characteristic of computer machine language. Assembly language is a programming language in which each machine language instruction is represented by mnemonic characters; it is a symbolic language, an English-like and understandable alternative to basic machine language. Machine language is the binary code (the on/off electrical switches: zero and one) that can be interpreted by the internal circuitry of the CPU. The binary code is usually arranged as a hexadecimal (base 16) code. It is a very time-consuming, error-prone programming process.

Answer 9

C. simulation. Simulation is used as an auditing tool in testing transaction processing systems. It is not used directly as a security measure in E-commerce. The other answer choices are direct security measures used in e-commerce.

Answer 10

D. limit on the number of transaction inquiries that can be made by each user in a specified time period. A limit on transaction totals and frequency is not part of the access control matrix. An access control matrix consists of: a list of all authorized user code numbers and passwords, a list of all files and programs maintained on the system, and a record of the type of access to which each user is entitled. Terms Authorized Compatibility Check (Compatibility Test) Matrix References

Answer 11

D. compare product identification codes by store for consecutive periods. Comparison of product identification codes by store for consecutive periods could reveal periods in which some products had no sales, a possible indication of missing data. Unless product identification codes are consecutive, missing data would not be evident. This is not likely. A sort of store identification codes would produce all product identification codes and related data for each store. This would not be useful. Comparison of product identification codes for consecutive periods would not permit detection of missing rows of data.

Answer 12

C. database integrity might not be preserved during a network or computer failure. Database integrity might not be preserved during a network or computer failure because of the complexity of updates, the time delays when multiple sites are involved, and the number of nodes to be coordinated. Segregation of incompatible duties at the headquarters is independent of and imposes no risk on distributing the database. Since the database would be distributed to the local offices, it is likely that data would be updated more quickly than before. Both the centralized and distributed systems permitted access to all data, so if access security is maintained at the same levels, there should be no difference in the vulnerability of the database to outsiders.

Answer 13

C. integrity of index data. If index data for image processing systems are corrupted, users will likely be relying on the wrong images. Legibility and accuracy of image data are important to its use, but are independent of using the wrong image. Maintaining the initial sequence of index data may not be possible as the image data is modified and images are added/dropped.

Answer 14

D. Limiting access to employee master files to authorized employees in the personnel department The employee master file contains all of the personal wage rates, applicable deductions, fringe benefits, withholding criteria, etc., as well as other information unique to that individual that is necessary to process payroll. Thus, an internal control process that limits access to this file would prevent an employee from being paid an inappropriate hourly wage rate. An additional control would be to have someone other than the person recommending a payroll master file change review and approve the change.

Answer 15

C. Validity check A validity check is an edit test in which an identification number or transaction code is compared with a table of valid identification numbers or codes maintained in computer memory. A validity check on a customer number would have determined if the entry represented a valid customer. If not, the entry clerk would have been prompted to repeat the entry. A sequence check is an edit check that determines if a batch of input data is in the proper numerical or alphabetical sequence. This check would not compare the entry to all valid entries and notify the clerk of an error. A completeness test is an online data entry control in which the computer checks if all data required for a particular transaction has been entered by the user. The entry clerk in the question entered a customer identification number, and a completeness test would have accepted the entry even though it was not valid. A limit check ensures that a numerical amount in a record does not exceed some predetermined amount. As long as the entry clerk's customer identification number had the correct number of digits, a limit check would have allowed it to pass.

Answer 16

C. E-cash E-cash currencies, such as bitcoins, are anonymous and allow payment for purchases from websites. A credit card, a sight draft (one that promises immediate payment to the holder of the draft), and an electronic check (such as created when a debit card is used for a purchase) are not anonymous.

Answer 17

B. potential for computer disruptions in recording sales. As transactions travel through the Internet, they are subject to a variety of disruptions, at the sending computer, the receiving computer, during various processing steps, translations, and store-and-forward processes. These activities introduce risks such as unintentional errors, lost transactions, and duplication of transactions. Therefore, the auditor would be very concerned about completeness and accuracy controls over sale transactions processed via the Internet. Methods have been developed to replace the paper audit trail in all aspects of electronic commerce. While it may necessitate that the auditor test transactions throughout the financial statement period, the lack of paper sales invoices to audit can be overcome. The lack of a test facility or ability has internal control implications beyond just the processing of sales transactions. The frequency of archiving and data retention may affect when the auditor must test the internal controls over sales transactions, but with proper planning, testing can be done while the evidence of the electronic transaction is still available.

Answer 18

C. hash total. Assuming that the substitution takes place after the time cards have been batched for processing, the best control technique listed would be the hash total. The hash total is a type of batch control total. It is the summation of a quantitative but non-informational data field; for example, check numbers, purchase order numbers, and employee identification numbers.

Answer 19

A. an input control. Check digit verification is an example of an input control. The check digit is a number calculated based on a calculation using all but the last digit, which is the check digit. If the calculation returns the check digit, the number is accepted as valid. If the calculation returns a number other than the check digit, the input is rejected as invalid.

Answer 20

C. use trees to store data in a hierarchical structure. Hierarchical databases use tree structures to organize data; relational databases use tables. Relational databases are flexible and useful for unplanned, ad hoc queries, do store data in table form, and are maintained on direct access devices.

Answer 21

A. Change control Change control is the process of modifying application software, including requesting a change, reviewing the effectiveness of the change, approving the change, and implementing the change. Since programmers can implement application code changes without approval, there is a weakness in control over changes to application programs. Management override refers to management not following controls that are properly designed and in force. Data integrity refers to accuracy of data entered into the program or processing of that data rather than the software itself. Computer operations refer to the management of the computer system running the application rather than the steps programmed into the software.

Answer 22

D. The system librarian accepted the program into the production library after it had been tested by the programmer. The system librarian should only accept a modified program that has been properly tested by someone independent of the programmer to make sure that no unauthorized changes have been made.

Answer 23

C. increases system overhead. The machine instructions necessary to encrypt and decrypt data constitute system overhead, which means that processing may be slowed down. No encryption approach absolutely guarantees the secrecy of data in transmission although encryption approaches are considered to be less amenable to being broken than others. Keys may be distributed manually, but they may also be distributed electronically via secure key transporters. Using encryption software does not reduce the need for periodic password changes because passwords are the typical means of validating users' access to unencrypted data.

Answer 24

C. Reduction of the frequency of data-entry errors Since electronic funds transfer (EFT) allows transactions to take place more directly and with fewer intervening steps, there is less chance of human error. This can result in a reduction in the frequency of data-entry errors. EFT actually reduces the paper audit trail, although there are methods of monitoring and auditing such transactions at the time they occur. EFT may actually require stronger access controls due to the fact that fewer controls and reviews take place during the electronic processing of the transaction.

Answer 25

C. To restrict access to specific data and resources Logical security controls for information systems are used to restrict access to specific data and resources. Input controls ensure complete and accurate recording of data. Processing controls ensure complete and accurate processing of data. Output controls provide an audit trail of results of processing.

Answer 26

C. Code approved changes to a payroll program In highly integrated systems, a person with unrestricted access to the computer, its programs, and live data might be able to perpetuate and conceal fraud. Functions such as changing systems software, finding and correcting data-entry errors, and maintaining programming code and documentation are segregated to prevent fraud. For example, an applications programmer uses designs developed by analysts to develop the information system and write the code for a computer program.

Answer 27

B. To provide interactive assistance during the process of problem solving A DSS provides interactive problem-solving assistance. The DSS provides the decision maker with access to the computational capabilities, models, and data resources of the system to help in exploring the problem and developing potential solutions. A DSS should support rather than automate a manager's judgment. A DSS provides interactive rather than predefined problem-solving assistance. A DSS supports rather than replaces a manager's judgment in problem solving.

Answer 28

B. operating system. Initial log-in to a system is a function of the operating system–level access control software. An integrated test facility is an audit approach to validating processing. Database subschema authorizations control access to specific views of fields in a database. Access to applications and their data is a function of application level software.

Answer 29

C. Improper distribution of EDI transactions Electronic data interchange (EDI) transmits confidential information to business partners. There is always a risk in data transmission of it being received by unintended recipients, and this would concern an auditor. "Authorization of EDI transactions" is incorrect because proper authorization is required for transactions whether or not EDI is involved. "Duplication of EDI transmissions" is incorrect because duplication of transmissions to insure receipt is not a risk. The risks associated with these answer choices are controlled at the originating entity and do not result from improper transmission of the data. "Elimination of paper documents" is incorrect because elimination of paper documents reduces the chance that the information will be acquired by unintended recipients.

Answer 30

B. one-for-one checking. One-for-one checking involves retaining copies of all unnumbered documents submitted for processing and checking them off individually against a report of transactions processed. Batch totals require numerical control. Computer sequence checks require that transactions be numbered. Computer matching is performed under program control and not by the user.

Answer 31

A. Compare control and remittance totals One of the key tasks in processing cash receipts is to compare control totals and remittance totals. Such a task may be represented by a box on a flowchart describing the process. Tasks such as recording returns and allowances, authorizing and generating invoices, and authorizing and generating vouchers are not part of processing cash receipts.

Answer 32

B. assigned to groups before posting, and each transaction had its own line entry in the appropriate ledger. Batch processing is updating master files periodically to reflect all transactions that occurred during a given time period. To do this, transactions are grouped in batches and processed as a batch. The other answer choices are incorrect because: each transaction can have its own line entry in either batch or continuous processing and each transaction is posted to the ledger account as a part of the detailed posting of the batch, not just in a total

Answer 33

C. online teleprocessing facilities. Online teleprocessing would generally not involve a reciprocal processing agreement. Reciprocal processing agreements are often used for small systems, large batch operations, and small batch operations.

Answer 34

B. Pointer field A linked list has a pointer field which displays the address of the next record in the list.

Answer 35

C. heuristics. 启发式教学法 Knowledge-based systems use symbolic processing based on heuristics, rules-of-thumb.经验方法 Algorithms are defined procedures, characteristic of typical computer programs. Deterministic procedures are procedures, implemented in computer programs, that permit no uncertainty in outcomes. Simulations are computer programs that prepare results as if a set of assumptions were true.

Answer 36

C. problems with failures of the hardware used for processing data. Problems with failures of the hardware used for processing data are not considered a major risk, as PCs have hardware components similar to mainframe computers. The integrity of the hardware is quite high. A major concern with LANs is that users are responsible for building and maintaining procedures for capturing and processing data. One of the major problems associated with this form of end-user computing is that users often do not do a good job of documenting procedures. Security is a major concern for sensitive data residing on a PC and/or a LAN. Data communications are always a high risk factor on LANs because they do not happen automatically. The auditor will need to gain assurance that the company has mechanisms, including reconciliations, to ensure complete data communications.

Answer 37

A. user management. In distributed or cooperative systems, the responsibility for ensuring that adequate backups are taken is the responsibility of user management because the systems are under the control of users. In distributed environments, there will be no systems programmers comparable to those at central sites for traditional systems, there may be no data entry clerks because users are typically performing their own data entry, and there are no tape librarians

Answer 38

D. audit job accounting data for file accesses and job initiation/termination messages. Auditing job accounting data for file accesses and job initiation/termination messages will reveal whether the right data files were loaded/dismounted at the right times and the right programs were initiated/terminated at the right times, and thus verify whether the scheduling system performs as intended. Analyzing job activity with a queuing model to determine workload characteristics gives information about resource usage but does not verify whether the right data files were loaded/dismounted at the right times and the right programs were initiated/terminated at the right times. Simulating the resource usage and comparing the results with actual results of operating helps management characterize the workload but does not verify whether the right data files were loaded/dismounted at the right times and the right programs were initiated/terminated at the right times. Using library management software to track changes to successive versions of application programs permits control of production and test versions but does not verify whether the scheduling system performs as intended.

Answer 39

C. use less expensive computing equipment. Converting to open systems increases the number of vendors from which substitutable components could be acquired, which increases price competition for equipment. In general, running open systems: tends to increase the number of vendors, which decreases the amount of the average purchase from any one vendor, thereby decreasing the opportunities for volume discounts from vendors. allows organizations to scale their computing facilities to a precise size, which may be inconsistent with attempting to achieve economies of scale due to larger volumes concentrated in fewer sites. reduces an organization's reliance on proprietary components, which reduces the need for their integration into existing systems.

Answer 40

D. the display of a document with blanks for data items to be entered by the terminal operator. Just as preprinted source documents can be used to control the data collection and data recording processes in a manual system, the flashing of an outline of a document on a video monitor can be used to control the data transcription process in a computerized system that utilizes online data entry. This technique is referred to as pre-formatting screens.

Answer 41

A. reduce costs by reducing raw materials inventory. If implementing electronic data interchange (EDI) with suppliers permitted more frequent orders and more frequent communication about them, the company could reduce costs, e.g., inventory carrying costs, by reducing raw materials inventory. The company could ensure that it always maintained the 25-day buffer stock, but there would be no reason to do so if it could ensure more reliable deliveries by ordering more frequently. Tracking materials through production and scheduling production (intracompany processes) are not a use of electronic data interchange (EDI), which is inter-company exchange of business information.

Answer 42

D. persistent errors in user interaction with systems. The biggest risk in not having an adequately staffed help desk is that users will unknowingly persist in making errors in their interaction with the information systems.

Answer 43

A. manipulates 操纵 application programs. By definition, systems software consists of programs that act on the instructions provided in application programs. Stated another way, a systems program manipulates application programs.

Answer 44

B. Disaster recovery planning Having an alternate processing site is an example of disaster recovery planning since it allows processing to continue on the alternate site if something should happen to the main processing system. A disaster recovery plan is used to smoothly and quickly restore data processing capacity when there is a disaster. The other answer choices are incorrect: A closed loop refers to a mechanism whereby one party verifies the purported identity of another party by requiring them to supply a copy of a token transmitted to that identity. It is a form of authentication rather than disaster recovery. Authentication validation is a process of ensuring that proper parties are allowed to access the system. It is not related to disaster recovery. Segregation control testing is a policy to prevent individuals from accessing software or data without the collusion of another party. It is not related to disaster recovery.

Answer 45

C. Run antivirus software. The best approach to the described condition is to run antivirus software. A program taking longer than usual to load or execute is a symptom of a virus. Many viruses will spread and cause additional damage if many normal procedures are performed. Use of an appropriate antivirus program may identify and even eliminate a virus infection. Testing the system by running a different application program can enable a virus to spread 传播. Rebooting the system can enable a virus to spread. Backing up hard disk files to floppies can enable a virus to spread.

Answer 46

B. links all communication channels to form a loop and each link passes communication through its neighbor to the appropriate location. Ring networks do not have a central computer. Each site connects directly to only two other sites but is still able to communicate to all other sites via going through its neighbors. This means all data is passed through each site until arriving at the correct location. This essentially creates a loop where each link passes communication through its neighbor to the appropriate recipient. It is this configuration that gives ring network its name.

Answer 47

B. Maintain redundant 多余的 systems for instant availability to assure the flow of transactions If the system must be available on a continuous basis, there is an important need for backup systems that are instantly available in case of interruption of the primary system. Written source documents can later be inspected, but will not assure continued operation of the system. Business interruption insurance can provide funds to restore the system, but will not insure continued availability of the system. Data backups will enable reconstruction of lost information, but do not affect availability of the system to users.

Answer 48

C. hard disk. In a large database system maintained on a mainframe computer, the most common medium for data files for the database is the hard disk. In a large system, the magnetic tape files would not be a cost efficient storage medium. Data should never be stored in CPU memory. Efficiency of operations would be severely impaired and risk of data loss would be substantial. Read only memory does not apply to data files. Read only memory normally is reserved for the computer operating system.

Answer 49

D. change management control policies. Change management control policies put into place the proper processes and approval channels to make changes to an organization's systems.

Answer 50

A. Unauthorized access to system program and data files Unauthorized access to system program and data files is a risk associated with the use of telecommunications systems that is minimized through the use of a password control system. Physical locks and other such devices are used to prevent unauthorized physical availability of remote terminals. Organizational controls for security and protection are necessary to prevent physical destruction of remote terminals and system program and data files.

Answer 51

B. database has only consistent data. Integrity relates to the quality of a database. Among other considerations, data should be consistent and data inputs should conform to a predetermined standard of elements, size, and content.

Answer 52

B. Processing of data items is based on decision models. The use of decision models to organize data is a central element of MIS. The management of data in an organized database is a central element of MIS. Users of an MIS do not have to be computer experts to realize benefits. The MIS concept is not based on computers, and consists of an organized federation of subsystems rather than a single, highly integrated system.

Answer 53

C. a strategic information system. A strategic information system provides information that may allow an organization to make strategic, competitive decisions. Transaction processing systems support basic routine business functions. An office automation system is used by clerical personnel to process existing information. Decision support systems process semi-structured and unstructured problems.

Answer 54

A. Concurrent update control Only a concurrent update control can prevent problems when multiple users simultaneously update a record (i.e., the control locks other users out of the system until one has finished updating the file). The remaining controls listed do not have this functionality.

Answer 55

B. Identification of critical applications A disaster recovery plan allows a company to quickly resume normal business activities after a break in those activities due to a system failure or a natural disaster. A disaster recovery plan needs to include: recovery priorities, insurance, specific assignments for employees and departments, backup facilities, periodic testing of the recovery plan, and complete documentation of recovery plan (stored off-site). The information technology (IT) department would not be concerned with user department computers, warehouse security, or the training of operating personnel. (These are all outside the IT department.) The IT department would be concerned with identifying its critical applications in order to prioritize those applications which must be easily and quickly retrieved and implemented should a disaster occur.

Answer 56

A. unaltered in transmission. A digital signature allows the creator of a message to digitally “sign” the data and provides proof of authorization. Because a digital signature cannot be altered, it allows the recipient to determine that a message has been unaltered 不变的 in transmission.

Answer 57

D. convenience of the device. "Convenience 便利 of the device" is correct because convenience is a feature of the tablet device but is not a security risk in itself. Storage of sensitive data, portability of the device, and vulnerability of the device are incorrect because the device can easily be stolen, so sensitive data must be protected in that case.

Answer 58

C.transmission facilities on its premises are secure. If the company installs a leased-line network, it should ensure that transmission facilities on its premises are secure. In a leased-line network, there are no phone numbers and hence no ports with tone devices for incoming calls. Limiting network availability to certain times of the day is often associated with public switched lines, not leased lines, to reduce the time during which unauthorized people could potentially gain access to the system.

Answer 59

B. the programs may not be further tested before being placed into production permanently. The temptation is to place the test library program into production if it appeared to run satisfactorily. Test library programs can be assumed to be prepared by authorized personnel. The integrity of the production library is not threatened because no changes were made to the production library. Test library programs are run in such circumstances because the personnel involved believe that using them is better than using the prior programs or no programs at all.

Answer 60

D. successful testing of the plan. The only way to know whether contingency planning has been effective is to test the plan, by simulating an interruption or by conducting a paper test with a walk-through of recovery procedures. The absence of processing interruptions indicates nothing about the interruptions that might occur in the future, especially those that are not under the organization's control. A contingency plan may have comprehensive documentation, but until the plan is tested, an organization has no indication of its effectiveness. Audit sign-off is one indicator of plan quality, but until the plan is tested, an organization has no indication of its effectiveness.

Answer 61

D. The organization's strategic operational plan Strategic goals outline how the organization will use information systems to create a competitive advantage, and the strategic operational plan is, therefore, one of the most important influences on the development of the end-user computing strategic plan. The audit plan flows from the strategic plan, not vice versa. Changing technology could influence the organization's approach to security, so the security policy also flows from the strategic plan. Changing technology could influence the organization's approach to systems development, so the systems development methodology also flows from the strategic plan.

Answer 62

C. maintain as low a profile as possible for the data center. The best approach to avoid having the data center identified as a terrorist's target is to establish as low a profile as possible for the data center, e.g., by refraining from (1) identifying the building on the outside as a data center, (2) showcasing the data center through glass windows, of (3) advertising the important role the data center plays in operations. Ensuring that the disaster recovery plans are fully tested and hardening the electrical and communications systems so that they could withstand some kinds of attacks would not contribute to avoiding being selected as a terrorist's target. Monitoring the locations and activities of known terrorists, even if permitted by law, would not by itself help the company avoid having the data center selected as a terrorist's target.

Answer 63

A. erasing all employees' electronic mail immediately upon employment termination. “The company should have access to the business-related e-mail that is left behind. Access to e-mail can also be critical in business or possible criminal investigations.” The privacy concerns of the individual case must be mitigated by competing business interest; the need to follow-up on business e-mail and to assist in investigations. Encryption helps prevent eavesdropping of unauthorized persons trying to compromise e-mail messages. Limiting the number of electronic mail packages is a reasonable element of policy on electronic mail. It would be reasonable and prudent for electronic mail policy to direct that highly sensitive or confidential messages not be sent using electronic mail.

Answer 64

D. Traditional duties are less segregated. Conversion to automated data processing usually reduces the existing segregation of duties because the computer combines many functions which previously could have been performed by separate persons. Thus, an individual with access to the various computer functions could perform incompatible duties. Conversion to automated data processing usually reduces processing errors, has little or no effect on the types of risk to which the firm is exposed, and usually reduces processing time.

Answer 65

B.maintaining and updating the list of user passwords. The information security officer should not even know the user passwords. These are normally stored by a computer in encrypted format, and users change them directly. Developing an information security policy for the organization, commenting on security controls in new applications, and monitoring and investigating unsuccessful access attempts are appropriate duties of the information security officer.

Answer 66

D. data to be edited on a real-time basis. Using a sequential file organization, data is placed in the file using a key or code for sequencing. Sequential data can only be accessed after all preceding data records have been passed. Hence, it is impossible to edit the data on a real-time basis.

Answer 67

A. To take advantage of the time lag associated with negotiable instruments Time lag is the amount of time it takes a regular check to arrive at the payee, be deposited, and clear through regular banking channels. All of these processes are eliminated with EFT. EFT can reduce the payment time and allows for control of payments and transfers among accounts. Integration of EDI and EFT eliminates the requirements to manually input transaction data and introduce errors during the process.

Answer 68

D. Virtual private network A virtual private network (VPN) uses the Internet to provide secure remote access to an organization's network. The other answer choices (packet-switched network, digital encryption, and authority certificate) are incorrect because none of them create an encrypted communications tunnel across the Internet. They all refer to verification of the data being transmitted rather than the communication process.

Answer 69

D. recalculating an amount to assure its accuracy. Examples of internal checks are as follows: Limit check, which identifies if data have a value higher or lower than a predetermined amount Identification, which determines if the data is valid Sequence check, which checks sequencing Error log, which is simply an up-to-date log of all identified errors Transaction log, which provides the basic audit trail Arithmetic proof, which computes the calculation in order to validate the result Hence, an example of an internal check is recalculating an amount to assure its accuracy or arithmetic proof.

Answer 70

C. fulfill its obligations to customers. The better the recovery plans, the more likely the company would be to resume operations quickly and fulfill its obligations to customers. The company may or may not maintain the same level of employment after a disaster, e.g., a disaster that destroys productive capacity in one plant may lead to layoffs. Thorough planning may or may not minimize the cost of facility repair, i.e., the best approach may be to undergo more expensive repair sooner in order to resume operations sooner. The maximum benefit from planning is that it prompts action to avoid the most likely or most devastating events with the potential to interrupt business. Management would be delighted if planning ensured that business was never interrupted and thus that the recovery plan was never invoked.

Answer 71

B. optional. While automated monitoring of controls is helpful in creating an environment of continuous improvement, it is not necessary. Manual monitoring of controls can also help identify areas of process or control inefficiencies or ineffectiveness.

Answer 72

C. All computers linked to a local area network (LAN) Data integrity relates to using data for its intended purpose. A local area network would promote data integrity by making data available only to those users having a legitimate reason for access. Centralized access controls would help promote data integrity.

Answer 73

D. access control. Passwords are a form of access controls since they limit access to computer systems and the information stored in them. Physical controls limit access to an area and do not include passwords. Edit controls test the validity of data. Digital controls are examples of physical controls.

Answer 74

C. Location that is equipped with a redundant hardware and software configuration. A hot site is a completely operational data processing facility that is designed to meet the user's requirements and can be made available to the user for disaster recovery on short notice. Such a site includes both redundant hardware and software that are configured specifically to meet the user's needs.

Answer 75

A. run-to-run controls. Run-to-run controls for an online system are able to accumulate separate totals for all transactions processed during the day and then agree the totals to the total of items accepted for processing. Computer matching compares transaction data to referenced fields or records. Computer sequence checks identify changes or breaks in a numerical sequence. One-for-one checking generally requires manual comparisons of input data elements to processing results.

Answer 76

C. database schema. A database schema is “a view of the entire structure of the database.” It is “the organizational chart showing how the database is structured.” The database schema shows all elements of the database and areas of responsibility of individuals.

Answer 77

C. usually has lower upfront costs for equipment and maintenance. Computing clouds provide computation, software, data access, and storage resources without the cost of sophisticated computer systems or large IT. Shared resources, software, and information are provided to users as a metered service over the Internet, not a company’s intranet. Cloud computing has security issues as the user is relying on a third party. Cloud computing does not offer any advantages for program modification options; the advantages are essentially the same under either an in-house system or cloud computing.

Answer 78

D. apply a compatibility test to transactions or inquiries entered by the user. Use of a compatibility test for users would assure that an employee used a CRT only for purposes related to that employee's job description. For example, an accounts receivable clerk would not be allowed access to inventory or fixed asset records since those records would not be compatible with the duties of an accounts receivable clerk. None of the control measures mentioned in the other answers would specifically prevent an employee from making an unauthorized change in computer records unrelated to that employee's job.

Answer 79

A. organizational and operational changes are reflected in the recovery plans. A crucial aspect of recovery planning for the company is ensuring that organizational and operational changes are incorporated in the plans because such changes have the potential to make the recovery plans inapplicable. It is vital that changes to systems be tested thoroughly before being placed into production, but that is not a part of recovery planning. A good recovery plan would specify how operational staff might be replaced should the need arise, but their replacements might not be management personnel. Being able to predict workload changes accurately permits a company to minimize its information systems facility costs, but that is not a part of recovery planning.

Answer 80

A. a need-to-know basis. Access on a need-to-know basis means that access is authorized only as is required for employees to perform authorized job functions. Individual accountability means that individuals with access to data are responsible for the use and security of data obtained via their access privileges. Just-in-time means arranging delivery of inventory or materials as close to the time they would be incorporated into products as is possible rather than maintaining large quantities of inventory or materials. Management-by-exception means spending managerial time on exceptional conditions on the grounds that attending to exceptions is a better approach to management than spending time on the transactions or processes that are operating in their normal ranges.

Answer 81

D. hot site. A hot site is one that contains all essential hardware to restore the system in a minimal amount of time. A hot site is more costly than a cold site, which includes only appropriate power, air conditioning, and support systems, but no hardware.

Answer 82

D. cryptographic devices. Cryptographic devices protect data in transmission over communication lines. Asynchronous modems handle data streams from peripheral devices to a central processor. Authentication techniques confirm that valid users have access to the system. Call-back procedures are used to ensure incoming calls are from authorized locations.

Answer 83

A. backup/restart procedures have been built into job streams and programs. An essential component of a disaster recovery plan is that the need for backup/restart has been anticipated and provided for in the application systems. Change control procedures should not be bypassed by operating personnel, changes in equipment capacities should be compatible with projected workloads, and service level agreements with owners of critical applications should be adequate, but these are not generally considerations in disaster recovery planning.

Answer 84

B. Alternate processing site, backup and off-site storage procedures, identification of critical applications, and test of the plan Disaster plans must include all of the following factors: ``` A backup for programs and data An alternative processing site Off-site storage of backup Identification of critical applications A method for testing the plan ```

Answer 85

B. Disaster recovery plan A disaster recovery plan (DRP) is designed to smoothly and quickly restore the data processing capability of the organization when there is a disaster. When developing a DRP, the first step is to create a set or responsibilities for the various participants and tasks that are to be included in the plan. Once this step is completed, the participants named would likely be the ones to complete the plan. The plan would include the following: Setting recovery priorities Providing the necessary insurances Providing for backup computer and telecommunications facilities Having procedures for periodic testing and revision Complete documentation of the process

Answer 86

A. Executive support system An executive information system provides executives with information to make strategic plans, control the company, monitor business conditions, and identify business problems and opportunities. The word “strategic” tells you this system provides information at a high level, the executive level. The other answer choices are incorrect because they operate at lower levels in the organization and do not provide information directly related to strategic planning.

Answer 87

A. control access to information system resources. The primary objective of security software is to control access to information system resources such as data files, software and program libraries. Security software can detect the use of unauthorized utility software, but not its installation. Viruses are detected by anti-virus software. Security software may be helpful as a tool in establishing separation of duties. However, security software does not monitor separation of duties.

Answer 88

B. hash total on employee Social Security numbers. Hash totals on employee Social Security numbers would represent a total of all Social Security numbers. This would be an EDP control used to assure the paychecks had been written for all employees for a pay period. Record count simply calculates the number of records. It may be effective for the number of checks, but not validate the correct employees. Check digit validates a numeric field and would not give assurance in this instance. Validity check validates only one field in a given record.

Answer 89

A. part of the detailed design phase. The systems development cycle consists of analysis, conceptual design, detailed design, implementation, and operation. In this cycle, coding (of data, accounts, etc.) is a part of the detailed design stage, the stage in which programs and data structures are developed and facilities are installed and employees are trained.

Answer 90

A. Data control group The data control group makes sure that: a log is kept of all inputs, data processing operations, stored data, and system output, source data have been properly approved, transactions are processed correctly, input and output are reconciled, records of input errors are maintained so they can be corrected and resubmitted, data-related errors are sent to the users who originated the transaction for correction, systems output is distributed to the intended and proper user, and there is adequate rotation of operator duties.

Answer 91

D. document Document flowcharts, also called horizontal flowcharts, depict areas of responsibility such as departments arranged horizontally across the chart. For example, purchasing, receiving, and storage might be used in a flowchart representing materials acquisition.

Answer 92

C. integrate data from all aspects of an organization's activities. Enterprise resource planning (ERP) systems integrate all aspects of a company's operations in its information system. Such systems integrate financial and non-financial operating data, and collect data from external sources. The answer choices “allow non-experts to make decisions about a particular problem” and “help with the decision-making process” are incorrect because ERP systems provide the data but do not enhance the ability to make decisions based on that data. “Present executives with the information needed to make strategic plans” is incorrect because ERP systems provide operating data, not information from the analysis of that data or projections about the future needed to make strategic plans.

Answer 93

A. changes in equipment, data, and software. Because the company has not revised its contingency plan since the decentralization, the existing plan will probably be out of date because of changes in equipment, data, and software. Headquarters has adequate processing capability, so the plan is not affected. A cold site may not be needed by headquarters. Personnel turnover alone would not cause the plan to be out of date.

Answer 94

D. An enterprise resource planning system Enterprise resource planning (ERP) systems integrate all aspects of a company's operations in its information system. Such systems integrate financial and non-financial operating data, and collect data from external sources. A decision support system provides information for a particular decision, not enterprise-wide data. An executive support system provides information at a high level to support executive strategic planning, not detailed enterprise-wide data. An office automation system computerizes the information system but does not provide detailed enterprise-wide data.

Answer 95

D. Develop and code computer programs. A systems analyst would be likely to be involved in analysis of the present system, preparing program specifications, designing computer applications and flowcharts. A systems analyst would not develop and code computer programs. This is a function performed by a programmer.

Answer 96

B. continuation of mortgage servicing. The most critical aspect of the planning would be to provide for continuation of mortgage servicing. Without mortgage servicing, the company would be out of business. Deterring and detecting fraud or abuse while processing in recovery mode is important, but that is not the most critical aspect to consider. There should be control over information assets at all times, but that is not the most critical aspect. The company would want to minimize expenses during recovery periods but not at the expense of continuing to service mortgages.

Answer 97

C. a separate backup run is required for disk while the prior master on magnetic tape serves as a backup. Disk-oriented systems typically employ destructive updating (i.e., new (updated) master records are written over the old master records, thereby destroying them). Consequently, disk-oriented systems require separate backup procedures. Whereas, tape-oriented systems generate a new master file tape as an output from the updating run, leaving the old master file tape and the transaction file tape for use as backup.

Answer 98

D. Advances in disaster recovery systems Although advances in disaster recovery systems may ease addressing the risks of disasters, such advances probably have little effect on the changes seen currently occurring in the workplace. These changes are most affected by advances in computer technology, computer applications, and computer availability.

Answer 99

C. Online An online transaction is processed with other computers or networks immediately through the Internet. The transaction is processed without delay as it is initiated and executed. Input or initiation equipment (e.g., a cash register) is in direct and open communication with the CPU (central processing unit) of the processing computer system. An online system provides updated information for the entire system, not only a part. In batch processing, items to be processed are collected in groups to permit fast and convenient processing (processed as a group). However, there is a delay before the batch is processed. Distributed data processing is a network of interdependent computers where certain functions are centralized, other functions are decentralized, and processing is shared among two or more computers. Since some functions are decentralized, there is a delay in combining records for the entire system. An application is a computer program for performing a specific function, such as a payroll program. It does not provide complete information for the entire entity.

Answer 100

D. business interruption. Greater reliance of management on information systems increases the exposure to business interruption. As management relies more on information systems for crucial functions, system failures have the potential to interrupt business. The exposure of unauthorized third-party access to systems is increased by the absence of adequate access controls to systems, not by greater reliance of management on information systems. Systematic programming errors are the result of misspecification of requirements or lack of correspondence between specifications and programs, not of greater reliance of management on information systems. Inadequate knowledge bases are a function of lack of care in building them; exposure does not result from greater reliance of management on information systems.

Answer 101

D. electronic vaulting跳跃的. Electronic vaulting is the process of electronically transmitting and storing backups of programs and data at a remote data storage facility.

Answer 102

D. Adopting the fixed-asset module of the new system for integration An enterprise-wide system is intended to include financial records of the entire entity, so the depreciation records should become part of the new system. Enterprise resource planning (ERP) systems integrate all aspects of a company's operations with its traditional information system. All of the other answer choices are incorrect because information maintained in separate systems is not available to the main system, which defeats the purpose of an ERP system.

Answer 103

C. that system failure is of lesser significance. Some advantages of decentralized 使分散 data processing facilities are: decentralization increases direct access by users, standalone capabilities are distributed to points of need, participation is increased in designs and use, and the ability to share computing power, which decreases the significance of system failure.

Answer 104

A. Managing remote access The key element is defining the responsibilities of a network administrator in a multinational organization. A network administrator in this environment would be expected to deal with the full scope of network activities, which would include access to the network from remote locations. Developing application programs, reviewing security policy, and installing systems upgrades are not tasks that would be performed at the network administrator level, even if the administrator had the skills necessary to do so.

Answer 105

B. Setting up a password for the screensaver program on the notebook computer Password protection for a screensaver program can be easily bypassed. Data encryption provides adequate security for notebook computers. Removable hard drives would provide adequate security. Security is promoted by physically locking the notebook computer to an immovable object.

Answer 106

C. Application Application controls refer to the transactions and data relating to each computer-based application system and are, therefore, specific to each process. Preventive, corrective, and detective controls are terms that apply to particular types of controls that may appear in any application, and so are incorrect answer choices. Corrective controls remedy problems discovered through detective controls. They include procedures to identify the cause of a problem, correct errors arising from the problem, and modify the system so that future errors may be minimized or eliminated. A detective control is a control that provides an alert after an unwanted event. A detective control is designed to catch an error and provide the feedback necessary so corrective action may be taken.

Answer 107

A. Both sender and receiver must have the private key before this encryption method will work. A major disadvantage of private key encryption is that both the sender and receiver must have the same (private) key, and this must be securely transmitted to avoid interception and decryption of the message by others. "The private key cannot be broken into fragments and distributed to the receiver" is incorrect because the private key can be transmitted in distinct fragments. "The private key is used by the sender for encryption but not by the receiver for decryption" and "the private key is used by the receiver for decryption but not by the sender for encryption" are both incorrect because both the sender and receiver use the same key.

Answer 108

A. Online analytical processing system This system is intended to allow users to analyze stored data, so it is an analytical system. An online transaction-processing system does not process transactions. An online executive information system does not provide high-level (summary) information. An online information storage system does not store data; instead, it accesses data already stored.

Answer 109

A. Flowcharting software Flowcharting software could be used to reduce the cost of preparing and updating flowcharts. The other answer choices are probably not viable alternatives. Organization charts typically show people rather than operations and controls. “Standard” flowcharts might show an ideal process layout but would probably not capture the actual situation present in a real unit. Outsourcing would probably be much more costly than the internal use of software.