Chapter 1
Chapter 2
Chapter 3
Chapter 4
Chapter 5
100
In planning an audit, the most difficult step is the identification of the: A: Areas of High Risk B: Skill sets of the Audit Staff C: Test Steps on the Audit D: Time Allotted for the Audit
What is "Areas of High Risk"(A)? Reference: AI-22
100
A top-down approach to the development of operational policies helps ensure: A: That they are consistent across the organization B: That they are implemented as part of risk assessment C: Compliance with all the policies D: That they are reviewed periodically
What is "That they are consistent across the organization"? (A) Reference: A2-81
100
What process uses test data as part of a comprehensive test of program controls in a continuous online manner? A: Test data/deck B: Base-case system evaluation C: Integrated Test Facility (ITF) D: Parallel simulation
What is "Base-case system evaluation"? (B) Reference: A3-35
100
An IS auditor reviewing a new outsourcing contract with a service provider would be most concerned if which of the following was missing? A: A clause providing a "right to audit" service provider B: A clause defining penalty payments for poor performance C: Predefined service level report templates D: A clause regarding supplier limitation of liability
What is "A clause providing a "right to audit" service provider"? (A) Reference: A4-3
100
The implementation of which of the following would most effectively prevent unauthorized access to a system administration account? A: Host intrusion detection software B: Automatic password expiration policy C: Password complexity rules D: Two-factor authentication (2FA)
What is "Two-factor authentication (2FA)"? (D) Reference: A5-9
200
A primary benefit derived from an organization employing controls self assessment techniques is that it: A: Can identify high risk areas that might need a detailed review later B: Allow IS auditors to independently assess risk C: Can be used as a replacement for traditional audits D: Allows management to relinquish responsibility for control
What is "Can identify high risk areas that might need a detailed review later"? (A) Reference: AI-23
200
A poor choice of passwords and transmission over unprotected communications lines are examples of: A: Vulnerability B: Threats C: Probabilities D: Impacts
What is "Vulnerability"? (A) Reference: A2-93
200
During which of the following phases in system development would user acceptance test plans normally be prepared? A: Feasibility study B: Requirements definition C: Implementation planning D: Post implementation review
What is "Requirements definition"? (B) Reference: A3-58
200
Which of the following recovery strategies is most appropriate for a business having multiple offices within a region and a limited recovery budget? A: A hot site maintained by the business B: A commercial cold site C: A reciprocal arrangement between its offices D: A third-party hot site
What is "A reciprocal arrangement between its offices"? (C) Reference: A4-6
200
The auditor is reviewing prior findings from an IT audit of a hospital. One finding indicates that the organization was using e-mail to communicate sensitive patient issues. The IT manager indicates that to address the finding, the organization has implemented digital signatures for all e-mail users. What should the IS auditor's response be? A: Digital signatures are adequate to protect confidentiality. B: Digital signatures are not adequate to protect confidentiality. C: The auditor should recommend implementation of digital watermarking for secure email. D: The auditor should gather more information about the specific implementation.
What is "Digital signatures are not adequate to protect confidentiality?" (B) Reference: A5-19
300
An IS auditor is reviewing a testing procedure and has concluded that material errors were not identified. What type of risk does this represent? A: Detection risk B: Audit risk C: Control risk D: Inherent risk
What is "Detection risk" (A)? Reference: AI-26
300
To aid management in achieving IT and business alignment, an IS auditor should recommend the use of: A: Control Self Assessment (CSA) B: A business impact analysis (BIA) C: An IT balanced scorecard (BSC) D: Business Process Re-engineering
What is "An IT balanced scorecard (BSC)"? (C) Reference: A2-90
300
Which testing approach is most appropriate to ensure that internal application interface errors are identified as soon as possible? A: Bottom-up B: Sociability testing C: Top-down D: System test
What is "Top-down"? (C) Reference: A3-100
300
An IS auditor has completed an audit of the IT department of an organization. Which of the following findings should be considered the most critical? A: Workstation operating system patch levels are not consistent on each machine B: The business continuity plan is current, but is not tested annually C: The password change policy is not being actively enforced D: Servers are not backed up on a regular basis
What is "Servers are not backed up on a regular basis"? (D) Reference: A4-15
300
An installed Ethernet cable run in an unshielded twisted pair (UTP) network is more than 100 meters long. Which of the following could be caused by the length of the cable? A: Electromagnetic interference B: Crosstalk C: Dispersion D: Attenuation
What is "Attenuation"? (D) Reference: A5-304
400
Which of the following forms of evidence will an IS auditor consider the most reliable? A: An oral statement from the auditee B: The results of a test performed by an external IS auditor C: An internally generated computer accounting report D: A confirmation letter received from an outside source
What is "The results of a test performed by an external IS auditor"? (B) Reference: A1-38
400
The ultimate purpose of IT governance is to: A: Encourage optimal use of IT B: Reduce IT costs C: Decentralize IT resources across the organization D: Centralize control of IT
What is "Encourage optimal use of IT"? (A) Reference: A2-110
400
Which of the following line media would provide the best security for a telecommunication network? A: Broadband network digital transmission B: Baseband network C: Dial-up D: Dedicated lines
What is "Dedicated lines"? (D) Reference: A3-140
400
An organization has a recovery time objective (RTO) equal to zero and a recovery point objective close to one minute for a critical system. This implies that the system can tolerate: A: A data loss of up to one minute, but the processing must be continuous B: A 1-minute processing interruption but cannot tolerate any data loss C: A processing interruption of one minute or more D: Both a data loss and a processing interruption longer than one minute
What is "A data loss of up to one minute, but the processing must be continuous"? (A) Reference: A4-148
400
Digital signatures require the: A: Signer to have a public key and the receiver to have a private key B: Signer to have a private key and the receiver to have a public key C: Signer and receiver to have a public key D: Signer and receiver to have a private key
What is "Signer to have a private key and the receiver to have a public key"? (B) Reference: A5-96
500
When performing a computer forensic investigation, in regard to the evidence gathered, an IS auditor should be most concerned with: A: Analysis B: Evaluation C: Preservation D: Disclosure
What is "Preservation"? (C) Reference: A1-58
500
Which of the following represents an example of a preventive control with respect to IT personnel? A: Review of visitor logs for the data center B: A log server that tracks log-on IP addresses of users C: Implementation of a badge entry system for the IT facility D: An accounting system that tracks employee telephone calls
What is "Implementation of a badge entry system for the IT facility"? (C) Reference: A2-109
500
When evaluating the controls of an electronic data interchange application, an IS auditor should primarily be concerned with the risk of: A: Excessive transaction turnaround time B: Application interface failure C: Improper transaction authorization D: Non-validated batch totals
What is "Improper transaction authorization"? (C) Reference: A3-121
500
The primary purpose of implementing Redundant Array of Inexpensive Disks (RAID) level 1 in a file server is to: A: Achieve performance improvement B: Provide user authentication C: Ensure availability of data D: Ensure the confidentiality of data
What is "Ensure availability of data"? (C) Reference: A4-156
500
Which of the following fire suppression systems is most appropriate to use in a data center environment? A: Wet-pipe sprinkler system B: Dry-piple sprinkler system C: FM-200 system D: Carbon dioxide-based fire extinguishers
What is "FM-200 system"? (C) Reference: A5-269
M
e
n
u