IS Audit and Control Quiz

While planning an individual audit assignment, an IS auditor should consider the following:

• Prior audit reports

• Risk assessment reports

• Regulatory requirements

• All the above

What is an example of deterrent control?

• Installation of surveillance cameras with warning signs about filming.

• Automatic backup of data to restore it in case of loss.

• Installing anti-virus software to detect malware.

• Regularly testing the system for vulnerabilities to eliminate them.

What can be identified as correct formula for the residual risk?

• Residual risk = Gross risk – risks covered by the implemented control

• Residual risk = Net risk - risks covered by the implemented control

• Residual risk = Gross risk – net risk

• Residual risk = Net risk – Gross risk

What must be included in change management policy?

• SoD

• Requirements for roll-back plans

• Emergency change management

• All the above

The following description is an example of which control: “In a human resources system, an employee's age can be limited from 18 to 65. If someone enters a value of 70, the system will reject it because it is outside the acceptable range”?

• Data integrity principles

• Checksums

• Checkdigits

• Limit checks

What is a management’s risk appetite?

• The level of risk that an organization is willing to accept in pursuit of its objectives.

• A detailed process of identifying and mitigating all risks within an organization.

• The minimum level of risk that an organization is legally required to avoid.

• The set of policies used to eliminate all potential risks to the organization.

Which of the options below is not a type of authentication?

• Something you know

• Something you have

• Something you are

• None of the above

Which of the following is an example of least privilege access?

• An employee has access to all company systems, even if he/she does not use them in his/her work.

• An IT employee has access to only those servers that are necessary for his/her daily duties.

• The sales manager has full access to the company's financial systems.

• The human resources manager has administrative access to all employee accounts in the system.

Which of changeovers requires most resources?

• Parallel changeover

• Abrupt changeover

• Phased changeover

• Direct changeover

What is the primary purpose of maintaining a register of technical user accounts?

• To maintain a list of all employees of an organization with their work contacts.

• To maintain a record and control of technical accounts that are used by systems and applications for automated processes.

• Register all administrative users for access to shared company resources.

• Maintain a list of user accounts that only have access to public company information.