Question 1

The IT Governance Committee has several important responsibilities.Which of the following is not normally one of those responsibilities?

Accepted Answer

A) Align IT investments to business strategies. 
B) Oversee and prioritize changes to IT systems. 
C) Develop, monitor, and review security procedures. 
D) Investing excess IT funds in long-term investments. 
A) Align IT investments to business strategies. 
B) Oversee and prioritize changes to IT systems. 
C) Develop, monitor, and review security procedures. 
D) Investing excess IT funds in long-term investments.

Question 2

Using a unique service set identifier SSID) makes it more difficult for an outsider to access the wireless network.

Accepted Answer

A) True 
 B)False

Question 3

Disaster recovery planning is a proactive plan to protect IT systems and the related data.

Accepted Answer

A) True 
 B)False

Question 4

The establishment of log-in procedures can help prevent or lessen security risks and are referred to as:

Accepted Answer

A) Reactive controls 
B) Preventive controls 
C) Availability controls 
D) Confidentiality controls 
A) Reactive controls 
B) Preventive controls 
C) Availability controls 
D) Confidentiality controls

Question 5

With the proper training of employees and the adequate controls, it would be possible to eliminate all errors.

Accepted Answer

A) True 
 B)False

Question 6

The use of dual firewalls - one between the internet and the web server and one between the web server and the organization's network - can help prevent unauthorized from accessing the organization's internal network of computers.

Accepted Answer

A) True 
 B)False

Question 7

The process of proactively examining the IT system for weaknesses that can be exploited by hackers, viruses, or malicious employees is called:

Accepted Answer

A) Intrusion detection 
B) Virus management 
C) Vulnerability assessment 
D) Penetration testing 
A) Intrusion detection 
B) Virus management 
C) Vulnerability assessment 
D) Penetration testing

Question 8

Which of the following is NOT one of the types of control totals?

Accepted Answer

A) Digit Count 
B) Record Count 
C) Batch Totals 
D) Hash Totals 
A) Digit Count 
B) Record Count 
C) Batch Totals 
D) Hash Totals

Question 9

In order to master risks and controls and how they fit together, which of the following is NOT one of the areas to fully understand?

Accepted Answer

A) The accounting information system. 
B) The description of the general and application controls that should exist in IT system. 
C) The type and nature of risks in IT systems. 
D) The recognition of how controls can be used to reduce risk. 
A) The accounting information system. 
B) The description of the general and application controls that should exist in IT system. 
C) The type and nature of risks in IT systems. 
D) The recognition of how controls can be used to reduce risk.

Question 10

The functional responsibilities within an IT system must include the proper segregation of duties.Which of the following positions is not one of the duties that is to be segregated from the others?

Accepted Answer

A) Systems analysts 
B) Chief information officer 
C) Database administrator 
D) Operations personnel 
A) Systems analysts 
B) Chief information officer 
C) Database administrator 
D) Operations personnel

Question 11

This item, that strengthens the use of passwords, is plugged into the computer's card reader and helps authenticate that the use is valid; it has an integrated circuit that displays a constantly changing ID code.These statement describe:

Accepted Answer

A) Security token 
B) USB control key 
C) Smart card 
D) Biometrics 
A) Security token 
B) USB control key 
C) Smart card 
D) Biometrics

Question 12

The risk that an unauthorized user would shut down systems within the IT system is an):

Accepted Answer

A) Security risk 
B) Availability risk 
C) Processing integrity risk 
D) Confidentiality risk 
A) Security risk 
B) Availability risk 
C) Processing integrity risk 
D) Confidentiality risk

Question 13

Which of the following is not an example of physical characteristics being used in biometric devices?

Accepted Answer

A) Retina scans 
B) Fingerprint matching 
C) Social security number 
D) Voice verification 
A) Retina scans 
B) Fingerprint matching 
C) Social security number 
D) Voice verification

Question 14

Examples of Business Continuity include all of the following except:

Accepted Answer

A) Disaster Recovery Plan 
B) Backup Data 
C) Environmental Backup Recovery Plan 
D) Offsite Backup 
A) Disaster Recovery Plan 
B) Backup Data 
C) Environmental Backup Recovery Plan 
D) Offsite Backup

Question 15

A new technology that is used to authenticate users is one that plugs into the USB port and eliminates the need for a card reader.This item is called a:

Accepted Answer

A) Biometric reader 
B) Smart card 
C) USB smart key 
D) Security token 
A) Biometric reader 
B) Smart card 
C) USB smart key 
D) Security token

Question 16

Hardware, software, or a combination of both that is designed to block unauthorized access to an IT system is called:

Accepted Answer

A) Computer log 
B) Biometric device 
C) Firewall 
D) Security token 
A) Computer log 
B) Biometric device 
C) Firewall 
D) Security token

Question 17

The AICPA Trust Services Principles categorizes IT controls and risks into categories.Which of the following is not one of those categories?

Accepted Answer

A) Confidentiality 
B) Security 
C) Recovery 
D) Availability 
A) Confidentiality 
B) Security 
C) Recovery 
D) Availability

Question 18

In a properly segregated IT system, no single person or department should develop computer programs and also have access to data that is commensurate with operations personnel.

Accepted Answer

A) True 
 B)False

Question 19

Nonrepudiation means that:

Accepted Answer

A) A user is not authorized to change configuration settings. 
B) A user is not allowed access to the authority tables. 
C) A user can prevent the unauthorized flow of data in both directions. 
D) A user cannot deny any particular act that he or she did on the IT system. 
A) A user is not authorized to change configuration settings. 
B) A user is not allowed access to the authority tables. 
C) A user can prevent the unauthorized flow of data in both directions. 
D) A user cannot deny any particular act that he or she did on the IT system.

Question 20

The accuracy, completeness, and timeliness of the process in IT systems is referred to as:

Accepted Answer

A) Availability Risks 
B) Security Risks 
C) Confidentiality Risks 
D) Processing Integrity Risks 
A) Availability Risks 
B) Security Risks 
C) Confidentiality Risks 
D) Processing Integrity Risks

The IT Governance Committee has several important responsibilities.Which of the following is not normally one of those responsibilities?

Using a unique service set identifier SSID) makes it more difficult for an outsider to access the wireless network.

Disaster recovery planning is a proactive plan to protect IT systems and the related data.

The establishment of log-in procedures can help prevent or lessen security risks and are referred to as:

With the proper training of employees and the adequate controls, it would be possible to eliminate all errors.

The use of dual firewalls - one between the internet and the web server and one between the web server and the organization's network - can help prevent unauthorized from accessing the organization's internal network of computers.

The process of proactively examining the IT system for weaknesses that can be exploited by hackers, viruses, or malicious employees is called:

Which of the following is NOT one of the types of control totals?

In order to master risks and controls and how they fit together, which of the following is NOT one of the areas to fully understand?

The functional responsibilities within an IT system must include the proper segregation of duties.Which of the following positions is not one of the duties that is to be segregated from the others?

This item, that strengthens the use of passwords, is plugged into the computer's card reader and helps authenticate that the use is valid; it has an integrated circuit that displays a constantly changing ID code.These statement describe:

The risk that an unauthorized user would shut down systems within the IT system is an):

Which of the following is not an example of physical characteristics being used in biometric devices?

Examples of Business Continuity include all of the following except:

A new technology that is used to authenticate users is one that plugs into the USB port and eliminates the need for a card reader.This item is called a:

Hardware, software, or a combination of both that is designed to block unauthorized access to an IT system is called:

The AICPA Trust Services Principles categorizes IT controls and risks into categories.Which of the following is not one of those categories?

In a properly segregated IT system, no single person or department should develop computer programs and also have access to data that is commensurate with operations personnel.

Nonrepudiation means that:

The accuracy, completeness, and timeliness of the process in IT systems is referred to as:

Introduction to AIS

Foundational Concepts of the AIS

Fraud, Ethics, and Internal Control

IT Governance

Erp Systems

Auditing Information Technology Bases Processes

Revenue and Cash Collection Processes

Expenditures Processes and Controls - Purchases

Expenditures Processes and Controls Payroll and Fixed Assets

Conversion Processes and Controls

Administrative Processes and Controls

Data and Databases

Ecommerce and Ebusiness

Filters

Exam 4: Internal Controls and Risks in IT Systems

The IT Governance Committee has several important responsibilities.Which of the following is not normally one of those responsibilities?

Using a unique service set identifier SSID) makes it more difficult for an outsider to access the wireless network.

Disaster recovery planning is a proactive plan to protect IT systems and the related data.

The establishment of log-in procedures can help prevent or lessen security risks and are referred to as:

With the proper training of employees and the adequate controls, it would be possible to eliminate all errors.

The use of dual firewalls - one between the internet and the web server and one between the web server and the organization's network - can help prevent unauthorized from accessing the organization's internal network of computers.

The process of proactively examining the IT system for weaknesses that can be exploited by hackers, viruses, or malicious employees is called:

Which of the following is NOT one of the types of control totals?

In order to master risks and controls and how they fit together, which of the following is NOT one of the areas to fully understand?

The functional responsibilities within an IT system must include the proper segregation of duties.Which of the following positions is not one of the duties that is to be segregated from the others?

This item, that strengthens the use of passwords, is plugged into the computer's card reader and helps authenticate that the use is valid; it has an integrated circuit that displays a constantly changing ID code.These statement describe:

The risk that an unauthorized user would shut down systems within the IT system is an):

Which of the following is not an example of physical characteristics being used in biometric devices?

Examples of Business Continuity include all of the following except:

A new technology that is used to authenticate users is one that plugs into the USB port and eliminates the need for a card reader.This item is called a:

Hardware, software, or a combination of both that is designed to block unauthorized access to an IT system is called:

The AICPA Trust Services Principles categorizes IT controls and risks into categories.Which of the following is not one of those categories?

In a properly segregated IT system, no single person or department should develop computer programs and also have access to data that is commensurate with operations personnel.

Nonrepudiation means that:

The accuracy, completeness, and timeliness of the process in IT systems is referred to as:

Introduction to AIS

Foundational Concepts of the AIS

Fraud, Ethics, and Internal Control

IT Governance

Erp Systems

Auditing Information Technology Bases Processes

Revenue and Cash Collection Processes

Expenditures Processes and Controls - Purchases

Expenditures Processes and Controls Payroll and Fixed Assets

Conversion Processes and Controls

Administrative Processes and Controls

Data and Databases

Ecommerce and Ebusiness

Filters