Question 1

Which of the following backup sites is the least expensive but has the slowest recovery speed?

Accepted Answer

A)  Hot backup site 
B)  Warm backup site 
C)  Cold backup site 
D)  Frozen backup site 
A)  Hot backup site 
B)  Warm backup site 
C)  Cold backup site 
D)  Frozen backup site

Question 2

Which of the following roles have control ownership related to protecting the physical computer systems?

Accepted Answer

A)  Information Security Manager 
B)  Data Center Manager 
C)  Facilities Manager 
D)  All answer choices are correct. 
A)  Information Security Manager 
B)  Data Center Manager 
C)  Facilities Manager 
D)  All answer choices are correct.

Question 3

Which development environment is often referred to as the sandbox because developers can test without having impact on the live systems?

Accepted Answer

A)  Test 
B)  Model 
C)  Production 
D)  Alteration 
A)  Test 
B)  Model 
C)  Production 
D)  Alteration

Question 4

Alejandro reviewed the user access protocols for Ponder Products. Alejandro is concerned that the accounting system could be subject to malicious attacks on user accounts that are currently protected with a user name and password. The system has the capability to send a message to a user's cell phone or email address. How could Alejandro use the messaging capabilities of the system to further protect it from attack?

Accepted Answer

A)  Enable two-factor authentication 
B)  Enable fingerprint scanners 
C)  Enable read-only access for all users 
D)  Enable administrator access for all users 
A)  Enable two-factor authentication 
B)  Enable fingerprint scanners 
C)  Enable read-only access for all users 
D)  Enable administrator access for all users

Question 5

In which change management environment does a developer write code to make the change in the system?

Accepted Answer

A)  Test 
B)  Model 
C)  Production 
D)  Live 
A)  Test 
B)  Model 
C)  Production 
D)  Live

Question 6

Which statement concerning the disaster response Recovery Time Objective (RTO) is TRUE?

Accepted Answer

A)  The RTO is how much time a system can be down before it causes significant damage to the business. 
B)  The RTO may be as short as a few seconds. 
C)  The RTO considers how long the system restoration and data re-load process takes. 
D)  All of these statements are true. 
A)  The RTO is how much time a system can be down before it causes significant damage to the business. 
B)  The RTO may be as short as a few seconds. 
C)  The RTO considers how long the system restoration and data re-load process takes. 
D)  All of these statements are true.

Question 7

Which of the following statements concerning IT governance are TRUE?

Accepted Answer

A)  IT governance requires a dedicated department. 
B)  IT governance ensures effective and efficient use of IT. 
C)  IT governance should be scheduled to occur once per year. 
D)  IT governance standards framework, COSO, focuses on minimizing risk. 
A)  IT governance requires a dedicated department. 
B)  IT governance ensures effective and efficient use of IT. 
C)  IT governance should be scheduled to occur once per year. 
D)  IT governance standards framework, COSO, focuses on minimizing risk.

Question 8

What kind of facility is used to protect the physical components on which systems and data are stored?

Accepted Answer

A)  System center 
B)  Network operations center 
C)  Access center 
D)  All of these answer choices are correct. 
A)  System center 
B)  Network operations center 
C)  Access center 
D)  All of these answer choices are correct.

Question 9

Which statements concerning Business Continuity Planning (BCP) are TRUE? Select all statements that are TRUE.

Accepted Answer

A)  BCP includes the procedures taken to protect employees, stakeholders, and assets in the event of a disruptive event. 
B)  BCP procedures focus on hot backup sites as all systems are critical and must be recovered quickly. 
C)  After the BCP manager develops the BCP, plans need to be memorized and not changed over time so that all employees know what to expect and do when a disruptive event occurs. 
D)  BCP plans could be triggered by a variety of disruptive events, such as natural disasters, cyberattacks, social unrest, or a global pandemic. 
A)  BCP includes the procedures taken to protect employees, stakeholders, and assets in the event of a disruptive event. 
B)  BCP procedures focus on hot backup sites as all systems are critical and must be recovered quickly. 
C)  After the BCP manager develops the BCP, plans need to be memorized and not changed over time so that all employees know what to expect and do when a disruptive event occurs. 
D)  BCP plans could be triggered by a variety of disruptive events, such as natural disasters, cyberattacks, social unrest, or a global pandemic.

Question 10

Adrian evaluated Branch Technologies user access assignment procedures and found them to be inefficient. Rather than assign each user permissions individually, Adrian recommends that Branch Technologies define roles with pre-defined access criteria and assign users to roles. What type of authorization is Adrian recommending?

Accepted Answer

A)  Role-based access controls 
B)  Individual permissions 
C)  Physical access controls 
D)  User access de-provisioning 
A)  Role-based access controls 
B)  Individual permissions 
C)  Physical access controls 
D)  User access de-provisioning

Question 11

An internal auditor inspecting a data center will look at all the following components.

Accepted Answer

A)  Security system 
B)  Fire protection 
C)  Physical access 
D)  All answer choices are correct. 
A)  Security system 
B)  Fire protection 
C)  Physical access 
D)  All answer choices are correct.

Question 12

Which role in the change management process tests the functionality of the code submitted to the model environment and documents the results of the test?

Accepted Answer

A)  Developer 
B)  User 
C)  IT Analyst 
D)  Production Control 
A)  Developer 
B)  User 
C)  IT Analyst 
D)  Production Control

Question 13

When disaster strikes, what two metrics concerning system and data restoration are important to consider?

Accepted Answer

A)  Recovery Technology Objective (RTO) and Recovery Process Objective (RPO) 
B)  Recovery Technology Objective (RTO) and Recovery Point Objective (RPO) 
C)  Recovery Time Objective (RTO) and Recovery Point Objective (RPO) 
D)  Recovery Time Objective (RTO) and Recovery Process Objective (RPO) 
A)  Recovery Technology Objective (RTO) and Recovery Process Objective (RPO) 
B)  Recovery Technology Objective (RTO) and Recovery Point Objective (RPO) 
C)  Recovery Time Objective (RTO) and Recovery Point Objective (RPO) 
D)  Recovery Time Objective (RTO) and Recovery Process Objective (RPO)

Question 14

The CEO of All-Farm Insurance asked you to verify that organization data is fully backed up each weekend and that all new data is backed up daily. On the daily backups, the CEO requests that all new data since the full backup is stored. What type of backup strategy should you choose?

Accepted Answer

A)  Hot backup 
B)  Full backup 
C)  Differential backup 
D)  Incremental backup 
A)  Hot backup 
B)  Full backup 
C)  Differential backup 
D)  Incremental backup

Question 15

Which of the stages of the formal change management process includes a recent copy of the production environment where tests are performed?

Accepted Answer

A)  Test environment 
B)  Model environment 
C)  Production environment 
D)  Development environment 
A)  Test environment 
B)  Model environment 
C)  Production environment 
D)  Development environment

Question 16

Which of the following are physical security measures used to prevent unauthorized access to a data center?

Accepted Answer

A)  Single entrance 
B)  Security camera at entrance 
C)  Multifactor authentication 
D)  All answer choices are correct. 
A)  Single entrance 
B)  Security camera at entrance 
C)  Multifactor authentication 
D)  All answer choices are correct.

Question 17

Angela is tasked with reviewing the IT service request process for her accounting firm. Which COBIT domain should she reference?

Accepted Answer

A)  Align, Plan and Organize (APO) 
B)  Build, Acquire and Implement (BAI) 
C)  Deliver, Service and Support (DSS) 
D)  Monitor, Evaluate, and Assess (ME
A)  
A)  Align, Plan and Organize (APO) 
B)  Build, Acquire and Implement (BAI) 
C)  Deliver, Service and Support (DSS) 
D)  Monitor, Evaluate, and Assess (ME
A)

Question 18

Which of the following is a poor policy for physical access control for a data center?

Accepted Answer

A)  Only employees directly involved with operating the data center are authorized to enter. 
B)  Employees must scan their badge then enter a PIN on a keypad to gain access to the data center. 
C)  Security personnel regularly walk the building perimeter and look through the outside windows to check for unauthorized access to the data center. 
D)  Security cameras at the data center entrance door record all entrances and exits from the data center. 
A)  Only employees directly involved with operating the data center are authorized to enter. 
B)  Employees must scan their badge then enter a PIN on a keypad to gain access to the data center. 
C)  Security personnel regularly walk the building perimeter and look through the outside windows to check for unauthorized access to the data center. 
D)  Security cameras at the data center entrance door record all entrances and exits from the data center.

Question 19

Which control activity related to physical security is managed by the facilities manager?

Accepted Answer

A)  Eating and drinking is prohibited where IT equipment is stored. 
B)  Policies and procedures for maintaining physical equipment are documented. 
C)  Access to buildings is justified, authorized, logged, and monitored. 
D)  Inappropriate access to IT equipment is immediately revoked. 
A)  Eating and drinking is prohibited where IT equipment is stored. 
B)  Policies and procedures for maintaining physical equipment are documented. 
C)  Access to buildings is justified, authorized, logged, and monitored. 
D)  Inappropriate access to IT equipment is immediately revoked.

Question 20

Explain the concept of IT governance.

Accepted Answer

IT Governance is the process t

Which of the following backup sites is the least expensive but has the slowest recovery speed?

Which of the following roles have control ownership related to protecting the physical computer systems?

Which development environment is often referred to as the sandbox because developers can test without having impact on the live systems?

In which change management environment does a developer write code to make the change in the system?

Which statement concerning the disaster response Recovery Time Objective (RTO) is TRUE?

Which of the following statements concerning IT governance are TRUE?

What kind of facility is used to protect the physical components on which systems and data are stored?

Which statements concerning Business Continuity Planning (BCP) are TRUE? Select all statements that are TRUE.

An internal auditor inspecting a data center will look at all the following components.

Which role in the change management process tests the functionality of the code submitted to the model environment and documents the results of the test?

When disaster strikes, what two metrics concerning system and data restoration are important to consider?

The CEO of All-Farm Insurance asked you to verify that organization data is fully backed up each weekend and that all new data is backed up daily. On the daily backups, the CEO requests that all new data since the full backup is stored. What type of backup strategy should you choose?

Which of the stages of the formal change management process includes a recent copy of the production environment where tests are performed?

Which of the following are physical security measures used to prevent unauthorized access to a data center?

Angela is tasked with reviewing the IT service request process for her accounting firm. Which COBIT domain should she reference?

Which of the following is a poor policy for physical access control for a data center?

Which control activity related to physical security is managed by the facilities manager?

Explain the concept of IT governance.

Accounting As Information

Risks and Risk Assessments

Risk Management and Internal Controls

Software and Systems

Data Storage and Analysis

Systems and Database Design

Emerging and Disruptive Technologies

Documenting Systems and Processes

Human Resources and Payroll Processes

Purchasing and Payments Process

Conversion Processes

Marketing, Sales, and Collection Processes

Financial Reporting Processes

Fraud

Cybersecurity

Data Analytics

Data Visualization

Audit Assurance

Filters

Exam 14: Information Systems and Controls

Which of the following backup sites is the least expensive but has the slowest recovery speed?

Which of the following roles have control ownership related to protecting the physical computer systems?

Which development environment is often referred to as the sandbox because developers can test without having impact on the live systems?

In which change management environment does a developer write code to make the change in the system?

Which statement concerning the disaster response Recovery Time Objective (RTO) is TRUE?

Which of the following statements concerning IT governance are TRUE?

What kind of facility is used to protect the physical components on which systems and data are stored?

Which statements concerning Business Continuity Planning (BCP) are TRUE? Select all statements that are TRUE.

An internal auditor inspecting a data center will look at all the following components.

Which role in the change management process tests the functionality of the code submitted to the model environment and documents the results of the test?

When disaster strikes, what two metrics concerning system and data restoration are important to consider?

The CEO of All-Farm Insurance asked you to verify that organization data is fully backed up each weekend and that all new data is backed up daily. On the daily backups, the CEO requests that all new data since the full backup is stored. What type of backup strategy should you choose?

Which of the stages of the formal change management process includes a recent copy of the production environment where tests are performed?

Which of the following are physical security measures used to prevent unauthorized access to a data center?

Angela is tasked with reviewing the IT service request process for her accounting firm. Which COBIT domain should she reference?

Which of the following is a poor policy for physical access control for a data center?

Which control activity related to physical security is managed by the facilities manager?

Explain the concept of IT governance.

Accounting As Information

Risks and Risk Assessments

Risk Management and Internal Controls

Software and Systems

Data Storage and Analysis

Systems and Database Design

Emerging and Disruptive Technologies

Documenting Systems and Processes

Human Resources and Payroll Processes

Purchasing and Payments Process

Conversion Processes

Marketing, Sales, and Collection Processes

Financial Reporting Processes

Fraud

Cybersecurity

Data Analytics

Data Visualization

Audit Assurance

Filters