Question 1

Which of the following is an example of a physical control?

Accepted Answer

A)  Providing fire detection and suppression equipment. 
B)  Establishing a physical security policy and promoting it throughout the organization. 
C)  Performing business continuity and disaster recovery planning. 
D)  Keeping an offsite backup of the organization's critical data.

Question 2

Which of the following are included in ISO 31000 risk principles and guidelines?

Accepted Answer

A)  Standards, framework, and process. 
B)  Standards, assessments, and process. 
C)  Principles, framework, and process. 
D)  Principles, practices, and process.

Question 3

During which phase of disaster recovery planning should an organization identify the business units, assets, and systems that are critical to continuing an acceptable level of operations?

Accepted Answer

A)  Scope and initiation phase. 
B)  Business impact analysis. 
C)  Plan development. 
D)  Testing.

Question 4

Which of the following statements is most accurate concerning the management and audit of a web server?

Accepted Answer

A)  The file transfer protocol (FTP) should always be enabled. 
B)  The simple mail transfer protocol (SMTP) should be operating under the most privileged accounts. 
C)  The number of ports and protocols allowed to access the web server should be maximized. 
D)  Secure protocols for confidential pages should be used instead of clear-text protocols such as HTTP or FTP.

Question 5

For an engineering department with a total quality management program, important elements of quality management include all of the following except:

Accepted Answer

A)  Basing performance evaluations on the number of projects completed. 
B)  Comparing results with those of other engineering departments. 
C)  Creating a quality council within the engineering department. 
D)  Conducting post-project surveys on performance.

Question 6

According to the COSO enterprise risk management (ERM) framework, which of the following is not a typical responsibility of the chief risk officer?

Accepted Answer

A)  Establishing risk category definitions and a common risk language for likelihood and impact measures. 
B)  Defining ERM roles and responsibilities. 
C)  Providing the board with an independent, objective risk perspective on financial reporting. 
D)  Guiding integration of ERM with other management activities.

Question 7

According to IIA guidance, which of the following is a typical risk associated with the tender process and contracting stage of an organization's IT outsourcing life cycle?

Accepted Answer

A)  The process is not sustained and is not optimized as planned. 
B)  There is a lack of alignment to organizational strategies. 
C)  The operational quality is less than projected. 
D)  There is increased potential for loss of assets.

Question 8

A capital investment project will have a higher net present value, everything else being equal, if it has:

Accepted Answer

A)  A higher initial investment level. 
B)  A higher discount rate. 
C)  Cash inflows that are larger in the later years of the life of the project. 
D)  Cash inflows that are larger in the earlier years of the life of the project.

Question 9

Which of the following IT strategies is most effective for responding to competitive pressures created by the marketplace?

Accepted Answer

A)  Promote closer linkage between organizational strategy and information. 
B)  Provide users with greater online access to information systems. 
C)  Enhance the functionality of application systems. 
D)  Expand the use of automated controls.

Question 10

According to Porter's model of competitive strategy, which of the following is a generic strategy? 1. Differentiation. 2. Competitive advantage. 3. Focused differentiation. 4. Cost focus.

Accepted Answer

A)  2 only 
B)  3 and 4 only 
C)  1, 3, and 4 only 
D)  1, 2, 3, and 4

Question 11

A global business organization is selecting managers to post to various international (expatriate) assignments. In the screening process, which of the following traits would be required to make a manager a successful expatriate? 1. Superior technical competence. 2. Willingness to attempt to communicate in a foreign language. 3. Ability to empathize with other people.

Accepted Answer

A)  1 and 2 only 
B)  1 and 3 only 
C)  2 and 3 only 
D)  1, 2, and 3

Question 12

Which of the following describes a typical desktop workstation used by most employees in their daily work?

Accepted Answer

A)  Workstation contains software that prevents unauthorized transmission of information into and out of the organization's network. 
B)  Workstation contains software that controls information flow between the organization's network and the Internet. 
C)  Workstation contains software that enables the processing of transactions and is not shared among users of the organization's network. 
D)  Workstation contains software that manages user's access and processing of stored data on the organization's network.

Question 13

Which of the following phases of a business cycle are marked by an underuse of resources? 1. The trough. 2. The peak. 3. The recovery. 4. The recession.

Accepted Answer

A)  1 and 3 only 
B)  1 and 4 only 
C)  2 and 3 only 
D)  2 and 4 only

Question 14

Which of the following techniques would be least effective in resolving the conflict created by an internal audit client's perception of the audit report as a personal attack on his management performance?

Accepted Answer

A)  The auditor should focus on the audit client as a person and understand him, rather than just concentrating on the problem. 
B)  The auditor should make recommendations based on objective criteria, rather than based on a subjective assessment. 
C)  The auditor should explore alternative solutions to address the audit problem, so the audit client has options. 
D)  The auditor should take a flexible position on the recommendations and focus on resolving the issue by addressing the interests of the people concerned.

Question 15

Which of the following is a disadvantage of selecting a commercial software package rather than developing an application internally?

Accepted Answer

A)  Lack of flexibility. 
B)  Incompatibility with client/server technology. 
C)  Employee resistance to change. 
D)  Inadequate technical support.

Question 16

An organization had three large centralized divisions: one that received customer orders for service work; one that scheduled the service work at customer locations; and one that answered customer calls about service problems. These three divisions were restructured into seven regional groups, each of which performed all three functions. One advantage of this restructuring would be:

Accepted Answer

A)  Better internal controls. 
B)  Greater economies of scale. 
C)  Improved work flow. 
D)  Increased specialization.

Question 17

A small furniture-manufacturing firm with 100 employees is located in a two-story building and does not plan to expand. The furniture manufactured is not special-ordered or custom-made. The most likely structure for this organization would be:

Accepted Answer

A)  Functional departmentalization. 
B)  Product departmentalization. 
C)  Matrix organization. 
D)  Divisional organization.

Question 18

Which of the following is not a potential area of concern when an internal auditor places reliance on spreadsheets developed by users?

Accepted Answer

A)  Increasing complexity over time. 
B)  Interface with corporate systems. 
C)  Ability to meet user needs. 
D)  Hidden data columns or worksheets.

Question 19

The activity that involves a trial run of a product in a typical segment of the market before proceeding to a national launch is referred to as:

Accepted Answer

A)  Test marketing 
B)  Experimentation 
C)  Segmentation 
D)  Positioning

Question 20

Which of the following statements are true regarding the use of heat maps as risk assessment tools? 1. They focus primarily on known risks, limiting the ability to identify new risks. 2. They rely heavily on objective assessments and related risk tolerances. 3. They are too complex to provide an easily understandable view of key risks. 4. They are helpful but limited in value in a rapidly changing environment.

Accepted Answer

A)  1 and 2 only 
B)  1 and 4 only 
C)  2 and 3 only 
D)  3 and 4 only

Exam 5: Business Analysis and Information Technology