Deck 8: Auditing Computer-Based Information Systems

Question 1

Parity checks are an example of

A)Data entry controls
B)Data transmission controls
C)Output controls
D)Processing controls

Answer 1

B

Question 2

The goal of information systems controls is

A)To ensure that systems objectives are met.
B)To ensure that systems function
C)To ensure that systems are reliable.
D)To ensure that data are confidential.

Answer 2

C

Question 3

Check digit verification is an example of

A)Data transmission controls
B)Output controls
C)Processing controls
D)Source data controls

Answer 3

D

Question 4

User reviews are an example of

A)Data entry controls
B)Data transmission controls
C)Output controls
D)Processing controls

Question 5

Input validation checks are an example of

A)Data entry controls
B)Data transmission controls
C)Output controls
D)Source data controls

Question 6

Sequentially pre-numbered forms is an example of .

A)Data entry controls
B)Data transmission controls
C)Processing controls
D)Source data controls

Question 7

Which of the following is not one of the 10 internationally recognized best practices for protecting the privacy of customers' personal information?

A)Access.
B)Monitoring and enforcement.
C)Registration.
D)Security.

Question 8

Turnaround documents are an example of

A)Data entry controls
B)Output controls
C)Processing controls
D)Source data controls

Question 9

Forms design is an example of this type of control.

A)Data entry controls
B)Data transmission controls
C)Output controls
D)Source data controls

Question 10

Batch totals are an example of

A)Data entry controls
B)Data transmission controls
C)Output controls
D)Processing controls

Question 11

A text file created by a website and stored on a visitor's hard disk.

A)Validity check
B)Spam
C)Error log
D)Cookie

Question 12

This determines if the characters in a field are of the proper type.

A)Field check
B)Limit check
C)Range check
D)Reasonableness test

Question 13

Data conversion checks are an example of

A)Data entry controls
B)Output controls
C)Processing controls
D)Source data controls

Question 14

File labels are an example of

A)Data entry controls
B)Output controls
C)Processing controls
D)Source data controls

Question 15

Visual scanning is an example of

A)Data entry controls
B)Output controls
C)Processing controls
D)Source data controls

Question 16

Which of the following is not one of the 10 internationally recognized best practices for protecting the privacy of customers' personal information?

A)Choice and consent.
B)Disclosure to third parties.
C)Reimbursement.
D)Use and retention.

Question 17

Concerning virtual private networks (VPN),which of the following is not true?

A)VPNs provide the functionality of a privately owned network using the Internet.
B)Using VPN software to encrypt information while it is in transit over the Internet in effect creates private communication channels,often referred to as tunnels,which are accessible only to those parties possessing the appropriate encryption and decryption keys.
C)The cost of the VPN software is much less than the cost of leasing or buying the infrastructure (telephone lines,satellite links,communications equipment,etc.)needed to create a privately owned secure communications network.
D)It is more expensive to reconfigure VPNs to include new sites than it is to add or remove the corresponding physical connections in a privately owned network.

Question 18

Error logs and review are an example of

A)Data entry controls
B)Data transmission controls
C)Output controls
D)Processing controls

Question 19

Message acknowledgement techniques are an example of

A)Data entry controls
B)Data transmission controls
C)Output controls
D)Processing controls

Question 20

Data matching is an example of

A)Data entry controls
B)Data transmission controls
C)Processing controls
D)Source data controls

Question 21

This compares the results produced by more than one method to verify accuracy.

A)Concurrent update control
B)Cross-footing balance test
C)Data matching
D)Recalculation of batch totals

Question 22

Every organization should have a disaster recovery plan so that data processing capacity can be restored as smoothly and quickly as possible.Which item below would not typically be part of an adequate disaster recovery plan?

A)a system upgrade due to operating system software changes
B)uninterruptible power systems installed for key system components
C)scheduled electronic vaulting of files
D)backup computer and telecommunication facilities

Question 23

This batch processing data entry control sums a non-financial numeric field.

A)Batch total
B)Financial total
C)Hash total
D)Sequence check

Question 24

This tests a numerical amount to ensure that it does not exceed a predetermined value.

A)Completeness check
B)Limit check
C)Range check
D)Sign check

Question 25

This batch processing data entry control sums the number of items in a batch.

A)Batch total
B)Hash total
C)Record count
D)Sequence check

Question 26

The system and the receiving unit calculate a summary statistic and compare it.

A)Echo check
B)Numbered batches
C)Parity check
D)Trailer record

Question 27

This ensures that the input data will fit into the assigned field.

A)Limit check
B)Range check
C)Size check
D)Validity check

Question 28

This compares the ID number in transaction data with similar data in the master file to verify that the account exists.

A)Reasonableness test
B)Sign check
C)Size check
D)Validity check

Question 29

This enables a system to continue functioning in the event that a particular component fails,

A)Backup procedures
B)Fault tolerance
C)Preventive maintenance
D)None of the above

Question 30

Concerning availability,which of the following statements is true?

A)Human error does not threaten system availability.
B)Proper controls can maximize the risk of threats causing significant system downtime.
C)Threats to system availability can be completely eliminated.
D)Threats to system availability include hardware and software failures as well as natural and man-made disasters.

Question 31

This entails verifying that the proper number of bits are set to the value 1 in each character received.

A)Echo check
B)Numbered batches
C)Parity check
D)Trailer record

Question 32

This batch processing data entry control sums a field that contains dollar values.

A)Batch total
B)Financial total
C)Hash total
D)Sequence check

Question 33

This tests a numerical amount to ensure that it does not exceed a predetermined value nor fall below another predetermined value.

A)Completeness check
B)Field check
C)Limit check
D)Range check

Question 34

This determines if all required data items have been entered.

A)Completeness check
B)Field check
C)Limit check
D)Range check

Question 35

This ensures that the correct and most current files are being updated.

A)Cross-footing balance test
B)Data matching
C)File labels
D)Write-protect mechanism

Question 36

This protects records from errors that occur when two or more users attempt to update the same record simultaneously.

A)Concurrent update controls
B)Cross-footing balance test
C)Data conversion controls
D)Recalculation of batch totals

Question 37

This determines the correctness of the logical relationship between two data items.

A)Range check
B)Reasonableness test
C)Sign check
D)Size check

Question 38

This batch processing data entry control tests if a batch of input data is in the proper numerical or alphabetical sequence.

A)Batch total
B)Financial total
C)Hash total
D)Sequence check

Question 39

These find processing errors.

A)Cross-footing balance test
B)File labels
C)Recalculation of batch totals
D)Write-protect mechanisms

Question 40

________ involves copying only the data items that have changed since the last backup.

A)Archive
B)Backup
C)Differential backup
D)Incremental backup

Question 41

A facility that contains all the computing equipment the organization needs to perform its essential business activities.

A)a cold site
B)a hot site
C)a remote sister site
D)a subsidiary location

Question 42

Which of the following is not a useful control procedure to control access to system outputs?

A)Allowing visitors to move through the building without supervision.
B)Coding reports to reflect their importance.
C)Requiring employees to log out of applications when leaving their desk.
D)Restricting access to rooms with printers.

Question 43

The maximum amount of time between backups is determined by a firm's

A)recovery time objective.
B)recovery point objective.
C)recovery objective.
D)maximum time recovery objective.

Question 44

The accounting department at Synergy Hydroelectric records an average of 10,000 transactions per hour.By cost-benefit analysis,managers have concluded that the maximum acceptable loss of data in the event of a system failure is 40,000 transactions.The firm's recovery point objective is therefore

A)40,000 transactions
B)10,000 transactions
C)10 hours
D)4 hours

Question 45

A location that is pre-wired for necessary telecommunications and computer equipment.

A)a cold site
B)a hot site
C)a remote sister site
D)a subsidiary location

Question 46

The accounting department at Synergy Hydroelectric records an average of 12,500 transactions per hour.By cost-benefit analysis,managers have concluded that the maximum acceptable loss of data in the event of a system failure is 25,000 transactions.If the firm's recovery time objective is 120 minutes,then the worst case recovery time objective is

A)1 hour
B)2 hours
C)3 hours
D)4 hours

Question 47

The maximum acceptable down time after a computer system failure is determined by a firm's

A)recovery time objective.
B)recovery point objective.
C)recovery objective.
D)maximum time recovery objective.

Question 48

While this type of backup takes longer,it's restoration is simpler.

A)Archive
B)Backup
C)Differential backup
D)Incremental backup

Question 49

Chaz Finnerty called the IT Help Desk in a huff."I'm trying to open an Excel file and I get a message that says that the file is locked for editing.What's going on?" The answer is that

A)the file is corrupted due to a computer virus.
B)there is no problem.Chaz is editing the file,so it is locked..
C)concurrent update controls have locked the file.
D)Chaz didn't open the file with the appropriate program.

Question 50

Which of the following is not the objective of a disaster recovery plan?

A)Minimize the extent of the disruption,damage or loss.
B)Permanently establish an alternative means of processing information.
C)Resume normal operations as soon as possible.
D)Train employees for emergency operations.

Question 51

The most important change management technique is probably

A)User rights and privileges are carefully monitored during change process.
B)Changes tested thoroughly prior to implementation.
C)All documentation is updated to reflect changes to the system.
D)Adequate monitoring and review by top management.

Question 52

The accounting department at Synergy Hydroelectric records an average of 10,000 transactions per hour.By cost-benefit analysis,managers have concluded that the maximum acceptable loss of data in the event of a system failure is 20,000 transactions.If the firm's recovery time objective is 60 minutes,then the worst case recovery time objective is

A)1 hour
B)2 hours
C)3 hours
D)4 hours

Question 53

________ copies all changes made since the last full backup.

A)Archive
B)Backup
C)Differential backup
D)Incremental backup

Question 54

The Spontaneous Combustion Rocket Shoppe in downtown Fargo,North Dakota,generates three quarters of its revenue from orders taken over the Internet.The revenue clearing account is debited by the total of cash and credit receipts and credited by the total of storefront and Internet sales.This is an example of a

A)data integrity test.
B)zero-balance test.
C)trial balance audit.
D)cross-footing balance test.

Question 55

The accounting department at Synergy Hydroelectric records an average of 12,500 transactions per hour.By cost-benefit analysis,managers have concluded that the maximum acceptable loss of data in the event of a system failure is 25,000 transactions.The firm's recovery point objective is therefore

A)25,000 transactions
B)12,500 transactions
C)1 hour
D)2 hours

Question 56

When I enter a correct customer number,the data entry screen displays the customer name and address.This is an example of

A)prompting.
B)preformatting.
C)closed-loop verification
D)error checking.

Question 57

What is the most effective way to ensure information system availability?

A)High bandwidth
B)Maintain a hot site
C)Maintain a cold site
D)Frequent backups

Question 58

A copy of a database,master file,or software that will be retained indefinitely as a historical record.

A)Archive
B)Backup
C)Differential backup
D)Incremental backup

Question 59

When a computer system's files are automatically duplicated on a second data storage system as they are changed,the process is referred to as

A)real-time mirroring.
B)batch updating.
C)consistency control.
D)double-secure storage.

Question 60

A comparison of debits and credits in related control accounts is referred to as a

A)cross-footing balance test.
B)parity test.
C)zero-balance test.
D)size check.

Question 61

Define and contrast a recovery point objective and a recovery time objective.

Question 62

What is fault tolerance?

Question 63

Which of the following will not make a password more secure?

A)Including multiple character types
B)Choosing a word or phrase that is easy to remember.
C)Making a password longer.
D)Change a password frequently.

Question 64

Devices that filter TCP/IP packets in order to protect against malicious code are called

A)routers.
B)firewalls.
C)COBIT frameworks.
D)black ICE.

Question 65

Modest Expectations Investment Services (MEIS)allows customers to manage their investments over the Internet.If customers attempt to sell more shares of a stock than they have in their account,an error message is displayed.This is an example of a

A)reasonableness test.
B)field check.
C)validity check.
D)limit check.

Question 66

Identify four data entry controls.

Question 67

Identify four source data controls.

Question 68

Mike Colby took a call from a client."Listen,Mike,I need to interact online in real time with our manufacturing operation in China,and I want to make sure that no one intercepts the communications.How can I do that?" Mike thought a moment,then responded with the best solution."We'll set up a(an)________."

A)ballistic sequencing network
B)electronic courier system
C)virtual private network
D)can-string-can (CSC)system

Question 69

Identify four useful procedures for controlling access to system outputs.

Question 70

Modest Expectations Investment Services (MEIS)allows customers to manage their investments over the Internet.If customers attempt to spend more money than they have in their account,an error message is displayed.This is an example of a

A)reasonableness test.
B)field check.
C)validity check.
D)limit check.

Question 71

Identify the 10 internationally recognized best practices for protecting the privacy of customers' personal information.

Question 72

Describe some steps you can take to minimize your risk of identify theft.

Question 73

Cancellation and storage of documents means that

A)data are copied from a document and stored,after which the document is shredded.
B)documents are defaced before being shredded.
C)documents are defaced and stored.
D)cancellation data are copied from documents before they are stored.

Question 74

Identify a fundamental control procedure for protecting that confidentiality of sensitive information.

Question 75

The devices that direct TCP/IP packets to their destinations are called

A)servers.
B)access points.
C)routers.
D)coaxial stackers.

Question 76

Identify four processing controls.

Question 77

Mike Colby took a call from a client."Listen,Mike,I need for my customers to make payments online using credit cards.Here's the thing,though.I want to make sure that no one intercepts the communications.How can I do that?" Mike thought a moment,then responded with the best solution."We'll set up a(an)________."

A)ballistic sequencing network
B)electronic courier system
C)secure sockets layer (SSL)system
D)can-string-can (CSC)system