Question 1

Enterprise controls:
A)Are controls in Enterprise Resource Planning Systems
B)Are controls required by the AICPA
C)Affect only application controls
D)Affect many general and application controls

Accepted Answer

Enterprise controls refer to controls that affect many general and application controls. They are not specific to Enterprise Resource Planning Systems or required by the AICPA. Examples of enterprise controls include security management, change management, and disaster recovery planning.

Question 2

A business continuity plan (BCP)includes which of the following?
A)Backups for hardware
B)Procedures to follow in the event of an emergency
C)Who is in charge during the emergency
D)none of the above
E)all of the above

Accepted Answer

A business continuity plan (BCP) includes all of the options listed: backups for hardware, procedures to follow in the event of an emergency, and who is in charge during the emergency. A BCP should cover all aspects of business operations, including IT, personnel, communication, and facilities, to ensure that the organization can continue to operate in the event of a disruption or disaster. Therefore, all of the options are necessary components of a comprehensive BCP.

Question 3

Within database systems,a control that restricts user access to precisely designated data sets and files is called a(an):
A)Layered password
B)Open password
C)Closed password
D)Server password

Accepted Answer

The answer of Within database systems,a control that restricts user...

Question 4

If _____ controls are ineffective,this can cause ____ controls to be unreliable.
A)IT general,application
B)Application,IT general
C)Application,enterprise
D)Cross-footing,segregation of duties

Accepted Answer

IT general controls are foundational controls that support the functioning of application controls. If IT general controls are ineffective, it can undermine the reliability of application controls, as these rely on the general IT environment's integrity and security.

Question 5

An effective control for maintaining the privacy of data stored on a large,networked server would be:
A)Security personnel at the building entrance
B)Encryption
C)Laptop protection policies
D)Routing verification

Accepted Answer

Encryption is an effective control for maintaining the privacy of data stored on a large, networked server because it involves converting the data into a code that only authorized users can access. This helps to prevent unauthorized access and data breaches. Security personnel at the building entrance, laptop protection policies, and routing verification are also important controls, but they may not provide the same level of protection as encryption.

Question 6

The textbook identifies a number of issues that should be considered when developing a security policy.One of the issues is "identify threats".Which of the following is not an example of this issue?
A)What assets need to be protected
B)What are the sources of potential security problems
C)External threats are viruses,worms,retaliations from former employees
D)Internal threats are misuse of assets by employees and embezzlement

Accepted Answer

Option A is not an example of "identify threats" because it is focusing on identifying the assets that need to be protected rather than identifying potential threats to those assets. The other options are all examples of identifying threats, including potential sources of security problems and specific types of external and internal threats.

Question 7

A "flying-start site" for disaster recovery purposes is a location that includes:
A)A computer system configured similarly to the system normally used
B)A computer system configured similarly to the system normally used plus up-to-date backup data and software
C)Power and environmentally controlled space to install equipment on short notice
D)none of the above

Accepted Answer

A "flying-start site" for disaster recovery purposes should include a computer system configured similarly to the system normally used, but also with up-to-date backup data and software to ensure continuity of operations in case of a disaster. Additionally, having power and environmentally controlled space is important, but not sufficient on its own to achieve a flying-start site.

Question 8

A company's disaster recovery site that includes a computer system configured similarly to the system used regularly by the company for data processing purposes is called:
A)A cold site
B)A recovery site
C)A disaster site
D)A hot site

Accepted Answer

A hot site is a disaster recovery site that includes a computer system configured similarly to the system used regularly by the company for data processing purposes. It is fully operational and ready to use in case of a disaster, providing immediate failover capabilities.

Question 9

A virtual private network (VPN):
A)Is a security appliance that runs behind an organization's firewall
B)Allows remote users to access entity resources by using wireless,hand-held devices
C)Is security software that is specifically designed to protect hard-wired local area networks (LANs)
D)both (a)and (b)
E)none of the above

Accepted Answer

Option A is partially correct as a VPN can be implemented as a security appliance, but it doesn't necessarily have to be behind an organization's firewall. Option B is also partially correct as a VPN can allow remote users to access entity resources, but it is not limited to wireless, hand-held devices. Option C is incorrect as a VPN is not software designed to protect hard-wired LANs exclusively. Therefore, option D is the best choice as it correctly combines the partial truths in options A and B.

Question 10

Which of the following best describes ISO 17799?
A)The international information systems standards that establish information systems best practices
B)The international information security standards that establish information security best practices
C)The international information systems control standards that establish information systems control best practices
D)none of the above

Accepted Answer

ISO 17799 is the international standard for information security that establishes best practices for information security management. It provides a framework for implementing and maintaining a comprehensive information security management system.

Question 11

When we say that an organization has an "integrated security policy",what do we mean?
A)The organization is working with suppliers and customers to improve security up and down the supply chain
B)Managers in various departments within the firm meet to assess risk and develop security options for top management
C)The organization is using a variety of security measures,such as firewalls,virus protection,intrusion detection systems,virtual private networks,etc.
D)none of the above

Accepted Answer

An integrated security policy means that the organization is implementing multiple security measures to protect its assets and information. This can include measures such as firewalls, virus protection, intrusion detection systems, virtual private networks, etc. It does not necessarily involve collaboration with suppliers or internal risk assessment meetings, as suggested by choices A and B.

Question 12

An example of a check-digit technique that includes "ordering of digits" in the construction of check-digit values is the:
A)Odd-even technique
B)Modulus 11 technique
C)Value-digit technique
D)Orion technique

Accepted Answer

Modulus 11 technique uses the ordering of digits in the calculation of the check-digit value. Other techniques such as odd-even technique and value-digit technique do not consider the ordering of digits. There is no known check-digit technique called "Orion technique".

Question 13

The risk of unauthorized access to data through electronic eavesdropping is minimized by using:
A)Data encryption
B)Routing verification procedures
C)Message acknowledgement procedures
D)EDC

Accepted Answer

Data encryption involves converting the data into a code that can only be deciphered with a specific key or password. This makes it difficult for unauthorized individuals to intercept and understand the data even if they are able to access it. Routing verification procedures and message acknowledgement procedures do not specifically address the risk of electronic eavesdropping. EDC (Error Detection and Correction) is a data transmission method that helps detect and correct errors in the data, but it does not provide any protection against unauthorized access.

Quiz 10: Computer Controls for Organizations and Accounting Information Systems

Enterprise controls:

A business continuity plan (BCP) includes which of the following?

Within database systems,a control that restricts user access to precisely designated data sets and files is called a(an) :

If _ controls are ineffective,this can cause controls to be unreliable.

An effective control for maintaining the privacy of data stored on a large,networked server would be:

The textbook identifies a number of issues that should be considered when developing a security policy.One of the issues is "identify threats".Which of the following is not an example of this issue?

A "flying-start site" for disaster recovery purposes is a location that includes:

A company's disaster recovery site that includes a computer system configured similarly to the system used regularly by the company for data processing purposes is called:

A virtual private network (VPN) :

Which of the following best describes ISO 17799?

When we say that an organization has an "integrated security policy",what do we mean?

An example of a check-digit technique that includes "ordering of digits" in the construction of check-digit values is the:

The risk of unauthorized access to data through electronic eavesdropping is minimized by using: