Information Systems Quiz 3

Quiz 3 Which of the following is NOT the contents of operational objectives studied by IS auditor? Capacity planning Disaster recovery Integrity requirements Policies and procedures Which of the following is NOT True? Laws is mandatory while ethics depends on situation Laws infringement would be punished while ethics infringement would not Laws is absolute while ethics is relative Laws is negotiable while ethics is mandatory Which of the following is NOT an audit stage done by an auditor? Audit risk assessment Granting audit charter Audit preplanning Audit reporting Which of the following is NOT true for auditor's roles? Acting for the benefit of another company To be fair and honest ahead of his/her own interest Should have the background tested Maintain the concept of independencies Which of the following is NOT true for audit committee? It is delegated the authority to review and challenge the assurances of internal controls made by executive management It is the most powerful execution unit inside the company Its purpose is to provide advice to the executive accounting officer concerning internal control strategies, priorities and assurances It is responsible for issuing the audit charter to grant the authority for internal audits or the engagement letter for the external audit Which of the following is NOT one of the ten commandments of computer ethics? Thou shalt not use a computer to harm other people Thou shalt always use a computer in ways that ensure consideration and penalty for your fellow humans Thou shalt think about the social consequences of program you are writing or the system you are designing Thous shalt not appropriate other people's intellectual work Which of the following is NOT a process to be done during IS Auditing? Evidence evaluation Evidence proof check Evidence announcement Evidence collection Which of the following is NOT the contents of strategic objectives studied by IS auditor? Defined IS goals IS organization and plans Operational plans Tactical plan Which of the following is NOT one of the ten commandments of computer ethics? Thou shalt not use other people's computer resources with authorization and proper compensation Thou shalt not interfere with other people's computer work Thou shalt not use a computer to steal Thou shalt not use a computer to bear false witness Which of the following is NOT correct? Laws are the rules that mandate or prohibit certain societal behavior Laws carry sanctions of a governing authority but ethics do not Ethics is based on fixed moral attitudes or legal requirements of all people Ethics is derived from define socially acceptable behavior Which of the following is NOT the needs of control & audit? Costs of Computer Abuse Value of Computer Hardware, Software & freedom of speech Organizational Costs of Data Loss High Costs of Computer Error During the understanding stage of business requirements by the IS auditor, which of the following is NOT the area to be studied? Operational objectives Financial objectives Auditee competitors' analysis Strategic objectives The development of an IS security policy is ultimately the responsibility of the: board of directors. IS department. security committee. security administrator. In reviewing the IS short-range (tactical) plan, the IS auditor should determine whether: the plan correlates business objectives to IS goals and objectives. there is a strategic information technology planning methodology in place. there is a clear definition of the IS mission and vision. there is an integration of IS and business staffs within projects. Which of the following is NOT true for system efficiency? It is calculated by output divided by input Efficiency of any particular system cannot be considered in isolation from other systems An efficient IS uses appropriate level of resources to achieve its required objectives Problems of sub-optimization occur if one system is optimized at overall company's expenses Which of the following is NOT a data attribute? Completeness Purity Sound level Veracity The PRIMARY objective of an audit of IT security policies is to ensure that: security and control policies support business and IT objectives. there is a published organizational chart with functional descriptions. duties are appropriately segregated. they are distributed and available to all staff. An IS auditor reviews an organization chart PRIMARILY for: understanding the responsibilities and authority of individuals. an understanding of workflows. investigating the network connected to different employees. investigating various communication channels. IT control objectives are useful to IS auditors, as they provide the basis for understanding the: security policy. best IT security control practices relevant to a specific entity. desired result or purpose of implementing specific control procedures. techniques for securing information. Which of the following is NOT the needs of control & audit? Value of Computer Hardware, Software & Personnel Maintenance of Privacy Incorrect Decision Making Controlled Education of Computer Users Which of the following is NOT used by IS auditing? IS management theories Computer science research methodology Traditional auditing knowledge Behavioral science concepts The MOST likely affect of the lack of senior management commitment to IT strategic planning is: that the technology will not be aligned with the organization’s objectives. a lack of a methodology for systems development. an absence of control over technology contracts. a lack of investment in technology. Which of the following is NOT the possible restriction on the scope of IS auditing? insufficient power lack of resources or lack of sufficient time ineffective audit procedures inability to obtain sufficient evidence for any reason Which of the following is NOT true for concurrent auditing techniques? Auditors can print or display the evidence afterwards so they can determine whether to take some type of remedial action after the audit review It is the new trend in IS auditing Evidence can be written to a file and periodically printed for auditors to analyze and evaluate It collects audit evidence at the same time as application system processing occurs Which of the following is NOT a professional code of ethics required from by ISACA? Serve in the interest of stakeholders in a lawful and honest manner, while maintaining high standards of conduct and character, and engage in acts discreditable to the profession. Support the implementation of, and encourage compliance with, appropriate standards, procedures and controls for information systems. Maintain competency in their respective fields and agree to undertake only those activities, which they can reasonably expect to complete with professional competence. Support the professional education of stakeholders in enhancing their understanding of information systems security and control. Which of the following would an IS auditor consider the MOST relevant to short-term planning for the IS department? Keeping current with technology advances Evaluating hardware needs Allocating resources Conducting control self-assessment To ensure confidentiality, auditor should NOT: Working papers which are used by auditors must be protected with access control and regular data backup Sensitive information should not be removed from their office A document file archive should be created during each audit while client shall maintain sole responsibility for the safe retention of the archive Should contact company's owner for advice concerning confidentiality and laws that dictate disclosure to authorities What will happen if the data integrity of an organization is low? The organization could suffer the risk of sabotage by the employees The organization could suffer from the risk of possible acquisition by their competitors The organization could suffer the risk of being attacked by the hackers The organization could suffer from a loss of competitive advantage To support an organization’s goals, the IS department should have: a low-cost philosophy. planned to acquire new hardware and software. leading-edge technology. long- and short-range plans. When an information security policy has been designed, it is MOST important that the information security policy be: updated frequently. stored offsite. circulated to users. written by IS management. Which of the following is NOT the primary risks that auditors should consider? prevention risks control risks detection risks inherent risks Which of the following is NOT true for code of ethics? Concern for the public interest is paramount Security practitioners have opportunities to do good or do harm Security practitioners ought to be committed to doing good Code should be seen as a collection of parts What is the relationship between IS auditing and security? Security is the study of threats facing the organization while IS auditing is to check whether sufficient and appropriate controls exist to counteract with the threats Security is the study of auditing technique while IS auditing is to make use of security results to checking the IS Security provides direction in the number of the controls to be used while IS auditing is to check whether the controls used are irrelevant They have no relationship to each other Which of the following goals would you expect to find in an organization’s strategic plan? Implement a new project planning system within the next 12 months. Perform an evaluation of information technology needs. Test a new accounting package. Become the supplier of choice for the product offered. Which of the following is NOT true for audit charter? Accountability of auditors Background of auditors Responsibility of auditors Authority of auditors Which of the following is NOT an objective of IS Auditing? Data Integrity Effectiveness Data Protection Asset Safeguarding Which of the following is NOT one of the data protection principles in HK? Data Disclosure Principle Data Use Principle Openness Principle Data Collection Principle Which of the following is NOT one of the data protection principles in HK? Data Access & Correction Principle Data Reliability Principle Accuracy & Retention Principle Data Security Principle Which of the following is NOT the contents of financial objectives studied by IS auditor? Debtors' analysis Business continuity Budgeting and forecasting Cost allocation Which of the following is NOT a professional code of ethics required from by ISACA? Failure to comply with this Code of Professional Ethics can result in an investigation into a member's, and/or certification holder's conduct and, ultimately, in disciplinary measures. Maintain the privacy and confidentiality of information obtained in the course of their duties all the time. Perform their duties with objectivity, due diligence and professional care, in accordance with professional standards and best practices. Inform appropriate parties of the results of work performed; revealing all significant facts known to them Which of the following statement is true? Security level is more important than access level because security would affect our survival Security level and access level have to be in balance Access level is more important than security level because it would slow down our business function If security is too loose, then we have more freedom to have some innovation