Domain 4: Information Systems Operations and Business Resilience

hash key

A hash function takes an input as a key, which is associated with a datum or record and used to identify it to the data storage and retrieval application. The keys may be fixed length, like an integer, or variable length, like a name.

Foreign Key

A primary key of one table that appears as an attribute in another table and acts to provide a logical relationship between the two tables In a relational database with referential integrity, the use of foreign keys would prevent events such as primary key changes and record deletions, resulting in orphaned relations within the database.

Denormalization

A process by which a table is changed from a higher-level normal form to a lower-level normal form, usually to increase processing speed. Denormalization potentially yields data anomalies.

cold site

A separate facility that does not have any computer equipment, but is a place where employees can move after a disaster

warm site

A separate facility with computer equipment that requires installation and configuration This is an offsite backup facility that is partially configured with network connections and selected peripheral equipment—such as disk and tape units, controllers and central processing units—to operate an information processing facility.

Desk Check Test

A test that answers the questions: Does the organization have the documentation and people it needs. Do they understand the documentation? Deskcheck testing requires the least effort of the options given. Its aim is to ensure the plan is up to date and promote familiarity of the BCP to critical personnel from all areas.

incremental backup

A type of partial backup that involves copying only the data items that have changed since the last partial backup. This produces a set of incremental backup files, each containing the results of one day's transactions thus minimizing the storage

Which of the following groups is the BEST source of information for determining the criticality of application systems as part of a business impact analysis? a. Business processes owners b. IT management c. Senior business management d. Industry experts

A. business process owners these individuals have the most relevant information to contribute because the business impact analysis (BIA) is designed to evaluate criticality and recovery time lines, based on business needs.

Secondary Key

Alternate keys are those candidate keys which are not the Primary key. There can be only one Primary key for a table. Therefore all the remaining Candidate keys are known as Alternate or Secondary keys Secondary keys that are not foreign keys are not subject to referential integrity checks.

During an audit of a business continuity plan (BCP), an IS auditor found that, although all departments were housed in the same building, each department had a separate BCP. The IS auditor recommended that the BCPs be reconciled. Which of the following areas should be reconciled FIRST? a. Recovery priorities b. Backup storages c. Evacuation plan d. Call tree

C. Evacuation plan Human life is first priority

code signing

Code signing ensures that the executable code came from a reputable source and has not been modified after being signed.

functional test

Functional testing involves mobilization of personnel and resources at various geographic sites. This is a more in-depth functional test and not primarily focused on coordination and communication.

Tabletop Exercise

Individuals sitting around a table with a facilitator discussing situations that could arise and how best to respond to them The primary purpose of tabletop testing is to practice proper coordination because it involves all or some of the crisis team members and is focused more on coordination and communication issues than on technical process details.

database limit controls

Limiting the space available to users in their own databases prevents them from building excessively large tables. This helps to control space utilization which itself acts to help performance by maintaining a buffer between the actual data volume stored and the physical device capacity. Additionally, it prevents users from consuming excessive resources in ad hoc table builds (as opposed to scheduled production loads that often can run overnight and are optimized for performance purposes). In a data warehouse, because you are not running online transactions, commitment and rollback does not have an impact on performance.

Normalization/ Denormalization

Normalization is the removal of redundant data elements from the database structure Denormalization: Disabling normalization in relational databases will create redundancy and a risk of not maintaining consistency of data, with the consequent loss of data integrity.

Service level objective

Organizations will try to set service level objective to meet established business targets. The resulting time for the service level agreement relates to recovery of services, not to recovery of data.

open source software

Program code made publicly available for free; it can be copied, distributed, or changed without the stringent copyright protections of proprietary software products.

RAID level 1

RAID 1 consists of an exact copy (or mirror) of a set of data on two or more disks; a classic RAID 1 mirrored pair contains two disks.

Portability

The ability of an application to operate on different devices or software platforms is the ability of an application to run properly in a different platform to the one it was designed for, with little or no modification.

Recovery Point Objective (RPO)

The maximum length of time that an organization can tolerate between backups.

Degaussing

The process of removing or rearranging the magnetic field of a disk in order to render the data unrecoverable This is highly effective but offers less assurance than physical destruction.

Service Level Management (SLM)

The process responsible for negotiating achievable service level agreements and ensuring that these are met.

hash totals

The use of hash totals is an effective method to reliably detect errors in data processing. A hash total would indicate an error in data integrity.

Database Commits and Rollbacks

These ensure that the data are saved after the transaction processing is completed. Rollback ensures that the processing that has been partially completed as part of the transaction is reversed back and not saved if the entire transaction does not complete successfully.

duplicate processing facility

This is a dedicated, fully-developed recovery site that can back up critical applications.

long-haul network diversity

This is a diverse, long-distance network using different packet switching circuits among the major long-distance carriers. It ensures long-distance access should any carrier experience a network failure.

alternative routing

This is a method of routing information via an alternate medium such as copper cable or fiber optics. This involves the use of different networks, circuits or end points should the normal network be unavailable.

last-mile circuit protection

This is a redundant combination of local carrier T-1s (E-1s in Europe), microwave and/or coaxial cable access to the local communications loop. This enables the facility to have access during a local carrier communication disaster. Alternate local-carrier routing is also used.

The service delivery objective

This is directly related to the business needs. SDO is the level of services to be reached during the alternate process mode until the normal situation is restored.

Maximum acceptable outage (MAO)

This is the maximum amount of system downtime that is tolerable. It can be used as a synonym for maximum tolerable period of disruption or maximum allowable downtime. However, the RTO denotes an objective/target, while the MAO constitutes a vital necessity for an organization's survival.

dial up site

This is used for remote access, but not for offsite information processing.

user spools

User spool limits restrict the space available for running user queries. This prevents poorly formed queries from consuming excessive system resources and impacting general query performance.

end-user applications

a system developed in such a way that it allows non-programmers to grasp basic technology concepts enabling them to create functional software applications.

During an IS audit of the disaster recovery plan of a global enterprise, the auditor observes that some remote offices have very limited local IT resources. Which of the following observations would be the MOST critical for the IS auditor? a. A test has not been made to ensure that local resources could maintain security and service standards when recovering from a disaster or incident. b. The corporate business continuity plan does not accurately document the systems that exist at remote offices. c. Corporate security measures have not been incorporated into the test plan. d. A test has not been made to ensure that tape backups from the remote offices are usable.

a. A test has not been made to ensure that local resources could maintain security and service standards when recovering from a disaster or incident. Regardless of the capability of local IT resources, the most critical risk would be the lack of testing, which would identify quality issues in the recovery process.

Which of the following is the MOST critical to the quality of data in a data warehouse? a. Accuracy of the source data b. Credibility of the data source c. Accuracy of the extraction process d. Accuracy of the data transformation

a. Accuracy of the source data Accuracy of source data is a prerequisite for the quality of the data in a data warehouse. Inaccurate source data will corrupt the integrity of the data in the data warehouse.

If a database is restored using before-image dumps, where should the process begin following an interruption? a. Before the last transaction b. After the last transaction c. As the first transaction after the latest checkpoint d. As the last transaction before the latest checkpoint

a. Before the last transaction If before images are used, the last transaction in the dump will not have updated the database prior to the dump being taken.

A vendor has released several critical security patches over the past few months and this has put a strain on the ability of the administrators to keep the patches tested and deployed in a timely manner. The administrators have asked if they could reduce the testing of the patches. What approach should the organization take? a. Continue the current process of testing and applying patches. b. Reduce testing and ensure that an adequate backout plan is in place. c. Delay patching until resources for testing are available. d. Rely on the vendor's testing of the patches.

a. Continue the current process of testing and applying patches. Applying security software patches promptly is critical to maintain the security of the servers; further, testing the patches is important because the patches may affect other systems and business operations. Because the vendor has recently released several critical patches in a short time, it can be hoped that this is a temporary problem and does not need a revision to policy or procedures.

Which of the following represents the GREATEST risk created by a reciprocal agreement for disaster recovery made between two companies? a. Developments may result in hardware and software incompatibility. b. Resources may not be available when needed. c. The recovery plan cannot be live tested. d. The security infrastructures in each company may be different.

a. Developments may result in hardware and software incompatibility. If one organization updates its hardware and software configuration, it may mean that it is no longer compatible with the systems of the other party in the agreement. This may mean that each company is unable to use the facilities at the other company to recover their processing following a disaster.

Which of the following is the MOST critical element to effectively execute a disaster recovery plan? a. Offsite storage of backup data b. Up-to-date list of key disaster recovery contacts c. Availability of a replacement data center d. Clearly defined recovery time objective (RTO)

a. Offsite storage of backup data Remote storage of backups is the most critical disaster recovery plan (DRP) element of the items listed because access to backup data is required to restore systems

Which of the following disaster recovery testing techniques is the MOST efficient way to determine the effectiveness of the plan? a. Preparedness tests b. Paper tests c. Full operational tests d. Actual service disruption

a. Preparedness tests These involve simulation of the entire environment (in phases) at relatively low cost and help the team to better understand and prepare for the actual test scenario.

An IS auditor is assisting in the design of the emergency change control procedures for an organization with a limited budget. Which of the following recommendations BEST helps to establish accountability for the system support personnel? a. Production access is granted to the individual support ID when needed. b. Developers use a firefighter ID to promote code to production. c. A dedicated user promotes emergency changes to production. d. Emergency changes are authorized prior to promotion.

a. Production access is granted to the individual support ID when needed. Production access should be controlled and monitored to ensure segregation of duties. During an emergency change, a user who normally does not have access to production may require access. The best process to ensure accountability within the production system is to have the information security team create a production support group and add the user ID to that group to promote the change. When the change is complete the ID can be removed from the group. This process ensures that activity in production is linked to the specific ID that was used to make the change.

Which of the following inputs would PRIMARILY help in designing the data backup strategy in case of potential natural disasters? a. Recovery point objective b. Volume of data to be backed up c. Available data backup technologies d. Recovery time objective

a. Recovery point objective is determined based on the acceptable data loss in case of a disruption of operations. It indicates the earliest point in time that is acceptable to recover the data the speed of recovery required by the business is the most important factor.

A clerk changed the interest rate for a loan on a master file. The rate entered is outside the normal range for such a loan. Which of the following controls is MOST effective in providing reasonable assurance that the change was authorized? a. The system will not process the change until the clerk's manager confirms the change by entering an approval code. b. The system generates a weekly report listing all rate exceptions and the report is reviewed by the clerk's manager. c. The system requires the clerk to enter an approval code. d. The system displays a warning message to the clerk.

a. The system will not process the change until the clerk's manager confirms the change by entering an approval code. this way can't even be entered the log would take too long

An organization completed a business impact analysis as part of business continuity planning. The NEXT step in the process is to develop: a. a business continuity strategy b. a business continuity plan c. a test and exercise plan. d. a user training program.

a. a business continuity strategy the analysis shows the risks now they need to come up with a strategy of how the organization would like to address it

An IS auditor reviewing a new outsourcing contract with a service provider would be MOST concerned if which of the following was missing? a. A clause providing a "right to audit" the service provider b. A clause defining penalty payments for poor performance c. Predefined service level report templates d. A clause regarding supplier limitation of liability

a. a clause providing a "right to audit" the service provider The absence of a "right to audit" clause or other form of attestation that the supplier was compliant with a certain standard would potentially prevent the IS auditor from investigating any aspect of supplier performance moving forward, including control deficiencies, poor performance and adherence to legal requirements. This would be a major concern for the IS auditor because it would be difficult for the organization to assess whether the appropriate controls had been put in place.

An organization has a business process with a recovery time objective equal to zero and a recovery point objective close to one minute. This implies that the process can tolerate: a. a data loss of up to one minute, but the processing must be continuous. b. a one-minute processing interruption but cannot tolerate any data loss. c. a processing interruption of one minute or more. d. both a data loss and a processing interruption longer than one minute.

a. a data loss of up to one minute, but the processing must be continuous Recovery time objective (RTO) measures an organization's tolerance for downtime and recovery point objective (RPO) measures how much data loss can be accepted.

Which of the following would an IS auditor consider to be MOST helpful when evaluating the effectiveness and adequacy of a preventive computer maintenance program? a. A system downtime log b. Vendors' reliability figures c. Regularly scheduled maintenance log d. A written preventive maintenance schedule

a. a system downtime log This provides evidence regarding the effectiveness and adequacy of computer preventive maintenance programs. The log is a detective control, but because it is validating the effectiveness of the maintenance program, it is validating a preventive control.

Which of the following is a prevalent risk in the development of end-user computing applications? a. Applications may not be subject to testing and IT general controls. b. Development and maintenance costs may be increased. c. Application development time may be increased. d. Decision-making may be impaired due to diminished responsiveness to requests for information.

a. applications may not be subject to testing and IT general controls this is an application created by an end user; example - business creating a query to pull a report End-user developed applications may not be subjected to an independent outside review by systems analysts and frequently are not created in the context of a formal development methodology.

In a small organization, developers may release emergency changes directly to production. Which of the following will BEST control the risk in this situation? a. Approve and document the change the next business day. b. Limit developer access to production to a specific time frame. c. Obtain secondary approval before releasing to production. d. Disable the compiler option in the production machine.

a. approve and document the change the next business day It may be appropriate to allow programmers to make emergency changes as long as they are documented and approved after the fact.

Vendors have released patches fixing security flaws in their software. Which of the following should an IS auditor recommend in this situation? a. Assess the impact of patches prior to installation. b. Ask the vendors for a new software version with all fixes included. c. Install the security patch immediately. d. Decline to deal with these vendors in the future.

a. assess the impact of patches prior to installation The effect of installing the patch should be immediately evaluated and installation should occur based on the results of the evaluation. There are numerous cases where a patch from one vendor has affected other systems; therefore, it is necessary to test the patches as much as possible before rolling them out to the entire organization.

An IS auditor performing an application maintenance audit would review the log of program changes for the: a. authorization of program changes. b. creation date of a current object module. c. number of program changes actually made. d. creation date of a current source program.

a. authorization of program changes The auditor wants to ensure that only authorized changes have been made to the application. The auditor would therefore review the log of program changes to verify that all changes have been approved.

Due to changes in IT, the disaster recovery plan of a large organization has been changed. What is the PRIMARY risk if the new plan is not tested? a. catastrophic service interruption b. high consumption of resources c. Total cost of the recovery may not be minimized d. Users and recovery teams may face severe difficulties when activating the plan

a. catastrophic service interruption all of the others are true but think what do they all lead too?

With respect to business continuity strategies, an IS auditor interviews key stakeholders in an organization to determine whether they understand their roles and responsibilities. The IS auditor is attempting to evaluate the: a. clarity and simplicity of the business continuity plans. b. adequacy of the business continuity plans. c. effectiveness of the business continuity plans. d. ability of IS and end-user personnel to respond effectively in emergencies

a. clarity and simplicity of the business continuity plan The IS auditor should interview key stakeholders to evaluate how well they understand their roles and responsibilities. When all stakeholders have a detailed understanding of their roles and responsibilities in the event of a disaster, an IS auditor can deem the business continuity plan to be clear and simple.

Which of the following is widely accepted as one of the critical components in networking management? a. Configuration and change management b. Topological mappings c. Application of monitoring tools d. Proxy server troubleshooting

a. configuration and change management Configuration management is widely accepted as one of the key components of any network because it establishes how the network will function internally and externally. It also deals with the management of configuration and monitoring performance. Change management ensures that the setup and management of the network is done properly, including managing changes to the configuration, removal of default passwords and possibly hardening the network by disabling unneeded services.

The frequent updating of which of the following is key to the continued effectiveness of a disaster recovery plan? a. Contact information of key personnel b. Server inventory documentation c. Individual roles and responsibilities d. Procedures for declaring a disaster

a. contact information of key personnel In the event of a disaster, it is important to have a current updated list of personnel who are key to the operation of the plan.

The responsibility for authorizing access to a business application system belongs to the: a. data owner b. security administrator c. IT security manager d. requestor's immediate supervisor

a. data owner When a business application is developed, a good practice is to assign an information or data owner to the application. The information owner should be responsible for authorizing access to the application itself or to back-end databases for queries.

The PRIMARY purpose of a business impact analysis is to: a. define recovery strategies. b. identify the alternate site. c. improve recovery testing. d. calculate the annual loss expectancy.

a. define recovery strategies One of the primary outcomes of a business impact analysis (BIA) is the recovery time objective and the recovery point objective, which help in defining the recovery strategies.

The PRIMARY objective of service-level management is to: a. define, agree on, record and manage the required levels of service. b. ensure that services are managed to deliver the highest achievable level of availability. c. keep the costs associated with any service at a minimum. d. monitor and report any legal noncompliance to business management.

a. define, agree on, record and manage the required levels of service The objective of service-level management (SLM) is to negotiate, document and manage (i.e., provide and monitor) the services in the manner in which the customer requires those services.

Which of the following activities performed by a database administrator should be performed by a different person? a. Deleting database activity logs b. Implementing database optimization tools c. Monitoring database usage d. Defining backup and recovery procedures

a. deleting database activity logs

Business units are concerned about the performance of a newly implemented system. Which of the following should an IS auditor recommend? a. Develop a baseline and monitor system usage. b. Define alternate processing procedures. c. Prepare the maintenance manual. d. Implement the changes users have suggested.

a. develop a baseline and monitor system usage An IS auditor should recommend the development of a performance baseline and monitor the system's performance against the baseline to develop empirical data upon which decisions for modifying the system can be made.

A hot site should be implemented as a recovery strategy when the: a. disaster downtime tolerance is low. b. recovery point objective is high. c. recovery time objective is high. d. maximum tolerable downtime is long.

a. disaster downtime tolerance is low This is the time gap during which the business can accept non-availability of IT facilities. If this time gap is low, recovery strategies that can be implemented within a short period of time, such as a hot site, should be used

Management considered two projections for its disaster recovery plan: plan A with two months to fully recover and plan B with eight months to fully recover. The recovery point objectives are the same in both plans. It is reasonable to expect that plan B projected higher: a. downtime costs. b. resumption costs. c. recovery costs. d. walk-through costs.

a. downtime costs Because management considered a longer time window for recovery in plan B, downtime costs included in the plan are likely to be higher.

The activation of an enterprise's business continuity plan should be based on predetermined criteria that address the: a. duration of the outage. b. type of outage. c. probability of the outage. d. cause of the outage.

a. duration of the outage The initiation of a business continuity plan (action) should primarily be based on the maximum period for which a business function can be disrupted before the disruption threatens the achievement of organizational objectives.

Depending on the complexity of an organization's business continuity plan (BCP), it may be developed as a set of plans to address various aspects of business continuity and disaster recovery. In such an environment, it is essential that: a. each plan is consistent with one another. b. all plans are integrated into a single plan. c. each plan is dependent on one another. d. the sequence for implementation of all plans is defined.

a. each plan is consistent with one another Depending on the complexity of an organization, there could be more than one plan to address various aspects of business continuity and disaster recovery, but the plans must be consistent to be effective.

In a relational database with referential integrity, the use of which of the following keys would prevent deletion of a row from a customer table as long as the customer number of that row is stored with live orders on the orders table? a. Foreign key b. Primary key c. Secondary key d. Public key

a. foreign key In a relational database with referential integrity, the use of foreign keys would prevent events such as primary key changes and record deletions, resulting in orphaned relations within the database.

In a relational database with referential integrity, the use of which of the following keys would prevent deletion of a row from a customer table as long as the customer number of that row is stored with live orders on the orders table? a. Foreign key b. Primary key c. Secondary key d. Secondary key

a. foreign key In a relational database with referential integrity, the use of foreign keys would prevent events such as primary key changes and record deletions, resulting in orphaned relations within the database.

What would be the MOST effective control for enforcing accountability among database users accessing sensitive information? a. Implement a log management process. b. Implement a two-factor authentication. c. Use table views to access sensitive data. d. Separate database and application servers.

a. implement a log management process Accountability means knowing what is being done by whom. The best way to enforce the principle is to implement a log management process that would create and store logs with pertinent information such as user name, type of transaction and hour.

During an audit of a small enterprise, the IS auditor noted that the IS director has superuser-privilege access that allows the director to process requests for changes to the application access roles (access types). Which of the following should the IS auditor recommend? a. Implement a properly documented process for application role change requests. b. Hire additional staff to provide a segregation of duties for application role changes. c. Implement an automated process for changing application roles. d. Document the current procedure in detail and make it available on the enterprise intranet.

a. implement a properly documented process for application role change requests The IS auditor should recommend implementation of processes that could prevent or detect improper changes from being made to the major application roles. The application role change request process should start and be approved by the business owner; then, the IS director can make the changes to the application.

Which of the following should an IS auditor recommend for the protection of specific sensitive information stored in a data warehouse? a. Implement column- and row-level permissions b. Enhance user authentication via strong passwords c. Organize the data warehouse into subject matter-specific databases d. Log user access to the data warehouse

a. implement column- and row-level permissions Column- and row-level permissions control what information users can access. Column-level security prevents users from seeing one or more attributes on a table. With row-level security a certain grouping of information on a table is restricted (e.g., if a table held details of employee salaries, then a restriction could be put in place to ensure that, unless specifically authorized, users could not view the salaries of executive staff). Column- and row-level security can be achieved in a relational database by allowing users to access logical representations of data (views) rather than physical tables. This "fine-grained" security model is likely to offer the best balance between information protection while still supporting a wide range of analytical and reporting uses.

Which of the following is the MOST efficient strategy for the backup of large quantities of mission-critical data when the systems need to be online to take sales orders 24 hours a day? a. Implementing a fault-tolerant disk-to-disk backup solution b. Making a full backup to tape weekly and an incremental backup nightly c. Creating a duplicate storage area network (SAN) and replicating the data to a second SAN d. Creating identical server and storage infrastructure at a hot site

a. implementing a fault-tolerant disk to disk backup solution Disk-to-disk backup, also called disk-to-disk-to-tape backup or tape cache, is when the primary backup is written to disk instead of tape. That backup can then be copied, cloned or migrated to tape at a later time (hence the term "disk-to-disk-to-tape"). This technology allows the backup of data to be performed without impacting system performance and allows a large quantity of data to be backed up in a very short backup window. In case of a failure, the fault-tolerant system can transfer immediately to the other disk set. (d) While creating an identical server and storage infrastructure at a hot site provides a great deal of redundancy and availability to enable the system to stay operational, it does not address the need for long-term data storage. There is still the need to create an efficient method of backing up data.

The cost of ongoing operations when a disaster recovery plan (DRP) is in place, compared to not having a DRP, will MOST likely: a. increase b. decrease c. remain the same d. be unpredictable.

a. increase the cost of testing, implementing and maintaining the DRP

A new business requirement required changing database vendors. Which of the following areas should the IS auditor PRIMARILY examine in relation to this implementation? a. Integrity of the data b. Timing of the cutover c. Authorization level of users d. Normalization of the data

a. integrity of the data A critical issue when migrating data from one database to another is the integrity of the data and ensuring that the data are migrated completely and correctly.

Emergency changes that bypass the normal change control process are MOST acceptable if: a. management reviews and approves the changes after they have occurred. b. the changes are reviewed by a peer at the time of the change. c. the changes are documented in the change control system by the operations department. d. management has preapproved all emergency changes.

a. management reviews and approves the changes after they have occurred Because management cannot always be available when a system failure occurs, it is acceptable for changes to be reviewed and approved within a reasonable time period after they occur.

Which of the following is the MOST important criterion when selecting a location for an offsite storage facility for IS backup files? The offsite facility must be: a. physically separated from the data center and not subject to the same risk. b. given the same level of protection as that of the computer data center. c. outsourced to a reliable third party. d. equipped with surveillance capabilities

a. physically separated from the data center and not subject to the same risk It is important that there is an offsite storage location for IS files and that it is in a location not subject to the same risk as the primary data center.

When reviewing a disaster recovery plan, an IS auditor should be MOST concerned with the lack of: a. process owner involvement. b. well-documented testing procedures. c. an alternate processing facility. d. a well-documented data classification scheme.

a. process owner involvement This is a critical part of the business impact analysis (BIA), which is used to create the disaster recovery plan. If the IS auditor determined that process owners were not involved, this would be a significant concern.

Which of the following stakeholders is the MOST important in terms of developing a business continuity plan? a. Process owners b. Application owners c. The board of directors d. IT management

a. process owners These people are essential in identifying the critical business functions, recovery times and resources needed.

An IS auditor should recommend the use of library control software to provide reasonable assurance that: a. program changes have been authorized. b. only thoroughly tested programs are released. c. modified programs are automatically moved to production. d. source and executable code integrity is maintained.

a. program changes have been authorized Library control software should be used to separate test from production libraries in mainframe and/or client server environments. The main objective of library control software is to provide assurance that program changes have been authorized.

Due to resource constraints, a developer requires full access to production data to support certain problems reported by production users. Which of the following choices would be a good compensating control for controlling unauthorized changes in production? a. Provide and monitor separate developer login IDs for programming and for production support. b. Capture activities of the developer in the production environment by enabling detailed audit trails. c. Back up all affected records before allowing the developer to make production changes. d. Ensure that all changes are approved by the change manager prior to implementation

a. provide and monitor separate developer login IDs for programming and for product support Providing separate login IDs that would only allow a developer privileged access when required is a good compensating control, but it must also be backed up with monitoring and supervision of the activity of the developer. b not right - While capturing activities of the developer via audit trails or logs would be a good practice, the control would not be effective unless these audit trails are reviewed on a periodic basis

In a disaster recovery situation, which of the following is the MOST important metric to ensure that data are synchronized between critical systems? a. Recovery point objective b. Recovery time objective c. Recovery service resilience d. Recovery service scalability

a. recovery point objective Establishing a common recovery point objective is most critical for ensuring that interdependencies between systems are properly synchronized. It ensures that systems do not contain data from different points in time that may result in accounting transactions that cannot be reconciled and a loss of referential integrity.

In a disaster recovery situation, which of the following is the MOST important metric to ensure that data are synchronized between critical systems? a. recovery point objective b. Recovery time objective c. Recovery service resilience d. Recovery service scalability

a. recovery point objective Establishing a common recovery point objective is most critical for ensuring that interdependencies between systems are properly synchronized. It ensures that systems do not contain data from different points in time that may result in accounting transactions that cannot be reconciled and a loss of referential integrity.

After a disaster declaration, the media creation date at a warm recovery site is based on the: a. recovery point objective. b. recovery time objective. c. service delivery objective. d. maximum tolerable outage.

a. recovery point objective This is determined based on the acceptable data loss in case of a disruption of operations. It indicates the earliest point in time that is acceptable to recover the data. The RPO effectively quantifies the permissible amount of data loss in case of interruption. The media creation date will reflect the point to which data are to be restored or the RPO.

An optimized disaster recovery plan for an organization should: a. reduce the length of the recovery time and the cost of recovery. b. increase the length of the recovery time and the cost of recovery. c. reduce the duration of the recovery time and increase the cost of recovery. d. not affect the recovery time or the cost of recovery.

a. reduce the length of the recovery time and the cost of recovery

Segmenting a highly sensitive database results in: a. reduced exposure. b. reduced threat. c. less criticality. d. less sensitivity.

a. reduced exposure Segmenting data reduces the quantity of data exposed to a particular vulnerability.

An advantage of using unshielded twisted-pair (UTP) cable for data communication over other copper-based cables is that UTP cable: a. reduces crosstalk between pairs. b. provides protection against wiretapping. c. can be used in long-distance networks. d. is simple to install.

a. reduces crosstalk between pairs The use of unshielded twisted-pair (UTP) in copper will reduce the likelihood of crosstalk.

An organization has just completed its annual risk assessment. Regarding the business continuity plan, what should an IS auditor recommend as the next step for the organization? a. Review and evaluate the business continuity plan for adequacy b. Perform a full simulation of the business continuity plan c. Train and educate employees regarding the business continuity plan d. Notify critical contacts in the business continuity plan

a. review and evaluate the business continuity plan for adequacy The business continuity plan should be reviewed every time a risk assessment is completed for the organization.

The IS auditor observes that the latest security-related software patches for a mission-critical system were released two months ago, but IT personnel have not yet installed the patches. The IS auditor should: a. review the patch management policy and determine the risk associated with this condition. b. recommend that IT systems personnel test and then install the patches immediately. c. recommend that patches be applied every month or immediately upon release. d. take no action, because the IT processes related to patch management appear to be adequate.

a. review the patch management policy and determine the risk associated with this condition Reviewing the patch management policy and determining whether the IT department is compliant with the policies will detect whether the policies are appropriate and what risk is associated with current practices.

When developing a business continuity plan, which of the following tools should be used to gain an understanding of the organization's business processes? a. Risk assessment b. Business continuity self-audit c. Gap analysis d. Resource recovery analysis

a. risk assessment This, along with business impact assessment, are tools for understanding the business as a part of a business continuity plan (BCP).

While designing the business continuity plan for an airline reservation system, the MOST appropriate method of data transfer/backup at an offsite location would be: a. shadow file processing. b. electronic vaulting. c. hard-disk mirroring. d. hot-site provisioning.

a. shadow file processing In shadow file processing, exact duplicates of the files are maintained at the same site or at a remote site. The two files are processed concurrently. This is used for critical data files such as airline booking systems.

During a data center audit, an IS auditor observes that some parameters in the tape management system are set to bypass or ignore tape header records. Which of the following is the MOST effective compensating control for this weakness? a. Staging and job setup b. Supervisory review of logs c. Regular backup of tapes d. Offsite storage of tapes

a. staging and job setup If the IS auditor finds that there are effective staging and job setup processes, this can be accepted as a compensating control. Not reading header records may otherwise result in loading the wrong tape and deleting or accessing data on the loaded tape.

A live test of a mutual agreement for IT system recovery has been carried out, including a four-hour test of intensive usage by the business units. The test has been successful, but gives only partial assurance that the: a. system and the IT operations team can sustain operations in the emergency environment. b. resources and the environment could sustain the transaction load. c. connectivity to the applications at the remote site meets response time requirements. d. workflow of actual business operations can use the emergency system in case of a disaster.

a. system and the IT operations team can sustain operations in the emergency environment The applications have been operated intensively, but the capability of the system and the IT operations team to sustain and support this environment (ancillary operations, batch closing, error corrections, output distribution, etc.) is only partially tested.

Disaster recovery planning addresses the: a. technological aspect of business continuity planning (BCP). b. operational part of BCP. c. functional aspect of BCP. d. overall coordination of BCP.

a. technological aspect of business continuity planning

An IS auditor is reviewing database security for an organization. Which of the following is the MOST important consideration for database hardening? a. The default configurations are changed. b. All tables in the database are denormalized. c. Stored procedures and triggers are encrypted. d. The service port used by the database server is changed.

a. the default configurations are changed Default database configurations, such as default passwords and services, need to be changed; otherwise, the database could be easily compromised by malicious code and by intruders.

During maintenance of a relational database, several values of the foreign key in a transaction table have been corrupted. The consequence is that: a. the detail of involved transactions may no longer be associated with master data, causing errors when these transactions are processed. b. there is no way of reconstructing the lost information, except by deleting the dangling tuples and reentering the transactions. c. the database will immediately stop execution and lose more information. d. the database will no longer accept input data.

a. the detail of involved transactions may no longer be associated with master data, causing errors when these transactions are processed When the external key of a transaction is corrupted or lost, the application system will normally be incapable of directly attaching the master data to the transaction data. Normally, this will cause the system to undertake a sequential search and slow down the processing. If the concerned files are big, this slowdown will be unacceptable. This is a violation of referential integrity.

If the recovery time objective increases: a. the disaster tolerance increases. b. the cost of recovery increases. c. a cold site cannot be used. d. the data backup frequency increases.

a. the disaster tolerance increases. the recovery time increases meaning the tolerance for disaster also increases as there will be more downtime

When auditing the archiving process of emails, the IS auditor should pay the MOST attention to: a. the existence of a data retention policy. b. the storage capacity of the archiving solution. c. the level of user awareness concerning email use. d. the support and stability of the archiving solution manufacturer.

a. the existence of a data retention policy Without a data retention policy that is aligned to the company's business and compliance requirements, the email archive may not preserve and reproduce the correct information when required.

Which of the following is the BEST method to ensure that the business continuity plan remains up to date? a. The group walks through the different scenarios of the plan from beginning to end. b. The group ensures that specific systems can actually perform adequately at the alternate offsite facility. c. The group is aware of full-interruption test procedures. d. Interdepartmental communication is promoted to better respond in the case of a disaster.

a. the group walks through the different scenarios of the plan from beginning to end A structured walk-through test gathers representatives from each department who will review the plan and identify weaknesses.

An IS auditor notes during an audit that an organization's business continuity plan does not adequately address information confidentiality during the recovery process. The IS auditor should recommend that the plan be modified to include: a. the level of information security required when business recovery procedures are invoked. b. information security roles and responsibilities in the crisis management structure. c. information security resource requirements. d. change management procedures for information security that could affect business continuity arrangements.

a. the level of information security required when business recovery procedures are invoked Business should consider whether information security levels required during recovery should be the same, lower or higher than when business is operating normally. In particular, any special rules for access to confidential data during a crisis need to be identified.

Determining the service delivery objective should be based PRIMARILY on: a. the minimum acceptable operational capability. b. the cost-effectiveness of the restoration process. c. meeting the recovery time objectives. d. the allowable interruption window.

a. the minimum acceptable operational capability. The service delivery objective (SDO) is the level of service to be reached during the alternate process mode until the normal situation is restored. This is directly related to the business needs.

The purpose of code signing is to provide assurance that: a. the software has not been subsequently modified. b. the application can safely interface with another signed application. c. the signer of the application is trusted. d. the private key of the signer has not been compromised.

a. the software has not been subsequently modified Code signing ensures that the executable code came from a reputable source and has not been modified after being signed.

When reviewing system parameters, an IS auditor's PRIMARY concern should be that: a. they are set to meet both security and performance requirements. b. changes are recorded in an audit trail and periodically reviewed. c. changes are authorized and supported by appropriate documents. d. access to parameters in the system is restricted.

a. they are set to meet both security and performance requirements The primary concern is to find the balance between security and performance. Recording changes in an audit trail and periodically reviewing them is a detective control; however, if parameters are not set according to business rules, monitoring of changes may not be an effective control

An IS auditor is reviewing a monthly accounts payable transaction register using audit software. For what purpose would the auditor be interested in using a check digit? a. To detect data transposition errors b. To ensure that transactions do not exceed predetermined amounts c. To ensure that data entered are within reasonable limits d. To ensure that data entered are within a predetermined range of values

a. to detect data transposition errors A check digit is a numeric value added to data to ensure that original data are correct and have not been altered.

An IS auditor is to assess the suitability of a service level agreement (SLA) between the organization and the supplier of outsourced services. To which of the following observations should the IS auditor pay the MOST attention? The SLA does not contain a: a. transition clauses from the old supplier to a new supplier or back to internal in the case of expiration or termination. b. late payment clause between the customer and the supplier. c. contractual commitment for service improvement. d. dispute resolution procedure between the contracting parties.

a. transition clauses from the older supplier to a new supplier or back to internal in case of expiration or termination The delivery of IT services for a specific customer always implies a close linkage between the client and the supplier of the service. If there are no contract terms to specify how the transition to a new supplier may be performed, there is the risk that the old supplier may simply "pull the plug" if the contract expires or is terminated or may not make data available to the outsourcing organization or new supplier. This would be the greatest risk to the organization.

A database administrator (DBA) who needs to make emergency changes to a database after normal working hours should log in: a. with their named account to make the changes. b. with the shared DBA account to make the changes. c. to the server administrative account to make the changes. d. to the user's account to make the changes.

a. with their named account to make the changes Logging in using the named user account before using the database administrator (DBA) account provides accountability by noting the person making the changes.

Level 5 RAID

allows you to have the best of all worlds - it allows combining great data performance and safety with an affordable price. RAID 5 is a unique version of RAID that uses something called RAID parity. This technique uses parity information or bonus data to calculate any lost information

An IS auditor of a health care organization is reviewing contractual terms and conditions of a third-party cloud provider being considered to host patient health information. Which of the following contractual terms would be the GREATEST risk to the customer organization? a. Data ownership is retained by the customer organization. b. The third-party provider reserves the right to access data to perform certain operations. c. Bulk data withdrawal mechanisms are undefined. d. The customer organization is responsible for backup, archive and restore.

b - the third party provider reserves the right to access data to perform certain operations Some service providers reserve the right to access customer information (third-party access) to perform certain transactions and provide certain services. In the case of protected health information, regulations may restrict certain access. Organizations must review the regulatory environment in which the cloud provider operates because it may have requirements or restrictions of its own. Organizations must then determine whether the cloud provider provides appropriate controls to ensure that data are appropriately secure.

Which of the following is the MOST important consideration when defining recovery point objectives? a. Minimum operating requirements b. Acceptable data loss c. Acceptable downtime

b. Acceptable data loss

Which of the following is MOST directly affected by network performance monitoring tools? a. Integrity b. Availability c. Completeness d. Confidentiality

b. Availability Network monitoring tools allow observation of network performance and problems. This allows the administrator to take corrective action when network problems are observed. Therefore, the characteristic that is most directly affected by network monitoring is availability.

Which of the following statements is useful while drafting a disaster recovery plan? a. Downtime costs decrease as the recovery point objective increases. b. Downtime costs increase with time. c. Recovery costs are independent of time. d. Recovery costs can only be controlled on a short-term basis.

b. Downtime costs increase with time. A disaster recovery plan should be drawn to achieve the lowest downtime costs possible.

Which of the following issues should be the GREATEST concern to the IS auditor when reviewing an IT disaster recovery test? a. Due to the limited test time window, only the most essential systems were tested. The other systems were tested separately during the rest of the year. b. During the test, some of the backup systems were defective or not working, causing the test of these systems to fail. c. The procedures to shut down and secure the original production site before starting the backup site required far more time than planned. d. Every year, the same employees perform the test. The recovery plan documents are not used because every step is well known by all participants.

b. During the test, some of the backup systems were defective or not working, causing the test of these systems to fail. The purpose of the test is to test the backup plan. When the backup systems are not working then the plan cannot be counted on in a real disaster. This is the most serious problem.

In addition to the backup considerations for all systems, which of the following is an important consideration in providing backup for online systems? a. Maintaining system software parameters b. Ensuring periodic dumps of transaction logs c. Ensuring grandfather-father-son file backups d. Maintaining important data at an offsite location

b. Ensuring periodic dumps of transaction logs This is the only safe way of preserving timely historic data. Because online systems do not have a paper trail that can be used to recreate data, maintaining transaction logs is critically important to prevent data loss. The volume of activity usually associated with an online system may make other more traditional methods of backup impractical.

A new application has been purchased from a vendor and is about to be implemented. Which of the following choices is a key consideration when implementing the application? a. Preventing the compromise of the source code during the implementation process b. Ensuring that vendor default accounts and passwords have been disabled c. Removing the old copies of the program from escrow to avoid confusion d. Verifying that the vendor is meeting support and maintenance agreements

b. Ensuring that vendor default accounts and passwords have been disabled ex: think workday - they should have removed the access during imp and was deficiency later

An IS auditor is reviewing the most recent disaster recovery plan of an organization. Which approval is the MOST important when determining the availability of system resources required for the plan? a. Executive management b. IT management c. Board of directors d. Steering committee

b. IT management Because a disaster recovery plan (DRP) is based on the recovery and provisioning of IT services, IT management's approval would be most important to verify that the system resources will be available in the event that a disaster event is triggered.

Which of the following tests performed by an IS auditor would be the MOST effective in determining compliance with change control procedures in an organization? a. Review software migration records and verify approvals. b. Identify changes that have occurred and verify approvals. c. Review change control documentation and verify approvals. d. Ensure that only appropriate staff can migrate changes into production.

b. Identify changes that have occurred and verify approvals. The most effective method is to determine what changes have been made (check logs and modified dates) and then verify that they have been approved.

In auditing a database environment, an IS auditor will be MOST concerned if the database administrator is performing which of the following functions? a. Performing database changes according to change management procedures b. Installing patches or upgrades to the operating system c. Sizing table space and consulting on table join limitations d. Performing backup and recovery procedures

b. Installing patches or upgrades to the operating system This is a function that should be performed by a systems administrator, not by a database administrator (DBA). If a DBA were performing this function, there would be a risk based on inappropriate segregation of duties.

Which of the following choices BEST ensures accountability when updating data directly in a production database? a. Principle of least privilege b. Review of audit logs c. Approved validation plan d. Segregation of duties

b. Review of audit logs key word - accountability Detailed audit logs that contain the user ID of the individual who performed the change as well as the data before and after the change are the best evidence of database changes. A review of these logs would evidence the individual who changed the data (ensuring accountability) as well as the correctness of the change.

Which of the following would help to ensure the portability of an application connected to a database? a. Verification of database import and export procedures b. Usage of a Structured Query Language c. Analysis of stored procedures/triggers d. Synchronization of the entity-relation model with the database physical schema

b. Usage of a Structured Query Language the use of Structured Query Language facilitates portability because it is an industry standard used by many systems.

Of the following alternatives, the FIRST approach to developing a disaster recovery strategy would be to assess whether: a. all threats can be completely removed. b. a cost-effective, built-in resilience can be implemented. c. the recovery time objective can be optimized. d. the cost of recovery can be minimized.

b. a cost-effective, built-in resilience can be implemented It is critical to initially identify information assets that can be made more resilient to disasters (e.g., diverse routing, alternate paths or multiple communication carriers). Preventing a problem is always better than planning to address a problem when it happens.

Which of the following assures an enterprise of the existence and effectiveness of internal controls relative to the service provided by a third party? a. The current service level agreement b. A recent independent third-party external audit report c. The current business continuity plan procedures d. A recent disaster recovery plan test report

b. a recent independent third party external audit report An independent third-party audit report such as a Statements on Standards for Attestation Engagements 16 would provide assurance of the existence and effectiveness of internal controls at the third party.

Which of the following is MOST important when an operating system patch is to be applied to a production environment? a. Successful regression testing by the developer b. Approval from the information asset owner c. Approval from the security officer d. Patch installation at alternate sites

b. approval from the information asset owner It is most important that information owners approve any changes to production systems to ensure that no serious business disruption takes place as the result of the patch release. While testing is important for any patch, in this case it should be assumed that the operating system (OS) vendor tested the patch before releasing it. Before this OS patch is put into production, the organization should do system testing to ensure that no issues will occur.

An IS auditor finds that a database administrator (DBA) has read and write access to production data. The IS auditor should: a. accept the DBA access as a common practice. b. assess the controls relevant to the DBA function c. recommend the immediate revocation of the DBA access to production data. d. review user access authorizations approved by the DBA.

b. assess the controls relevant to the DBA Function the auditor should see if there are any compensating controls in place that may address the exposure

Which of the following reports should an IS auditor use to check compliance with a service level agreement's requirement for uptime? a. utilization reports b. availability reports c. system logs d. hardware error reports

b. availability reports

An IS auditor observed that multiple applications are hosted on the same server. The recovery time objective (RTO) for the server will be: a. based on the application with the longest RTO. b. based on the application with the shortest RTO. c. based on the mean of each application's RTO. d. independent of the RTO and based on the criticality of the application.

b. based on the application with the shortest RTO When several applications are hosted on a server, the server's RTO must be determined by taking the RTO of the most critical application, which is the shortest RTO.

Which of the following is the GREATEST risk of an organization using reciprocal agreements for disaster recovery between two business units? a. The documents contain legal deficiencies. b. Both entities are vulnerable to the same incident. c. IT systems are not identical. d. One party has more frequent disruptions than the other.

b. both entities are vulnerable to the same incident

Which of the following BEST helps prioritize the recovery of IT assets when planning for a disaster? a. Incident response plan b. Business impact analysis c. Threat and risk analysis d. Recovery time objective

b. business impact analysis Incorporating the business impact analysis (BIA) into the IT disaster recovery planning process is critical to ensure that IT assets are prioritized to align with the business.

Which of the following would an IS auditor use to determine if unauthorized modifications were made to production programs? a. system log analysis b. compliance testing c. Forensic analysis d. Analytical review

b. compliance testing Determining that only authorized modifications are made to production programs would require the change management process be reviewed to evaluate the existence of a trail of documentary evidence. Compliance testing would help to verify that the change management process has been applied consistently. **the log wouldnt show if authorized or not

Which of the following choices would MOST likely ensure that a disaster recovery effort is successful? a. The tabletop test was performed. b. Data restoration was completed. c. Recovery procedures are approved. d. Appropriate staff resources are committed.

b. data restoration was complete The most reliable method to determine whether a backup is valid would be to restore it to a system. A data restore test should be performed at least annually to verify that the process is working properly.

Applying a retention date on a file will ensure that: a. data cannot be read until the date is set. b. data will not be deleted before that date. c. backup copies are not retained after that date. d. datasets having the same name are differentiated.

b. data will not be deleted before that date

During the audit of a database server, which of the following would be considered the GREATEST exposure? a. The password on the administrator account does not expire. b. Default global security settings for the database remain unchanged. c. Old data have not been purged. d. Database activity is not fully logged.

b. default global security settings for the database remain unchanged Default security settings for the database could allow issues such as blank user passwords or passwords that were the same as the username.

An IS auditor discovers that some hard drives disposed of by an enterprise were not sanitized in a manner that would reasonably ensure the data could not be recovered. In addition, the enterprise does not have a written policy on data disposal. The IS auditor should FIRST: a. draft an audit finding and discuss it with the auditor in charge. b. determine the sensitivity of the information on the hard drives. c. discuss with the IT manager the good practices in data disposal. d. develop an appropriate data disposal policy for the enterprise.

b. determine the sensitivity of the information on the hard drives. not as big of an issue if there isn't sensitive info on the drive - want to get more info so finding is 100% can't draft a finding yet b/c the organization doesnt have a policy

An IS auditor is performing a review of the disaster recovery hot site used by a financial institution. Which of the following would be the GREATEST concern? a. System administrators use shared accounts which never expire at the hot site. b. Disk space utilization data are not kept current. c. Physical security controls at the hot site are less robust than at the main site. d. Servers at the hot site do not have the same specifications as at the main site.

b. disk space utilization data are not kept current Not knowing how much disk space is in use and, therefore, how much is needed at the disaster recovery site could create major issues in the case of a disaster.

There are several methods of providing telecommunication continuity. The method of routing traffic through split cable or duplicate cable facilities is called: a. alternative routing. b. diverse routing. c. long-haul network diversity. d. last-mile circuit protection.

b. diverse routing This routes traffic through split-cable facilities or duplicate-cable facilities. This can be accomplished with different and/or duplicate cable sheaths. If different cable sheaths are used, the cable may be in the same conduit and, therefore, subject to the same interruptions as the cable it is backing up. The communication service subscriber can duplicate the facilities by having alternate routes, although the entrance to and from the customer premises may be in the same conduit. The subscriber can obtain diverse routing and alternate routing from the local carrier, including dual-entrance facilities. This type of access is time consuming and costly.

The GREATEST advantage of using web services for the exchange of information between two systems is: a. secure communication. b. efficient interfacing. c. enhanced documentation. d. improved performance.

b. efficient interfacing Web services facilitate the interoperable exchange of information between two systems regardless of the operating system or programming language used.

The objective of concurrency control in a database system is to: a. restrict updating of the database to authorized users. b. ensure integrity when two processes attempt to update the same data at the same time. c. prevent inadvertent or unauthorized disclosure of data in the database. d. ensure the accuracy, completeness and consistency of data.

b. ensure integrity when two processes attempt to update the same data at the same time key word - concurrency

An organization has recently installed a security patch, which crashed the production server. To minimize the probability of this occurring again, an IS auditor should: a. apply the patch according to the patch's release notes. b. ensure that a good change management process is in place. c. thoroughly test the patch before sending it to production. d. approve the patch after doing a risk assessment.

b. ensure that a good change management process is in place An IS auditor must review the change management process, including patch management procedures, and verify that the process has adequate controls and make suggestions accordingly.

Which of the following BEST mitigates the risk arising from using reciprocal agreements as a recovery alternative? a. Perform disaster recovery exercises annually. b. Ensure that partnering organizations are separated geographically. c. Regularly perform a business impact analysis. d. Select a partnering organization with similar systems.

b. ensure that the partnering organizations are separated geographically If the two partnering organizations are in close geographic proximity, this could lead to both organizations being subjected to the same environmental disaster, such as an earthquake.

During a review of a business continuity plan, an IS auditor noticed that the point at which a situation is declared to be a crisis has not been defined. The MAJOR risk associated with this is that: a. assessment of the situation may be delayed. b. execution of the disaster recovery plan could be impacted. c. notification of the teams might not occur. d. potential crisis recognition might be delayed.

b. execution of the disaster recovery plan could be impacted Execution of the business continuity and disaster recovery plans would be impacted if the organization does not know when to declare a crisis.

An organization has outsourced its help desk function. Which of the following indicators would be the BEST to include in the service level agreement? a. Overall number of users supported b. First call resolution rate c. Number of incidents reported to the help desk d. Number of agents answering the phones

b. first call resolution rate Because it is about service level (performance) indicators, the percentage of incidents solved on the first call is a good way to measure the effectiveness of the supporting organization

An IS auditor finds that database administrators (DBAs) have access to the log location on the database server and the ability to purge logs from the system. What is the BEST audit recommendation to ensure that DBA activity is effectively monitored? a. Change permissions to prevent DBAs from purging logs b. Forward database logs to a centralized log server to which the DBAs do not have access. c. Require that critical changes to the database are formally approved. d. Back up database logs to tape.

b. forward database logs to a centralized log server to which the DBAs do not have access To protect the availability and integrity of the database logs, it is most feasible to forward the database logs to a centralized log server to which the DBAs do not have access.

During a change control audit of a production system, an IS auditor finds that the change management process is not formally documented and that some migration procedures failed. What should the IS auditor do next? a. Recommend redesigning the change management process. b. Gain more assurance on the findings through root cause analysis. c. Recommend that program migration be stopped until the change process is documented. d. Document the finding and present it to management.

b. gain more assurance on the finding through a root cause analysis A change management process is critical to IT production systems. Before recommending that the organization take any other action (e.g., stopping migrations, redesigning the change management process), the IS auditor should gain assurance that the incidents reported are related to deficiencies in the change management process and not caused by some process other than change management.

An IS auditor discovers that developers have operator access to the command line of a production environment operating system. Which of the following controls would BEST mitigate the risk of undetected and unauthorized program changes to the production environment? a. Commands typed on the command line are logged. b. Hash keys are calculated periodically for programs and matched against hash keys calculated for the most recent authorized versions of the programs. c. Access to the operating system command line is granted through an access restriction tool with preapproved rights. d. Software development tools and compilers have been removed from the production environment.

b. hash keys are calculated periodically for programs and matched against hash keys calculated for the most recent authorized versions of the program The matching of hash keys over time would allow detection of changes to files.

A lower recovery time objective results in: a. higher disaster tolerance. b. higher cost. c. wider interruption windows. d. more permissive data loss.

b. higher cost Recovery time objective (RTO) is based on the acceptable down time in case of a disruption of operations. The lower the RTO, the higher the cost of recovery strategies.

An organization has implemented an online customer help desk application using a software as a service (SaaS) operating model. An IS auditor is asked to recommend the best control to monitor the service level agreement (SLA) with the SaaS vendor as it relates to availability. What is the BEST recommendation that the IS auditor can provide? a. Ask the SaaS vendor to provide a weekly report on application uptime. b. Implement an online polling tool to monitor the application and record outages. c. Log all application outages reported by users and aggregate the outage time weekly. d. Contract an independent third party to provide weekly reports on application uptime.

b. implement an online polling tool to monitor the application and record outages This is the best option for an organization to monitor the software as a service application availability. Comparing internal reports with the vendor's service level agreement (SLA) reports would ensure that the vendor's monitoring of the SLA is accurate and that all conflicts are appropriately resolved.

The database administrator suggests that database efficiency can be improved by denormalizing some tables. This would result in: a. loss of confidentiality. b. increased redundancy. c. unauthorized accesses. d. application malfunctions.

b. increased redundancy Normalization is a design or optimization process for a relational database that increases redundancy. Redundancy, which is usually considered positive when it is a question of resource availability, is negative in a database environment because it demands additional and otherwise unnecessary data handling efforts. Denormalization is sometimes advisable for functional reasons.

Which of the following BEST mitigates the risk of backup media containing irreplaceable information being lost or stolen while in transit? a. Ensure that media are encrypted. b. Maintain a duplicate copy. c. Maintain chain of custody. d. Ensure that personnel are bonded.

b. maintain a duplicate copy Sensitive data should always be fully backed up before being transmitted or moved. Backups of sensitive information should be treated with the same control considerations as the actual data. Chain of custody is an important control, but it will not mitigate a loss if a locked area is broken into and media removed or if media are lost while in an individual's custody.

Which of the following BEST helps define disaster recovery strategies? a. Annual loss expectancy and exposure factor b. Maximum tolerable downtime and data loss c. Existing server and network redundancies d. Data backup and offsite storage requirements

b. maximum tolerable downtime and data loss One of the key outcomes of the business impact analysis is the recovery time objective (RTO) and recovery point objective (RPO)—maximum tolerable downtime and data loss—that further help in identifying the recovery strategies.

Which of the following would BEST support 24/7 availability? a. daily backup b. mirroring c. offsite storage d. periodic testing

b. mirroring Mirroring of critical elements is a tool that facilitates immediate (failover) recoverability.

When an organization's disaster recovery plan has a reciprocal agreement, which of the following risk treatment approaches is being applied? a. Transfer b. Mitigation c. Avoidance d. Acceptance

b. mitigation A reciprocal agreement in which two organizations agree to provide computing resources to each other in the event of a disaster is a form of risk mitigation. This usually works well if both organizations have similar information processing facilities. Because the intended effect of reciprocal agreements is to have a functional disaster recovery plan, it is a risk mitigation strategy.

Which of the following is an appropriate test method to apply to a business continuity plan? a. Pilot b. Paper c. Unit d. System

b. paper A paper test (sometimes called a deskcheck) is appropriate for testing a business continuity plan (BCP). It is a walk-through of the entire BCP, or part of the BCP, involving major players in the BCP's execution who reason out what may happen in a particular disaster.

Which of the following tasks should be performed FIRST when preparing a disaster recovery plan? a. Develop a recovery strategy. b. Perform a business impact analysis. c. Map software systems, hardware and network components. d. Appoint recovery teams with defined personnel, roles and hierarchy.

b. perform a business impact analysis The first step in any disaster recovery plan is to perform a BIA. need to determine what needs to be recovered in priority order

Doing which of the following during peak production hours could result in unexpected downtime? a. Performing data migration or tape backup b. Performing preventive maintenance on electrical systems c. Promoting applications from development to the staging environment d. Reconfiguring a standby router in the data center

b. performing preventive maintenance on electrical systems Preventive maintenance activities should be scheduled for non-peak times of the day, and preferably during a maintenance window time period. A mishap or incident caused by a maintenance worker could result in unplanned downtime. EX: think scheduling of deloitte connect maintenance done on the weekend

Which of the following would contribute MOST to an effective business continuity plan? a. The document is circulated to all interested parties. b. Planning involves all user departments. c. The plan is approved by senior management. d. An audit is performed by an external IS auditor.

b. planning involves all user departments The involvement of user departments in the business continuity plan (BCP) is crucial for the identification of the business processing priorities and the development of an effective plan.

An organization having a number of offices across a wide geographical area has developed a disaster recovery plan. Using actual resources, which of the following is the MOST cost-effective test of the disaster recovery plan? a. Full operational test b. Preparedness test c. Paper test d. Regression test

b. preparedness test This is performed by each local office/area to test the adequacy of the preparedness of local operations for disaster recovery.

In the event of a data center disaster, which of the following would be the MOST appropriate strategy to enable a complete recovery of a critical database? a. Daily data backup to tape and storage at a remote site b. Real-time replication to a remote site c. Hard disk mirroring to a local server d. Real-time data backup to the local storage area network

b. real-time replication to a remote site With real-time replication to a remote site, data are updated simultaneously in two separate locations; therefore, a disaster in one site would not damage the information located in the remote site. This assumes that both sites were not affected by the same disaster.

An IS auditor reviewing an organization's disaster recovery plan should PRIMARILY verify that it is: a. tested every six months. b. regularly reviewed and updated. c. approved by the chief executive officer. d. communicated to every department head in the organization.

b. regularly reviewed and updated The plan should be reviewed at appropriate intervals, depending on the nature of the business and the rate of change of systems and personnel. Otherwise, it may become out of date and may no longer be effective. regular testing is needed but timing depends

The BEST method for assessing the effectiveness of a business continuity plan is to review the: a. plans and compare them to appropriate standards. b. results from previous tests. c. emergency procedures and employee training. d. offsite storage and environmental controls.

b. results from previous tests

An IS auditor can verify that an organization's business continuity plan (BCP) is effective by reviewing the: a. alignment of the BCP with industry good practices. b. results of business continuity tests performed by IS and end-user personnel. c. offsite facility, its contents, security and environmental controls. d. annual financial cost of the BCP activities versus the expected benefit of the implementation of the plan.

b. results of business continuity tests performed by IS and end-user personnel The effectiveness of the business continuity plan (BCP) can best be evaluated by reviewing the results from previous business continuity tests for thoroughness and accuracy in accomplishing their stated objectives.

Which of the following processes will be MOST effective in reducing the risk that unauthorized software on a backup server is distributed to the production server? a. Manually copy files to accomplish replication. b. Review changes in the software version control system. c. Ensure that developers do not have access to the backup server. d. Review the access control log of the backup server.

b. review changes in the software version control system It is common practice for software changes to be tracked and controlled using version control software. An IS auditor should review reports or logs from this system to identify the software that is promoted to production. Only moving the versions on the version control system program will prevent the transfer of development or earlier versions.

An IS auditor discovers that the disaster recovery plan (DRP) for a company does not include a critical application hosted in the cloud. Management's response states that the cloud vendor is responsible for disaster recovery (DR) and DR-related testing. What is the NEXT course of action for the IS auditor to pursue? a. Plan an audit of the cloud vendor. b. Review the vendor contract to determine its DR capabilities. c. Review an independent auditor's report of the cloud vendor. d. Request a copy of the DRP from the cloud vendor.

b. review the vendor contract to determine it's DR capabilities. you must review the contract to ensure it explicitly states in the contract with well defined recovery time objectives w/o contractual language the vendor is not required to provide DR services SOC report is wrong b/c DR capabilities can be reviewed to ascertain the vendor's DR capabilities; however, this will only be fruitful if the vendor is contractually required to provide DR services.

A programmer maliciously modified a production program to change data and then restored it back to the original code. Which of the following would MOST effectively detect the malicious activity? a. Comparing source code b. Reviewing system log files c. Comparing object code d. Reviewing executable and source code integrity

b. reviewing system log files This is the only trail that may provide information about the unauthorized activities in the production library.

An IS auditor discovers that some users have installed personal software on their PCs. This is not explicitly forbidden by the security policy. Of the following, the BEST approach for an IS auditor is to recommend that the: a. IT department implement control mechanisms to prevent unauthorized software installation. b. security policy be updated to include the specific language regarding unauthorized software. c. IT department prohibit the download of unauthorized software. d. users obtain approval from an IS manager before installing nonstandard software.

b. security policy be updated to include the specific language regrading unauthorized software Lack of specific language addressing unauthorized software in the acceptable use policy is a weakness in administrative controls. The policy should be reviewed and updated to address the issue—and provide authority for the IT department to implement technical controls. The IT department cannot implement controls in the absence of the authority provided through policy.

Which of the following controls would provide the GREATEST assurance of database integrity? a. Audit log procedures b. Table link/reference checks c. Query/table access time checks d. Rollback and rollforward database features

b. table link/reference checks Performing table link/reference checks serves to detect table linking errors (such as completeness and accuracy of the contents of the database), and thus provides the greatest assurance of database integrity.

Code erroneously excluded from a production release was subsequently moved into the production environment, bypassing normal change procedures. Which of the following choices is of MOST concern to the IS auditor performing a postimplementation review? a. The code was missed during the initial implementation. b. The change did not have change management approval. c. The error was discovered during the postimplementation review. d. The release team used the same change order number.

b. the change did not have change management approval Change management approval of changes mitigates the risk of unauthorized changes being introduced to the production environment. Unauthorized changes might result in disruption of systems or fraud. It is, therefore, imperative to ensure that each change has appropriate change management approval.

During fieldwork, an IS auditor experienced a system crash caused by a security patch installation. To provide reasonable assurance that this event will not recur, the IS auditor should ensure that: a. only systems administrators perform the patch process. b. the client's change management process is adequate. c. patches are validated using parallel testing in production. d. an approval process of the patch, including a risk assessment, is developed.

b. the client's change management process is adequate The change management process, which would include procedures regarding implementing changes during production hours, helps to ensure that this type of event does not recur. An IS auditor should review the change management process, including patch management procedures, to verify that the process has adequate controls and to make suggestions accordingly.

Integrating the business continuity plan into IT project management aids in: a. the testing of the business continuity requirements. b. the development of a more comprehensive set of requirements. c. the development of a transaction flowchart. d. ensuring the application meets the user's needs.

b. the development of a more comprehensive set of requirements. Integrating the business continuity plan (BCP) into the development process ensures complete coverage of the requirements through each phase of the project.

A new database is being set up in an overseas location to provide information to the general public and to increase the speed at which the information is made available. The overseas database is to be housed at a data center and will be updated in real time to mirror the information stored locally. Which of the following areas of operations should be considered as having the HIGHEST risk? a. Confidentiality of the information stored in the database b. The hardware being used to run the database application c. Backups of the information in the overseas database d. Remote access to the backup database

b. the hardware being used to run the database application The business objective is to make the information available to the public in a timely manner. Because the database is physically located overseas, hardware failures that are left unfixed can reduce the availability of the system to users. confidentiality isn't a huge concern bc the information is intended for the public

During an assessment of software development practices, an IS auditor finds that open source software components were used in an application designed for a client. What is the GREATEST concern the auditor would have about the use of open source software? a. The client did not pay for the open source software components. b. The organization and client must comply with open source software license terms. c. Open source software has security vulnerabilities. d. Open source software is unreliable for commercial use.

b. the organization and client must comply with open source software license terms There are many types of open source software licenses and each has different terms and conditions. Some open source software licensing allows use of the open source software component freely but requires that the completed software product must also allow the same rights. This is known as viral licensing, and if the development organization is not careful, its products could violate licensing terms by selling the product for profit. The IS auditor should be most concerned with open source software licensing compliance to avoid unintended intellectual property risk or legal consequences.

Although management has stated otherwise, an IS auditor has reasons to believe that the organization is using software that is not licensed. In this situation, the IS auditor should FIRST: a. include the statement from management in the audit report. b. verify the software is in use through testing. c. include the item in the audit report. d. discuss the issue with senior management because it could have a negative impact on the organization.

b. verify the software is in use through testing When there is an indication that an organization might be using unlicensed software, the IS auditor should obtain sufficient evidence before including it in report.

An IS auditor observed that users are occasionally granted the authority to change system data. This elevated system access yet is required for smooth functioning of business operations. Which of the following controls would the IS auditor MOST likely recommend for long-term resolution? a. Redesign the controls related to data authorization. b. Implement additional segregation of duties controls. c. Review policy to see if a formal exception process is required. d. Implement additional logging controls.

c - review policy to see if a formal exception process is required If the users are granted access to change data in support of the business requirements, and the policy should be followed. If there is no policy for the granting of extraordinary access, then one should be designed to ensure no unauthorized changes are made.

Which of the following is the BEST reason for integrating the testing of noncritical systems in disaster recovery plans (DRPs) with business continuity plans (BCPs)? a. To ensure that DRPs are aligned to the business impact analysis. b. Infrastructure recovery personnel can be assisted by business subject matter experts. c. BCPs may assume the existence of capabilities that are not in DRPs. d. To provide business executives with knowledge of disaster recovery capabilities.

c. BCPs may assume the existence of capabilities that are not in DRPs BCPs may assume the existence of capabilities that are not part of the DRPs, such as allowing employees to work from home during the disaster; however, IT may not have made sufficient provisions for these capabilities (e.g., they cannot support a large number of employees working from home). While the noncritical systems are important, it is possible that they are not part of the DRPs. For example, an organization may use an online system that does not interface with the internal systems. If the business function using the system is a critical process, the system should be tested, and it may not be part of the DRP. Therefore, DRP and BCP testing should be integrated.

Which of the following is the BEST way to ensure that incident response activities are consistent with the requirements of business continuity? a. Draft and publish a clear practice for enterprise-level incident response. b. Establish a cross-departmental working group to share perspectives c. Develop a scenario and perform a structured walk-through. d. Develop a project plan for end-to-end testing of disaster recovery.

c. Develop a scenario and perform a structured walk-through. structured walk-through including both incident response and business continuity personnel provides the best opportunity to identify gaps or misalignments between the plans.

An IS auditor is performing an audit in the data center when the fire alarm begins sounding. The audit scope includes disaster recovery, so the auditor observes the data center staff response to the alarm. Which of the following is the MOST important action for the data center staff to complete in this scenario? a. Notify the local fire department of the alarm condition. b. Prepare to activate the fire suppression system. c. Ensure all persons in the data center are evacuated. d. Remove all backups from the data center.

c. Ensure all persons in the data center are evacuated. In an emergency, safety of life is always the first priority; therefore, the complete and orderly evacuation of the facility staff would be the most important activity.

An IS auditor is evaluating the effectiveness of the change management process in an organization. What is the MOST important control that the IS auditor should look for to ensure system availability? a. Changes are authorized by IT managers at all times. b. User acceptance testing is performed and properly documented. c. Test plans and procedures exist and are closely followed. d. Capacity planning is performed as part of each development project.

c. Test plans and procedures exist and are closely followed The most important control for ensuring system availability is to implement a sound test plan and procedures that are followed consistently.

An IS auditor is reviewing an organization's disaster recovery plan (DRP) implementation. The project was completed on time and on budget. During the review, the auditor uncovers several areas of concern. Which of the following presents the GREATEST risk? a. Testing of the DRP has not been performed. b. The disaster recovery strategy does not specify use of a hot site. c. The business impact analysis was conducted, but the results were not used. d. The disaster recovery project manager for the implementation has recently left the organization.

c. The business impact analysis was conducted, but the results were not used. The risk of not using the results of the BIA for disaster recovery planning means that the disaster recovery plan (DRP) may not be designed to recover the most critical assets in the correct order. As a result, the plan may not be adequate to allow the organization to recover from a disaster.

An IS auditor has been assigned to conduct a test that compares job run logs to computer job schedules. Which of the following observations would be of the GREATEST concern to the IS auditor? a. There are a growing number of emergency changes. b. There were instances when some jobs were not completed on time. c. There were instances when some jobs were overridden by computer operators. d. Evidence shows that only scheduled jobs were run.

c. There were instances when some jobs were overridden by computer operators. The overriding of computer processing jobs by computer operators could lead to unauthorized changes to data or programs. This is a control concern; thus, it is always critical.

An IS auditor reviewing database controls discovered that changes to the database during normal working hours were handled through a standard set of procedures. However, changes made after normal hours required only an abbreviated number of steps. In this situation, which of the following would be considered an adequate set of compensating controls? a. Allow changes to be made only with the database administrator (DBA) user account. b. Make changes to the database after granting access to a normal user account. c. Use the DBA user account to make changes, log the changes and review the change log the following day. d. Use the normal user account to make changes, log the changes and review the change log the following day.

c. Use the DBA user account to make changes, log the changes and review the change log the following day. The use of a DBA user account is normally set up to log all changes made and is most appropriate for changes made outside of normal hours. The use of a log, which records the changes, allows changes to be reviewed. Because an abbreviated number of steps are used, this represents an adequate set of compensating controls.

Which of the following recovery strategies is MOST appropriate for a business having multiple offices within a region and a limited recovery budget? a. A hot site maintained by the business b. A commercial cold site c. A reciprocal arrangement between its offices d. A third-party hot site

c. a reciprocal arrangement between its offices For a business having many offices within a region, a reciprocal arrangement among its offices would be most appropriate. Each office could be designated as a recovery site for some other office. This would be the least expensive approach and would provide an acceptable level of confidence.

An IS auditor is conducting a review of the disaster recovery procedures for a data center. Which of the following indicators BEST shows that the procedures meet the requirements? a. Documented procedures were approved by management. b. Procedures were reviewed and compared with industry good practices. c. A tabletop exercise using the procedures was conducted. d. Recovery teams and their responsibilities are documented.

c. a tabletop exercise using the procedures was conducted Conducting a tabletop exercise (paper-based test) of the procedures with all responsible members, best ensures that the procedures meet the requirements. This type of test can identify missing or incorrect procedures because representatives responsible for performing the tasks are present.

A financial institution that processes millions of transactions each day has a central communications processor (switch) for connecting to automated teller machines. Which of the following would be the BEST contingency plan for the communications processor? a. Reciprocal agreement with another organization b. Alternate processor in the same location c. Alternate processor at another network node d. Duplex communication links

c. alternate processor at another network node

An IS auditor needs to review the procedures used to restore a software application to its state prior to an upgrade. Therefore, the auditor needs to assess: a. problem management procedures. b. software development procedures. c. backout procedures. d. incident management procedures.

c. backout procedures These are used to restore a system to a previous state and are an important element of the change control process. The other choices are not related to the change control process—a process which specifies what procedures should be followed when software is being upgraded but the upgrade does not work and requires a fallback to its former state.

In determining the acceptable time period for the resumption of critical business processes: a. only downtime costs need to be considered. b. recovery operations should be analyzed. c. both downtime costs and recovery costs need to be evaluated. d. indirect downtime costs should be ignored.

c. both downtime costs and recovery costs need to be evaluated

For effective implementation after a business continuity plan (BCP) has been developed, it is MOST important that the BCP be: a. stored in a secure, offsite facility. b. approved by senior management c. communicated to appropriate personnel. d. made available through the enterprise's intranet.

c. communicated to appropriate personnel

While auditing an e-commerce architecture, an IS auditor notes that customer master data are stored on the web server for six months after the transaction date and then purged due to inactivity. Which of the following should be the PRIMARY concern for the IS auditor? a. Availability of customer data b. Integrity of customer data c. Confidentiality of customer data d. System storage performance

c. confidentiality of customer data Due to its exposure to the Internet, storing customer data for six months raises concerns regarding confidentiality of customer data.

During a human resources (HR) audit, an IS auditor is informed that there is a verbal agreement between the IT and HR departments as to the level of IT services expected. In this situation, what should the IS auditor do FIRST? a. Postpone the audit until the agreement is documented. b. Report the existence of the undocumented agreement to senior management. c. Confirm the content of the agreement with both departments. d. Draft a service level agreement for the two departments.

c. confirm the content of the agreement with both departments An IS auditor should first confirm and understand the current practice before making any recommendations. Part of this will be to ensure that both parties agree with the terms of the agreement. Reporting to senior management is not necessary at this stage of the audit because this is not a serious immediate vulnerability.

Which of the following should an incident response team address FIRST after a major incident in an information processing facility? a. Restoration at the facility b. Documentation of the facility c. Containment at the facility d. Monitoring of the facility

c. containment at the facility The first priority (after addressing life safety) is the containment of the incident at the facility so that spread of the damage is minimized. The incident team must gain control of the situation.

Which of the following backup techniques is the MOST appropriate when an organization requires extremely granular data restore points, as defined in the recovery point objective? a. Virtual tape libraries b. Disk-based snapshots c. Continuous data backup d. Disk-to-tape backup

c. continuous data backup Recovery point objective (RPO) is based on the acceptable data loss in the case of a disruption. In this scenario the organization needs a short RPO and continuous data backup is the best option.

As part of the business continuity planning process, which of the following should be identified FIRST in the business impact analysis? a. Risk such as single point-of-failure and infrastructure risk b. Threats to critical business processes c. Critical business processes for ascertaining the priority for recovery d. Resources required for resumption of business

c. critical business processes for ascertaining the priority for recovery The identification of critical business processes should be addressed first so that the priorities and time lines for recovery can be documented.

An IS auditor notes that patches for the operating system used by an organization are deployed by the IT department as advised by the vendor. The MOST significant concern an IS auditor should have with this practice is that IT has NOT considered: a. the training needs for users after applying the patch. b. any beneficial impact of the patch on the operational systems. c. delaying deployment until testing the impact of the patch. d. the necessity of advising end users of new patches.

c. delaying deployment until testing the impact of the patch Deploying patches without testing exposes an organization to the risk of system disruption or failure.

After completing the business impact analysis, what is the NEXT step in the business continuity planning process? a. Test and maintain the plan. b. Develop a specific plan. c. Develop recovery strategies. d. Implement the plan.

c. develop recovery strategies Once the business impact analysis (BIA) is completed, the next phase in the business continuity plan (BCP) development is to identify the various recovery strategies and select the most appropriate strategy for recovering from a disaster that will meet the time lines and priorities defined through the BIA. after selecting a strategy, a specific BCP can be developed, tested and implemented.

The PRIMARY purpose of implementing Redundant Array of Inexpensive Disks level 1 in a file server is to: a. achieve performance improvement. b. provide user authentication. c. ensure availability of data. d. ensure the confidentiality of data.

c. ensure availability of data Redundant Array of Inexpensive Disks (RAID) level 1 provides disk mirroring. Data written to one disk are also written to another disk. Users in the network access data in the first disk; if disk one fails, the second disk takes over. This redundancy ensures the availability of data.

The PRIMARY benefit of an IT manager monitoring technical capacity is to: a. identify the need for new hardware and storage procurement. b. determine the future capacity need based on usage. c. ensure that the service level requirements are met. d. ensure that systems operate at optimal capacity.

c. ensure that the service level requirements are met. Capacity monitoring has multiple objectives; however, the primary objective is to ensure compliance with the internal service level agreement between the business and IT.

The MAIN purpose for periodically testing offsite disaster recovery facilities is to: a. protect the integrity of the data in the database. b. eliminate the need to develop detailed contingency plans. c. ensure the continued compatibility of the contingency facilities. d. ensure that program and system documentation remains current

c. ensure the continued compatibility of the contingency facilities The main purpose of offsite hardware testing is to ensure the continued compatibility of the contingency facilities so that assurance can be gained that the contingency plans would work in an actual disaster.

The BEST audit procedure to determine if unauthorized changes have been made to production code is to: a. examine the change control system records and trace them forward to object code files. b. review access control permissions operating within the production program libraries. c. examine object code to find instances of changes and trace them back to change control records. d. review change approved designations established within the change control system.

c. examine object code to find instances of changes and trace them back to change control records The procedure of examining object code files to establish instances of code changes and tracing these back to change control system records is a substantive test that directly addresses the risk of unauthorized code changes.

The FIRST step in the execution of a problem management mechanism should be: a. issue analysis. b. exception ranking. c. exception reporting. d. root cause analysis.

c. exception reporting The reporting of operational issues is normally the first step in tracking problems.

Which of the following is MOST important to determine the recovery point objective for a critical process in an enterprise? a. Number of hours of acceptable downtime b. Total cost of recovering critical systems c. Extent of data loss that is acceptable d. Acceptable reduction in the level of service

c. extent of data loss that is acceptable The recovery point objective (RPO) is determined based on the acceptable data loss in case of a disruption of operations. It indicates the earliest point in time that is acceptable to recover the data. The RPO effectively quantifies the permissible amount of data loss in case of interruption.

Data flow diagrams are used by IS auditors to: a. identify key controls. b. highlight high-level data definitions. c. graphically summarize data paths and storage. d. portray step-by-step details of data generation.

c. graphically summarize data paths and storage

Which of the following would be MOST important for an IS auditor to verify while conducting a business continuity audit? a. Data backups are performed on a timely basis. b. A recovery site is contracted for and available as needed. c. Human safety procedures are in place. d. Insurance coverage is adequate and premiums are current.

c. human safety procedures are in place The most important element in any business continuity process is the protection of human life. This takes precedence over all other aspects of the plan.

When reviewing the desktop software compliance of an organization, the IS auditor should be MOST concerned if the installed software: a. was installed, but not documented in the IT department records. b. was being used by users not properly trained in its use. c. is not listed in the approved software standards document. d. license will expire in the next 15 days.

c. it is not listed in the approved software standards document The installation of software that is not allowed by policy is a serious violation and could put the organization at security, legal and financial risk. Any software that is allowed should be part of a standard software list. This is the first thing to review because this would also indicate compliance with policies.

In a contract with a hot, warm or cold site, contractual provisions should PRIMARILY cover which of the following considerations? a. Physical security measures b. Total number of subscribers c. Number of subscribers permitted to use a site at one time d. References by other users

c. number of subscribers permitted to use a site at one time The contract should specify the number of subscribers permitted to use the site at any one time. The contract can be written to give preference to certain subscribers.

Responsibility and reporting lines cannot always be established when auditing automated systems because: a. diversified control makes ownership irrelevant. b. staff traditionally changes jobs with greater frequency. c. ownership is difficult to establish where resources are shared. d. duties change frequently in the rapid development of technology.

c. ownership is difficult to establish where resources are shared The actual data and/or application owner may be hard to establish because of the complex nature of both data and application systems and many systems support more than one business department.

An IS auditor examining the security configuration of an operating system should review the: a. transaction logs. b. authorization tables. c. parameter settings

c. parameter settings ex: think windows passwords - we look at parameters of the OS Configuration parameters allow a standard piece of software to be customized for diverse environments and are important in determining how a system runs the parameter settings should be appropriate to an organization's workload and control environment. Improper implementation and/or monitoring of operating systems can result in undetected errors and corruption of the data being processed, as well as lead to unauthorized access and inaccurate logging of system usage.

Which of the following is the MOST effective when determining the correctness of individual account balances migrated from one database to another? a. Compare the hash total before and after the migration. b. Verify that the number of records is the same for both databases. c. Perform sample testing of the migrated account balances. d. Compare the control totals of all of the transactions.

c. perform sample testing of the migrated account balances This will involve the comparison of a selection of individual transactions from the database before and after the migration.

During the review of an enterprise's preventive maintenance process for systems at a data center, the IS auditor has determined that adequate maintenance is being performed on all critical computing, power and cooling systems. Additionally, it is MOST important for the IS auditor to ensure that the organization: a. has performed background checks on all service personnel. b. escorts service personnel at all times when performing their work. c. performs maintenance during noncritical processing times. d. independently verifies that maintenance is being performed.

c. performs maintenance during noncritical processing times The biggest risk to normal operations in a data center would be if an incident or mishap were to happen during critical peak processing times; therefore, it would be prudent to ensure that no type of system maintenance be performed at these critical times.

Which of the following is a continuity plan test that simulates a system crash and uses actual resources to cost-effectively obtain evidence about the plan's effectiveness? a. Paper test b. Posttest c. Preparedness test d. Walk-through

c. preparedness test This is a localized version of a full test, wherein resources are expended in the simulation of a system crash. This test is performed regularly on different aspects of the plan and can be a cost-effective way to gradually obtain evidence about the plan's effectiveness. It also provides a means to improve the plan in increments.

While reviewing the process for continuous monitoring of the capacity and performance of IT resources, an IS auditor should PRIMARILY ensure that the process is focused on: a. adequately monitoring service levels of IT resources and services. b. providing data to enable timely planning for capacity and performance requirements. c. providing accurate feedback on IT resource capacity. d. properly forecasting performance, capacity and throughput of IT resources.

c. providing accurate feedback on IT resource capacity Accurate capacity monitoring of IT resources would be the most critical element of a continuous monitoring process.

To address an organization's disaster recovery requirements, backup intervals should not exceed the: a. maximum acceptable outage. b. recovery time objective. c. recovery point objective. d. service level objective.

c. recovery point objective This defines the point in time to which data must be restored after a disaster to resume processing transactions. Backups should be performed in a way that the latest backup is no older than this maximum time frame. If the backups are not done frequently enough, then too many data are likely to be lost

During the design of a business continuity plan, the business impact analysis identifies critical processes and supporting applications. This will PRIMARILY influence the: a. responsibility for maintaining the business continuity plan. b. criteria for selecting a recovery site provider. c. recovery strategy. d. responsibilities of key personnel.

c. recovery strategy The most appropriate strategy is selected based on the relative risk level, time lines and criticality identified in the business impact analysis.

Recovery procedures for an information processing facility are BEST based on: a. recovery time objective. b. recovery point objective. c. maximum tolerable outage. d. information security policy.

c. recovery time objective This is the amount of time allowed for the recovery of a business function or resource after a disaster occurs; the RTO is the desired recovery time frame based on maximum tolerable outage (MTO) and available recovery alternatives.

Which of the following is the BEST indicator of the effectiveness of backup and restore procedures while restoring data after a disaster? a. Members of the recovery team were available. b. Recovery time objectives were met. c. Inventory of backup tapes was properly maintained. d. Backup tapes were completely restored at an alternate site.

c. recovery time objectives were met The effectiveness of backup and restore procedures is best ensured RTOs being met because these are the requirements that are critically defined during the business impact analysis stage, with the inputs and involvement of all business process owners.

While observing a full simulation of the business continuity plan, an IS auditor notices that the notification systems within the organizational facilities could be severely impacted by infrastructure damage. The BEST recommendation the IS auditor can provide to the organization is to ensure: a. the salvage team is trained to use the notification system. b. the notification system provides for the recovery of the backup. c. redundancies are built into the notification system. d. the notification systems are stored in a vault.

c. redundancies are built into the notification system If the notification system has been severely impacted by the damage, redundancy would be the best control.

IT management has decided to install a level 1 Redundant Array of Inexpensive Disks (RAID) system in all servers to compensate for the elimination of offsite backups. The IS auditor should recommend: a. upgrading to a level 5 RAID. b. increasing the frequency of onsite backups. c. reinstating the offsite backups. d. establishing a cold site in a secure location.

c. reinstating the offsite backups. A Redundant Array of Inexpensive Disks (RAID) system, at any level, will not protect against a natural disaster. The problem will not be alleviated without offsite backups.

Which of the following is a MAJOR concern during a review of help desk activities? a. Certain calls could not be resolved by the help desk team. b. A dedicated line is not assigned to the help desk team. c. Resolved incidents are closed without reference to end users. d. The help desk instant messaging has been down for over six months.

c. resolved incidents are closed without reference to end users The help desk function is a service-oriented unit. The end users must be advised before an incident can be regarded as closed.

While reviewing the IT infrastructure, an IS auditor notices that storage resources are continuously being added. The IS auditor should: a. recommend the use of disk mirroring. b. review the adequacy of offsite storage. c. review the capacity management process. d. recommend the use of a compression algorithm.

c. review the capacity management process Capacity management is the planning and monitoring of computer resources to ensure that available IT resources are used efficiently and effectively. This will look at capacity from a strategic viewpoint and allow a plan to forecast and purchase additional equipment in a planned manner.

An IS auditor is assessing services provided by an Internet service provider (ISP) during an IS compliance audit of a nationwide corporation that operates a governmental program. Which of the following is MOST important? a. Review the request for proposal. b. Review monthly performance reports generated by the ISP. c. Review the service level agreement. d. Research other clients of the ISP.

c. review the service level agreement A service level agreement provides the basis for an adequate assessment of the degree to which the provider is meeting the level of agreed-on service.

Which of the following issues should be a MAJOR concern to an IS auditor who is reviewing a service level agreement (SLA)? a. A service adjustment resulting from an exception report took a day to implement. b. The complexity of application logs used for service monitoring made the review difficult. c. Service measures were not included in the SLA. d. The document is updated on an annual basis.

c. service measures were not included in the SLA can't measure effectiveness/efficiency with no service measures

To verify that the correct version of a data file was used for a production run, an IS auditor should review: a. operator problem reports. b. operator work schedules. c. system logs. d. output distribution reports.

c. system logs

Which of the following should be a MAJOR concern for an IS auditor reviewing a business continuity plan? a. The plan is approved by the chief information officer. b. The plan contact lists have not been updated. c. Test results are not adequately documented. d. The training schedule for recovery personnel is not included.

c. test results are not adequately documented The effectiveness of a business continuity plan (BCP) can best be determined through tests. If results of tests are not documented, then there is no basis for feedback, updates, etc.

To ensure structured disaster recovery, it is MOST important that the business continuity plan and disaster recovery plan are: a. stored at an alternate location. b. communicated to all users. c. tested regularly. d. updated regularly.

c. tested regularly. If the business continuity plan (BCP) is tested regularly, the BCP and disaster recovery plan team is adequately aware of the process and that helps in structured disaster recovery.

To optimize an organization's business continuity plan, an IS auditor should recommend a business impact analysis to determine: a. the business processes that generate the most financial value for the organization and, therefore, must be recovered first. b. the priorities and order for recovery to ensure alignment with the organization's business strategy. c. the business processes that must be recovered following a disaster to ensure the organization's survival. d. the priorities and order of recovery, which will recover the greatest number of systems in the shortest time frame.

c. the business processes that must be recovered following a disaster to ensure the organization's survival To ensure the organization's survival following a disaster, it is important to recover the most critical business processes first.

During an audit of a small company that provides medical transcription services, an IS auditor observes several issues related to the backup and restore process. Which of the following should be the auditor's GREATEST concern? a. Restoration testing for backup media is not performed; however, all data restore requests have been successful. b. The policy for data backup and retention has not been reviewed by the business owner for the past three years. c. The company stores transcription backup tapes offsite using a third-party service provider, which inventories backup tapes annually. d. Failed backup alerts for the marketing department data files are not followed up on or resolved by the IT administrator.

c. the company stores transcription backup tapes offsite using a third=party service provider, which inventories backup tapes annually For a company working with confidential patient data, the loss of a backup tape is a significant incident. Privacy laws specify severe penalties for such an event, and the company's reputation could be damaged due to mandated reporting requirements. To gain assurance that tapes are being handled properly, the organization should perform audit tests that include frequent physical inventories and an evaluation of the controls in place at the third-party provider.

An IS auditor reviewing the application change management process for a large multinational company should be MOST concerned when: a. test systems run different configurations than do production systems. b. change management records are paper based. c. the configuration management database is not maintained. d. the test environment is installed on the production server.

c. the configuration management database is not maintained The configuration management database (CMDB) is used to track configuration items (CIs) and the dependencies between them. An out-of-date CMDB in a large multinational company could result in incorrect approvals being obtained or leave out critical dependencies during the test phase. As long as the test and production environments are kept separate, they can be installed on the same physical server(s).

An organization is considering using a new IT service provider. From an audit perspective, which of the following would be the MOST important item to review? a. References from other clients for the service provider b. The physical security of the service provider site c. The proposed service level agreement with the service provider d. Background checks of the service provider's employees

c. the proposed service level agreement with the service provider When contracting with a service provider, it is a good practice to enter into an SLA with the provider. An SLA is a guarantee that the provider will deliver the services according to the contract. The IS auditor will want to ensure that performance and security requirements are clearly stated in the SLA.

In which of the following situations is it MOST appropriate to implement data mirroring as the recovery strategy? a. Disaster tolerance is high. b. The recovery time objective is high. c. The recovery point objective is low. d. The recovery point objective is high.

c. the recovery point objective is low The RPO indicates the latest point in time at which it is possible to recover the data. This determines how often the data must be backed up to minimize data loss. If the RPO is low, then the organization does not want to lose much data and must use a process such as data mirroring to prevent data loss.

Which of the following must exist to ensure the viability of a duplicate information processing facility? a. The site is near the primary site to ensure quick and efficient recovery. b. The site contains the most advanced hardware available. c. The workload of the primary site is monitored to ensure adequate backup is available. d. The hardware is tested when it is installed to ensure it is working properly.

c. the workload of the primary site is monitored to ensure adequate backup is available Resource availability must be assured. The workload of the primary site must be monitored to ensure that availability at the alternate site for emergency backup use is sufficient.

Which of the following is the MOST likely reason an organization implements an emergency change to an application using the emergency change control process? a. The application owner requested new functionality. b. Changes are developed using an agile methodology. c. There is a high probability of a significant impact on operations. d. The operating system vendor has released a security patch.

c. there is a high probability of a significant impacts on operations Emergency releases to an application are fixes that require implementation as quickly as possible to prevent significant user downtime. Emergency release procedures are followed in such situations.

It is MOST appropriate to implement an incremental backup scheme when: a. there is limited recovery time for critical data. b. online disk-based media are preferred. c. there is limited media capacity. d. a random selection of backup sets is required.

c. there is limited media capacity In an incremental backup, after the full backup, only the files that have changed are backed up, thus minimizing media storage. this is backing up a backup

Which of the following is the PRIMARY objective of the business continuity plan process? a. To provide assurance to stakeholders that business operations will continue in the event of disaster b. To establish an alternate site for IT services to meet predefined recovery time objectives c. To manage risk while recovering from an event that adversely affected operations d. To meet the regulatory compliance requirements in the event of natural disaster

c. to manage risk while recovering from an event that adversely affected operations The business continuity plan (BCP) process primarily focuses on managing and mitigating risk during recovery of operations due to an event that affected operations.

An IS auditor is reviewing the change management process for an enterprise resource planning application. Which of the following is the BEST method for testing program changes? a. Select a sample of change tickets and review them for authorization. b. Perform a walk-through by tracing a program change from start to finish. c. Trace a sample of modified programs to supporting change tickets. d. Use query software to analyze all change tickets for missing fields.

c. trace a sample of modified programs to supporting change tickets This is the best way to test change management controls. This method is most likely to identify instances in which a change was made without supporting documentation.

During the review of data file change management controls, which of the following BEST helps to decrease the research time needed to investigate exceptions? a. One-for-one checking b. Data file security c. Transaction logs d. File updating and maintenance authorization

c. transaction logs These generate an audit trail by providing a detailed list of date of input, time of input, user ID, terminal location, etc. Research time can be reduced in investigating exceptions because the review can be performed on the logs rather than on the entire transaction file. It also helps to determine which transactions have been posted to an account—by a particular individual during a particular period.

An IS auditor finds that the data warehouse query performance decreases significantly at certain times of the day. Which of the following controls would be MOST relevant for the IS auditor to review? a. Permanent table-space allocation b. Commitment and rollback controls c. User spool and database limit controls d. Read/write access log controls

c. user spool and database limit controls User spool limits restrict the space available for running user queries. This prevents poorly formed queries from consuming excessive system resources and impacting general query performance. Limiting the space available to users in their own databases prevents them from building excessively large tables. This helps to control space utilization which itself acts to help performance by maintaining a buffer between the actual data volume stored and the physical device capacity. Additionally, it prevents users from consuming excessive resources in ad hoc table builds (as opposed to scheduled production loads that often can run overnight and are optimized for performance purposes). In a data warehouse, because you are not running online transactions, commitment and rollback does not have an impact on performance.

A large chain of shops with electronic funds transfer at point-of-sale devices has a central communications processor for connecting to the banking network. Which of the following is the BEST disaster recovery plan for the communications processor? a. Offsite storage of daily backups b. Alternative standby processor onsite c. Installation of duplex communication links d. Alternative standby processor at another network node

d. Alternative standby processor at another network node The unavailability of the central communications processor would disrupt all access to the banking network, resulting in the disruption of operations for all of the shops. This could be caused by failure of equipment, power or communication

An IS auditor analyzing the audit log of a database management system finds that some transactions were partially executed as a result of an error and have not been rolled back. Which of the following transaction processing features has been violated? a. Consistency b. Isolation c. Durability d. Atomicity

d. Atomicity this guarantees that either the whole transaction is processed or none of it

Which of the following would an IS auditor consider to be the MOST important to review when conducting a disaster recovery audit? a. A hot site is contracted for and available as needed. b. A business continuity manual is available and current. c. Insurance coverage is adequate and premiums are current. d. Data backups are performed timely and stored offsite.

d. Data backups are performed timely and stored offsite. Without data to process, all other components of the recovery effort are in vain. Even in the absence of a plan, recovery efforts of any type would not be practical without data to process.

While conducting an audit on the customer relationship management application, the IS auditor observes that it takes a significantly long time for users to log on to the system during peak business hours as compared with other times of the day. Once logged on, the average response time for the system is within acceptable limits. Which of the following choices should the IS auditor recommend? a. No action should be taken because the system meets current business requirements. b. IT should increase the network bandwidth to improve performance. c. Users should be provided with detailed manuals to use the system properly. d. Establish performance measurement criteria for the authentication servers.

d. Establish performance measurement criteria for the authentication servers Performance criteria for the authentication servers would help to quantify acceptable thresholds for system performance, which can be measured and remediated.

Which of the following BEST ensures that users have uninterrupted access to a critical, heavily used web-based application? a. Disk mirroring b. Redundant Array of Inexpensive Disks c. Dynamic domain name system d. Load balancing

d. Load balancing This best ensures uninterrupted system availability by distributing traffic across multiple servers. Load balancing helps ensure consistent response time for web applications. Also, if a web server fails, load balancing ensures that traffic will be directed to a different, functional server.

Which of the following is the MOST efficient and sufficiently reliable way to test the design effectiveness of a change control process? a. Test a sample population of change requests b. Test a sample of authorized changes c. Interview personnel in charge of the change control process d. Perform an end-to-end walk-through of the process

d. Perform an end-to-end walk-through of the process The question asks about design

Which of the following is the BEST method to ensure that critical IT system failures do not recur? a. Invest in redundant systems. b. Conduct a follow-up audit. c. Monitor system performance. d. Perform root cause analysis.

d. Perform root cause analysis.

Which of the following is a network diagnostic tool that monitors and records network information? a. Online monitor b. Downtime report c. Help desk report d. Protocol analyzer

d. Protocol analyzer These are network diagnostic tools that monitor and record network information from packets traveling in the link to which the analyzer is attached.

Which of the following should be of MOST concern to an IS auditor reviewing the business continuity plan (BCP)? a. The disaster levels are based on scopes of damaged functions but not on duration. b. The difference between low-level disaster and software incidents is not clear. c. The overall BCP is documented, but detailed recovery steps are not specified. d. The responsibility for declaring a disaster is not identified.

d. The responsibility for declaring a disaster is not identified. If nobody declares the disaster, the BCP would not be invoked, making all other concerns less important.

Which of the following ensures the availability of transactions in the event of a disaster? a. Send tapes hourly containing transactions offsite b. Send tapes daily containing transactions offsite. c. Capture transactions to multiple storage devices. d. Transmit transactions offsite in real time.

d. Transmit transactions offsite in real time.

Which of the following distinguishes a business impact analysis from a risk assessment? a. An inventory of critical assets b. An identification of vulnerabilities c. A listing of threats d. A determination of acceptable downtime

d. a determination of acceptable downtime A determination of acceptable downtime correct. This is made only in a business impact analysis (BIA).

A database administrator has detected a performance problem with some tables, which could be solved through denormalization. This situation will increase the risk of: a. concurrent access. b. deadlocks. c. unauthorized access to data. d. a loss of data integrity.

d. a loss of data integrity. think about what the database owner knows about (DATA)

Which of the following security measures BEST ensures the integrity of information stored in a data warehouse? a. Validated daily backups b. Change management procedures c. Data dictionary maintenance d. A read-only restriction

d. a read-only restriction Because most data in a data warehouse are historic and do not need to be changed, applying read-only restrictions prevents data manipulation. Backups address availability, not integrity. Validated backups ensure that the backup will work when needed.

A company with a limited budget has a recovery time objective of 72 hours and a recovery point objective of 24 hours. Which of the following would BEST meet the requirements of the business? a. A hot site b. A cold site c. A mirrored site d. A warm site

d. a warm site This is the most appropriate solution because it provides basic infrastructure and most of the required IT equipment to affordably meet the business requirements. The remainder of the equipment needed can be provided through vendor agreements within a few days. The recovery time objective (RTO) is the amount of time allowed for the recovery of a business function or resource after a disaster occurs. The recovery point objective (RPO) is determined based on the acceptable data loss in case of a disruption of operations. The RPO indicates the earliest point in time that is acceptable to recover the data, and it effectively quantifies the permissible amount of data loss in case of interruption.

While performing a review of a critical third-party application, an IS auditor would be MOST concerned with discovering: a. inadequate procedures for ensuring adequate system portability. b. inadequate operational documentation for the system. c. an inadequate alternate service provider listing. d. an inadequate software escrow agreement.

d. an inadequate software escrow agreement The inclusion of a clause in the agreement that requires software code to be placed in escrow helps to ensure that the customer can continue to use the software and/or obtain technical support if a vendor were to go out of business.

An IS auditor is auditing an IT disaster recovery plan. The IS auditor should PRIMARILY ensure that the plan covers: a. a resilient IT infrastructure. b. alternate site information. c. documented disaster recovery test results. d. analysis and prioritization of business functions.

d. analysis and prioritization of business functions The disaster recovery plan (DRP) must primarily focus on recovering critical business functions in the event of disaster within predefined recovery time objectives (RTOs); thus, it is necessary to align the recovery of IT services based on the criticality of business functions.

An IS auditor determined that the IT manager recently changed the vendor that is responsible for performing maintenance on critical computer systems to cut costs. While the new vendor is less expensive, the new maintenance contract specifies a change in incident resolution time specified by the original vendor. Which of the following should be the GREATEST concern to the IS auditor? a. Disaster recovery plans may be invalid and need to be revised. b. Transactional business data may be lost in the event of system failure. c. The new maintenance vendor is not familiar with the organization's policies. d. Application owners were not informed of the change.

d. application owners were not informed of the change The greatest risk of making a change to the maintenance of critical systems is that the change could have an adverse impact on a critical business process. While there is a benefit in selecting a less expensive maintenance vendor, the resolution time must be aligned with the needs of the business.

An IS auditor has discovered that a new patch is available for an application, but the IT department has decided that the patch is not needed because other security controls are in place. What should the IS auditor recommend? a. Apply the patch only after it has been thoroughly tested. b. Implement a host-based intrusion detection system. c. Modify the firewall rules to further protect the application server. d. Assess the overall risk, then recommend whether to deploy the patch.

d. assess the overall risk, then recommend whether to deploy the patch

Which of the following is the MOST reasonable option for recovering a non-critical system? a. Warm site b. Mobile site c. Hot site d. Cold site

d. cold site Generally, a cold site is contracted for a longer period at a lower cost. Because it requires more time to make a cold site operational, it is generally used for noncritical applications.

Which of the following database controls would ensure that the integrity of transactions is maintained in an online transaction processing system's database? a. Authentication controls b. Data normalization controls c. Read/write access log controls d. Commitment and rollback controls

d. commitment and rollback controls These are directly relevant to integrity. These controls ensure that database operations that form a logical transaction unit will be completed entirely or not at all (i.e., if, for some reason, a transaction cannot be fully completed, then incomplete inserts/updates/deletes are rolled back so that the database returns to its pretransition state).

Which of the following processes should an IS auditor recommend to assist in the recording of baselines for software releases? a. Change management b. Backup and recovery c. Incident management d. Configuration management

d. configuration management The configuration management process may include automated tools that will provide an automated recording of software release baselines. Should the new release fail, the baseline will provide a point to which to return. change management is not correct b/c This is important to control changes to the configuration, but the baseline itself refers to a standard configuration.

During a disaster recovery test, an IS auditor observes that the performance of the disaster recovery site's server is slow. To find the root cause of this, the IS auditor should FIRST review the: a. event error log generated at the disaster recovery site. b. disaster recovery test plan. c. disaster recovery plan. d. configurations and alignment of the primary and disaster recovery sites.

d. configurations and alignment of the primary and disaster recovery sites Because the configuration of the system is the most probable cause, the IS auditor should review that first.

Which of the following controls would be MOST effective in ensuring that production source code and object code are synchronized? a. Release-to-release source and object comparison reports b. Library control software restricting changes to source code c. Restricted access to source code and object code d. Date and time-stamp reviews of source and object code

d. data and time-stamp reviews of source and object code This would ensure that source code, which has been compiled, matches the production object code. This is the most effective way to ensure that the approved production source code is compiled and is the one being used. Source code is generally understood to mean programming statements that are created by a programmer with a text editor or a visual programming tool and then saved in a file. Object code generally refers to the output, a compiled file, which is produced when the Source Code is compiled with a C compiler.

Online banking transactions are being posted to the database when processing suddenly comes to a halt. The integrity of the transaction processing is BEST ensured by: a. database integrity checks. b. validation checks. c. input controls. d. database commits and rollbacks.

d. database commits and rollbacks These ensure that the data are saved after the transaction processing is completed. Rollback ensures that the processing that has been partially completed as part of the transaction is reversed back and not saved if the entire transaction does not complete successfully.

Which of the following is the MOST effective method for disposing of magnetic media that contains confidential information? a. Degaussing b. Defragmenting c. Erasing d. Destroying

d. destroying Destroying magnetic media is the only way to assure that confidential information cannot be recovered.

A hard disk containing confidential data was damaged beyond repair. If the goal is to positively prevent access to the data by anyone else, what should be done to the hard disk before it is discarded? a. Overwriting b. Low-level formatting c. Degaussing d. Destruction

d. destruction Physically destroying the hard disk is the most effective way to ensure that data cannot be recovered.

The MAIN criterion for determining the severity level of a service disruption incident is: a. cost of recovery. b. negative public opinion. c. geographic location. d. downtime.

d. downtime The longer the period of time a client cannot be serviced, the greater the severity (impact) of the incident.

Which of the following reports is the MOST appropriate source of information for an IS auditor to validate that an Internet service provider (ISP) has been complying with an enterprise service level agreement for the availability of outsourced telecommunication services? a. Downtime reports on the telecommunication services generated by the ISP b. A utilization report of automatic failover services generated by the enterprise c. A bandwidth utilization report provided by the ISP d. Downtime reports on the telecommunication services generated by the enterprise

d. downtime reports on the telecommunications services generated by the enterprise more accurate coming from enterprise not ISP he enterprise should use internally generated downtime reports to monitor the service provided by the Internet service provider (ISP) and, as available, to compare with the reports provided by the ISP.

Which of the following would BEST ensure uninterrupted operations in an organization with IT operation centers in several countries? a. Distribution of key procedural documentation b. Reciprocal agreement between business partners c. Strong senior management leadership d. Employee training on the business continuity plan

d. employee training on business continuity plan During a disaster, the chain of command might be interrupted. Therefore, it is important that employees know their roles in the BCP, including where to report and how to perform their job functions. Employee training on the plan is especially important for businesses with offices that are geographically separated because there is a greater chance of communication disruption.

An enterprise uses privileged accounts to process configuration changes for mission-critical applications. Which of the following would be the BEST and appropriate control to limit the risk in such a situation? a. Ensure that audit trails are accurate and specific. b. Ensure that personnel have adequate training. c. Ensure that personnel background checks are performed for critical personnel. d. Ensure that supervisory approval and review are performed for critical changes.

d. ensure that supervisory approval and review are performed for critical changes Supervisory approval and review of critical changes by the accountable managers in the enterprise are required to avoid and detect any unauthorized change. In addition to authorization, supervision enforces a separation of duties and prevents an unauthorized attempt by any single employee.

During an application audit, an IS auditor is asked to provide assurance of the database referential integrity. Which of the following should be reviewed? a. Field definition b. Master table definition c. Composite keys d. Foreign key structure

d. foreign key structure Referential integrity in a relational database refers to consistency between coupled (linked) tables. Referential integrity is usually enforced by the combination of a primary key or candidate key (alternate key) and a foreign key. For referential integrity to hold, any field in a table that is declared a foreign key should contain only values from a parent table's primary key or a candidate key.

A medium-sized organization, whose IT disaster recovery measures have been in place and regularly tested for years, has just developed a formal business continuity plan (BCP). A basic BCP tabletop exercise has been performed successfully. Which testing should an IS auditor recommend be performed NEXT to verify the adequacy of the new BCP? a. Full-scale test with relocation of all departments, including IT, to the contingency site b. Walk-through test of a series of predefined scenarios with all critical personnel involved c. IT disaster recovery test with business departments involved in testing the critical applications d. Functional test of a scenario with limited IT involvement

d. functional test of a scenario with limited IT involvement After a tabletop exercise has been performed, the next step would be a functional test, which includes the mobilization of staff to exercise the administrative and organizational functions of a recovery. Because the IT part of the recovery has been tested for years, it would be more efficient to verify and optimize the BCP before actually involving IT in a full-scale test. The full-scale test would be the last step of the verification process before entering into a regular annual testing schedule.

Which of the following would BEST help to detect errors in data processing? a. Programmed edit checks b. Well-designed data entry screens c. Segregation of duties d. Hash totals

d. hash totals The use of hash totals is an effective method to reliably detect errors in data processing. A hash total would indicate an error in data integrity.

The application systems of an organization using open-source software have no single recognized developer producing patches. Which of the following would be the MOST secure way of updating open-source software? a. Rewrite the patches and apply them. b. Review the code and application of available patches. c. Develop in-house patches. d. Identify and test suitable patches before applying them.

d. identify and test suitable patches before applying them

The PRIMARY objective of testing a business continuity plan is to: a. familiarize employees with the business continuity plan. b. ensure that all residual risk is addressed. c. exercise all possible disaster scenarios. d. identify limitations of the business continuity plan.

d. identify limitations of the business continuity plan Testing the business continuity plan provides the best evidence of any limitations that may exist.

An IS auditor finds out-of-range data in some tables of a database. Which of the following controls should the IS auditor recommend to avoid this situation? a. Log all table update transactions. b. Implement before-and-after image reporting. c. Use tracing and tagging. d. Implement integrity constraints in the database.

d. implement integrity constraints in the database This is a preventive control because data are checked against predefined tables or rules, preventing any undefined data from being entered.

During the review of an in-house developed application, the GREATEST concern to an IS auditor is if a: a. user raises a change request and tests it in the test environment. b. programmer codes a change in the development environment and tests it in the test environment. c. manager approves a change request and then reviews it in production. d. manager initiates a change request and subsequently approves it.

d. manager initiates a change request and subsequently approves it. Initiating and subsequently approving a change request violates the principle of segregation of duties. A person should not be able to approve their own requests.

When developing a disaster recovery plan, the criteria for determining the acceptable downtime should be the: a. annual loss expectancy. b. service delivery objective. c. quantity of orphan data. d. maximum tolerable outage.

d. maximum tolerable outage Recovery time objective is determined based on the acceptable downtime in case of a disruption of operations. It indicates the maximum tolerable outage that an organization considers to be acceptable before a system or process must resume following a disaster.

What is the BEST backup strategy for a large database with data supporting online sales? a. Weekly full backup with daily incremental backup b. Daily full backup c. Clustered servers d. Mirrored hard disks

d. mirrored hard disks This will ensure that all data are backed up to more than one disk so that a failure of one disk will not result in loss of data.

Which of the following is the BEST method for determining the criticality of each application system in the production environment? a. Interview the application programmers. b. Perform a gap analysis. c. Review the most recent application audits. d. Perform a business impact analysis.

d. perform a business impact analysis A BIA will give the impact of the loss of each application. A BIA is conducted with representatives of the business that can accurately describe the criticality of a system and its importance to the business.

During an application audit, the IS auditor finds several problems related to corrupt data in the database. Which of the following is a corrective control that the IS auditor should recommend? a. Define the standards, and closely monitor them for compliance. b. Ensure that only authorized personnel can update the database. c. Establish controls to handle concurrent access problems. d. Proceed with restore procedures.

d. proceed with restore procedures This is a corrective control. Restore procedures can be used to recover databases to their last-known archived version.

An organization's disaster recovery plan should address early recovery of: a. all information systems processes. b. all financial processing applications. c. only those applications designated by the IS manager. d. processing in priority order, as defined by business management.

d. processing in priority order, as defined by business management Business management should know which systems are critical and what they need to process well in advance of a disaster. It is management's responsibility to develop and maintain the plan. Adequate time will not be available for this determination once the disaster occurs. IS and the information processing facility are service organizations that exist for the purpose of assisting the general user management in successfully performing their jobs.

The PRIMARY objective of business continuity and disaster recovery plans should be to: a. safeguard critical IS assets. b. provide for continuity of operations. c. minimize the loss to an organization. d. protect human life.

d. protect human life Because human life is invaluable, the main priority of any business continuity and disaster recovery plan should be to protect people.

Which of the following provides the BEST evidence of an organization's disaster recovery capability readiness? a. A disaster recovery plan (DRP) b. Customer references for the alternate site provider c. Processes for maintaining the DRP d. Results of tests and exercises

d. results of tests and exercises Only tests and exercises demonstrate the adequacy of the plans and provide reasonable assurance of an organization's disaster recovery capability readiness.

When performing a database review, an IS auditor notices that some tables in the database are not normalized. The IS auditor should next: a. recommend that the database be normalized. b. review the conceptual data model. c. review the stored procedures. d. review the justification.

d. review the justification performance can be better when data is normalized

Which of the following is the BEST method for an IS auditor to verify that critical production servers are running the latest security updates released by the vendor? a. Ensure that automatic updates are enabled on critical production servers. b. Verify manually that the patches are applied on a sample of production servers. c. Review the change management log for critical production servers. d. Run an automated tool to verify the security patches on production servers.

d. run an automated too to verify the security patches on production servers An automated tool can immediately provide a report on which patches have been applied and which are missing

Which of the following is the GREATEST risk when storage growth in a critical file server is not managed properly? a. Backup time would steadily increase. b. Backup operational costs would significantly increase. c. Storage operational costs would significantly increase. d. Server recovery work may not meet the recovery time objective.

d. server recovery work may not meet the recovery time objective In case of a crash, recovering a server with an extensive amount of data could require a significant amount of time. If the recovery cannot meet the RTO, there will be a discrepancy in IT strategies. It is important to ensure that server restoration can meet the RTO.

Which of the following should the IS auditor review to ensure that servers are optimally configured to support processing requirements? a. Benchmark test results b. Server logs c. Downtime reports d. Server utilization data

d. server utilization data Monitoring server utilization identifies underutilized servers and monitors overall server utilization. Underutilized servers do not provide the business with optimal cost-effectiveness. By monitoring server usage, IT management can take appropriate measures to raise the utilization ratio and provide the most effective return on investment.

A disaster recovery plan for an organization's financial system specifies that the recovery point objective is zero and the recovery time objective is 72 hours. Which of the following is the MOST cost-effective solution? a. A hot site that can be operational in eight hours with asynchronous backup of the transaction logs b. Distributed database systems in multiple locations updated asynchronously c. Synchronous updates of the data and standby active systems in a hot site d. Synchronous remote copy of the data in a warm site that can be operational in 48 hours

d. synchronous remote copy of the data in a warm site that can be operational in 48 hours This is correct as it meets the required recovery time objective (RTO). c - These meet the RPO and RTO requirements but are costlier than a warm site solution. Recovery point objective (RPO) is defined as the maximum amount of data - as measured by time - that can be lost after a recovery from a disaster, failure, or comparable event before data loss will exceed what is acceptable to an organization

When reviewing a hardware maintenance program, an IS auditor should assess whether: a. the schedule of all unplanned maintenance is maintained. b. it is in line with historical trends. c. it has been approved by the IS steering committee. d. the program is validated against vendor specifications.

d. the program is validated against vendor specifications. Although maintenance requirements vary based on complexity and performance workloads, a hardware maintenance schedule should be validated against the vendor-provided specifications. the vendor should have an idea of what maintenance is needed

An IS auditor is reviewing an organization's recovery from a disaster in which not all the critical data needed to resume business operations were retained. Which of the following was incorrectly defined? a. The interruption window b. The recovery time objective c. The service delivery objective d. The recovery point objective

d. the recovery point objective This is determined based on the acceptable data loss in the case of a disruption of operations. RPO defines the point in time from which it is necessary to recover the data and quantifies, in terms of time, the permissible amount of data loss in the case of interruption.

During an implementation review of a recent application deployment, it was determined that several incidents were assigned incorrect priorities and, because of this, failed to meet the business service level agreement (SLA). What is the GREATEST concern? a. The support model was not approved by senior management. b. The incident resolution time specified in the SLA is not realistic. c. There are inadequate resources to support the applications. d. The support model was not properly developed and implemented.

d. the support model was not properly developed and implemented The greatest concern for the IS auditor is that the support model was not developed and implemented correctly to prevent or react to potential outages. Incidents could cost the business a significant amount of money and a support model should be implemented with the project. This should be a step within the system development life cycle and procedures and, if it is missed on one project, it may be a symptom of an overall breakdown in process

An IS auditor is evaluating network performance for an organization that is considering increasing its Internet bandwidth due to a performance degradation during business hours. Which of the following is MOST likely the cause of the performance degradation? a. Malware on servers b. Firewall misconfiguration c. Increased spam received by the email server d. Unauthorized network activities

d. unauthorized network activities Unauthorized network activities—such as employee use of file or music sharing sites or online gambling or personal email containing large files or photos—could contribute to network performance issues. Because the IS auditor found the degraded performance during business hours, this is the most likely cause

Which of the following activities should the business continuity manager perform FIRST after the replacement of hardware at the primary information processing facility? a. Verify compatibility with the hot site b. Review the implementation report c. Perform a walk-through of the disaster recovery plan d. Update the IT asset inventory

d. update the IT asset inventory An IT assets inventory is the basic input for the business continuity/disaster recovery plan, and the plan must be updated to reflect changes in the IT infrastructure. need to define assets before can define risk

A batch transaction job failed in production; however, the same job returned no issues during user acceptance testing (UAT). Analysis of the production batch job indicates that it was altered after UAT. Which of the following ways would be the BEST to mitigate this risk in the future? a. Improve regression test cases. b. Activate audit trails for a limited period after release. c. Conduct an application user access review. d. Ensure that developers do not have access to code after testing.

d/ Ensure that developers do not have access to code after testing. To ensure proper segregation of duties, developers should be restricted to the development environment only. If code needs to be modified after user acceptance testing, the process must be restarted in development. THink developers shouldnt have access to production

Authorizing access to application data is the responsibility of the:

data owner

Recovery time objective (RTO)

defines the time period after the disaster in which normal business functionality needs to be restored.

bonded security

is a type of insurance for the employer. It protects business owners from employee theft and also compensates the employer in cases of property loss caused by an employee.

Primary Key

is either an existing table column or a column that is specifically generated by the database according to a defined sequence. It should not be possible to delete a row from a customer table when the customer number (primary key) of that row is stored with live orders on the orders table (the foreign key to the customer table). A primary key works in one table so it is not able to provide/ensure referential integrity by itself For example, students are routinely assigned unique identification (ID) numbers, and all adults receive government-assigned and uniquely-identifiable Social Security numbers.

Up Time

is the duration of time that a system has been working and available in a reliable operating manner. opposite of downtime

site subscriber

other business that subscribe to a hot/cold/warm site you should understand who the other subscribers are

What invokes a business continuity plan (BCP)?

the responsible party declaring a disastor