Computer Security Auditing Exam Questions
Course Introduction
Computer Security Auditing covers the principles and practices of assessing and validating the security posture of information systems within organizations. The course explores methodologies for conducting security audits, including risk assessment, vulnerability analysis, compliance evaluation, and reporting of findings. Topics include audit frameworks and standards, security policies and procedures, data protection controls, network and application security assessments, and regulatory requirements. Students gain practical experience by planning and performing audits, utilizing industry tools, and developing skills to identify security weaknesses, suggest remediation strategies, and ensure organizational compliance with best practices and legal mandates.
Recommended Textbook
Information Technology Auditing 3rd Edition by James
Available Study Resources on Quizplus 12 Chapters
1295 Verified Questions
1295 Flashcards
Source URL: https://quizplus.com/study-set/351
Page 2
A. Hall
Chapter 1: Auditing and Internal Control
Available Study Resources on Quizplus for this Chatper
103 Verified Questions
103 Flashcards
Source URL: https://quizplus.com/quiz/5812
Sample Questions
Q1) The PCAOB's standard No.2 specifically requires auditors to understand transaction flows in designing their test of controls.What steps does this entail?
Answer: This involves:
1.Selecting the financial accounts that have material implications for financial reporting.2.Identify the application controls related to those accounts. 3.Identify the general that support the application controls. The sum of these controls,both application and general,constitute the relevant internal controls over financial reporting that need to be reviewed.
Q2) Which of the following suggests a weakness in the internal control environment?
A) the firm has an up-to-date organizational chart
B) monthly reports comparing actual performance to budget are distributed to managers
C) performance evaluations are prepared every three years
D) the audit committee meets quarterly with the external auditors
Answer: C
Q3) A clerk reorders 250 items when the inventory falls below 25 items.This is an example of __________________________.
Answer: general authorization
To view all questions and flashcards with answers, click on the resource link above.
3
Chapter 2: Auditing IT Governance Controls
Available Study Resources on Quizplus for this Chatper
99 Verified Questions
99 Flashcards
Source URL: https://quizplus.com/quiz/5813
Sample Questions
Q1) A cold site backup approach is also known as
A) internally provided backup
B) recovery operations center
C) empty shell
D) mutual aid pact
Answer: C
Q2) Explain why reduced security is an outsourcing risk.
Answer: Information outsourced to off-shore IT vendors raises unique and serious questions regarding internal control and the protection of sensitive personal data.When corporate financial systems are developed and hosted overseas,and program code is developed through interfaces with the host company's network,US corporations are at risk of losing control of their information.To a large degree US firms are reliant on the outsourcing vendor's security measures,data-access policies and the privacy laws of the host country.
Q3) Specific IT assets support an organization's strategic objectives.
A)True
B)False
Answer: True
To view all questions and flashcards with answers, click on the resource link above.
4
Chapter 3: Security Part I: Auditing Operating Systems and Networks
Available Study Resources on Quizplus for this Chatper
143 Verified Questions
143 Flashcards
Source URL: https://quizplus.com/quiz/5814
Sample Questions
Q1) Polling is one technique used to control data collisions.
A)True
B)False
Answer: True
Q2) IP spoofing is a form of masquerading to gain unauthorized access to a Web server.
A)True
B)False
Answer: True
Q3) To preserve audit trails in a computerized environment,transaction logs are permanent records of transactions.
A)True
B)False
Answer: True
Q4) The network paradox is that networks exist to provide user access to shared resources while one of its most important objectives is to control access.
A)True
B)False
Answer: True
Page 5
To view all questions and flashcards with answers, click on the resource link above.
Chapter 4: IT Security Part II: Auditing Database Systems
Available Study Resources on Quizplus for this Chatper
101 Verified Questions
101 Flashcards
Source URL: https://quizplus.com/quiz/5815
Sample Questions
Q1) A join builds a new table by creating links.
A)True
B)False
Q2) All of the following are advantages of a partitioned database except
A) increased user control by having the data stored locally
B) deadlocks are eliminated
C) transaction processing response time is improved
D) partitioning can reduce losses in case of disaster
Q3) Why are the hierarchical and network models called navigational databases?
Q4) There is more than one conceptual view of the database.
A)True
B)False
Q5) Which characteristic is associated with the database approach to data management?
A) data sharing
B) multiple storage procedures
C) data redundancy
D) excessive storage costs
Q6) The __________________________ describes every data element in the database.
Q7) What is the flat-file model?
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Systems Development and Program Change
Activities
Available Study Resources on Quizplus for this Chatper
108 Verified Questions
108 Flashcards
Source URL: https://quizplus.com/quiz/5816
Sample Questions
Q1) Which of the following is not an advantage of commercial software? Commercial software
A) can be installed faster than a custom system
B) can be easily modified to the user's exact specifications
C) is significantly less expensive than a system developed in-house
D) is less likely to have errors than an equivalent system developed in-house
Q2) The objective of systems planning is to link systems projects to the strategic objectives of the firm.
A)True
B)False
Q3) Typically a systems analysis
A) results in a formal project schedule
B) does not include a review of the current system
C) identifies user needs and specifies system requirements
D) is performed by the internal auditor
Q4) Which statement is correct?
A) compiled programs are very susceptible to unauthorized modification
B) the source program library stores application programs in source code form
C) modifications are made to programs in machine code language
D) the source program library management system increases operating efficiency
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Overview of Transaction Processing and Financial Reporting Systems
Available Study Resources on Quizplus for this Chatper
143 Verified Questions
143 Flashcards
Source URL: https://quizplus.com/quiz/5817
Sample Questions
Q1) Give a brief description of each of the following documentation techniques: systems flowchart,and program flowchart.
Q2) What type of data is found in the general ledger master file?
A) a chronological record of all transactions
B) the balance of each account in the chart of accounts
C) budget records for each account in the chart of accounts
D) subsidiary details supporting a control account
Q3) Batch processing is best used when timely information is needed because this method processes data efficiently.
A)True
B)False
Q4) System flowcharts
A) depict logical tasks that are being performed, but not who is performing them
B) illustrate the relationship between database entities in systems.
C) represent relationships between key elements of both manual and computer systems.
D) describe the internal logic of computer applications in systems. .
Q5) In one sentence,what does updating a master file record involve?
Q6) For what purpose are ER diagrams used?
Q7) List two of the three transaction cycles. Page 8
To view all questions and flashcards with answers, click on the resource link above.
Page 9
Chapter 7: Computer-Assisted Audit Tools and Techniques
Available Study Resources on Quizplus for this Chatper
83 Verified Questions
83 Flashcards
Source URL: https://quizplus.com/quiz/5818
Sample Questions
Q1) Program testing
A) involves individual modules only, not the full system
B) requires creation of meaningful test data
C) need not be repeated once the system is implemented
D) is primarily concerned with usability
Q2) The three groups of application controls are batch controls,run-to-run controls,and audit trail controls.
A)True
B)False
Q3) A salami fraud affects a large number of victims,but the harm to each appears to be very small.
A)True
B)False
Q4) Shredding computer printouts is an example of an output control.
A)True
B)False
Q5) A __________________________ fraud affects a large number of victims but the harm to each appears to be very small.
Q6) What are the three broad categories of application controls?
Q7) What are the three categories of processing control?
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 8: Data Structures and CAATTs for Data Extraction
Available Study Resources on Quizplus for this Chatper
89 Verified Questions
89 Flashcards
Source URL: https://quizplus.com/quiz/5819
Sample Questions
Q1) Explain the basic results that come from the restrict,project,and join functions.
Q2) Improperly normalized databases are associated with three types of anomalies: the update anomaly,the insertion anomaly,and the deletion anomaly.
A)True
B)False
Q3) When a large portion of the file is to be processed in one operation such as payroll,sequential data structures are an inefficient method of organizing a file.
A)True
B)False
Q4) Contrast embedded audit modules with generalized audit software.
Q5) What are the characteristics of a properly designed relational database table?
Q6) A table is in second normal form when it is
A) free of repeating group data
B) free of transitive dependencies
C) free of partial dependencies
D) free of insert anomalies
E) none of the above
Q7) Explain how a separate linking file works in a network model.
11
To view all questions and flashcards with answers, click on the resource link above.
Chapter 9: Auditing the Revenue Cycle
Available Study Resources on Quizplus for this Chatper
105 Verified Questions
105 Flashcards
Source URL: https://quizplus.com/quiz/5820
Sample Questions
Q1) The packing slip is also known as the shipping notice.
A)True
B)False
Q2) The bill of lading is a legal contract between the buyer and the seller.
A)True
B)False
Q3) Copies of the sales order can be used for all of the following except
A) purchase order
B) credit authorization
C) shipping notice
D) packing slip
Q4) How is EDI more than technology? What unique control problems may it pose?
Q5) All of the following are advantages of real-time processing of sales except
A) The cash cycle is shortened
B) Paper work is reduced
C) Incorrect data entry is difficult to detect
D) Up-to-date information can provide a competitive advantage in the marketplace
Q6) Describe the key tasks in the sales order process
Q7) What role does each of the following departments play in the sales order processing subsystem: sales,credit,and shipping? Be complete.
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 10: Auditing the Expenditure Cycle
Available Study Resources on Quizplus for this Chatper
144 Verified Questions
144 Flashcards
Source URL: https://quizplus.com/quiz/5821
Sample Questions
Q1) Why should the copy of a purchase order,which is sent to receiving,be a "blind" copy?
Q2) Differentiate between a purchase requisition and a purchase order.
Q3) What are the steps taken in the cash disbursement system?
Q4) How does a voucher payable system work? What documents are reconciled? Who prepares the voucher? How is the A/P balance determined? How does the voucher payable system improve control over cash?
Q5) Why should employees clocking on and off the job be supervised.
Q6) Ideally,payroll checks are written on a special bank account used only for payroll. A)True
B)False
Q7) To maintain a good credit rating and to optimize cash management,cash disbursements should arrive at the vendor's place of business
A) as soon as possible
B) on the due date
C) on the discount date
D) by the end of the month.
Q8) What is the purpose of the purchase order?
To view all questions and flashcards with answers, click on the resource link above. Page 13
Chapter 12: Business Ethics, Fraud, and Fraud Detection
Available Study Resources on Quizplus for this Chatper
85 Verified Questions
85 Flashcards
Source URL: https://quizplus.com/quiz/5822
Sample Questions
Q1) Business ethics involves
A) how managers decide on what is right in conducting business
B) how managers achieve what they decide is right for the business
C) both a and b
D) none of the above
Q2) Explain the pass through fraud.
Q3) Misappropriation of assets can involve various schemes: expense reimbursement fraud,lapping,and payroll fraud.Explain each and give an example.
Q4) Business ethics is the analysis of the nature and social impact of computer technology,and the corresponding formulation and justification of policies for the ethical use of such technology.
A)True
B)False
Q5) For an action to be called fraudulent,all of the following conditions are required except
A) poor judgment
B) false representation
C) intent to deceive
D) injury or loss
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 11: Enterprise Resource Planning Systems
Available Study Resources on Quizplus for this Chatper
92 Verified Questions
92 Flashcards
Source URL: https://quizplus.com/quiz/5823
Sample Questions
Q1) The setup of a data warehouse includes
A) modeling the data
B) extracting data from operational databases
C) cleansing the data
D) all of the above
Q2) The implementation of an ERP creates an environment with a single point of failure,which places the organization at risk.
A)True
B)False
Q3) What is the closed database architecture?
Q4) Explain the risks associated with the creation of unnecessary roles and why it can happen.
Q5) What is the "Big-Bang" approach?
Q6) Why do ERP systems need bolt-on software? Give an example.
Q7) A data warehouse is a relational or multi-dimensional database that may require hundreds of gigabytes of storage.
A)True
B)False
Q8) How are OLTP and OLAP different? Give examples of their use.
To view all questions and flashcards with answers, click on the resource link above. Page 15