acct exam

a.

control risk

b.

legal risk

c.

detection risk

d.

inherent risk

a.

In the CBIS environment, auditors gather evidence relating only to the contents of databases, not the reliability of the computer system.

b.

Conducting an audit is a systematic and logical process that applies to all forms of information systems.

c.

Substantive tests establish whether internal controls are functioning properly.

d.

IT auditors prepare the audit report if the system is computerized.

a.

written assertions and a practitioner’s written report

b.

the engagement is designed to conduct risk assessment of the client’s systems to verify their degree of SOX compliance

c.

the formal establishment of measurements criteria

d.

the engagement is limited to examination, review, and application of agreed-upon procedures

a.

Auditors must determine, whether changes in internal control has, or is likely to, materially affect internal control over financial reporting.

b.

Auditors must interview management regarding significant changes in the design or operation of internal control that occurred since the last audit.

c.

Corporate management (including the CEO) must certify monthly and annually their organization’s internal controls over financial reporting.

d.

Management must disclose any material changes in the company’s internal controls that have occurred during the most recent fiscal quarter.

a.

examining the safety deposit box for stock certificates

b.

reviewing systems documentation

c.

completing questionnaires

d.

observation

a.

transaction number

b.

account number

c.

date

d.

user

a.

master file

b.

transaction file

c.

reference file

d.

archive file

a.

depict logical tasks that are being performed, but not who is performing them

b.

illustrate the relationship between processes, and the documents that flow between them and trigger activities

c.

represent relationships between key elements of the computer system

d.

describe in detail the logic of the process

a.

airline reservations

b.

credit authorization

c.

payroll processing

d.

adjustments to perpetual inventory

a.

batch processing using direct access files

b.

real-time processing

c.

batch processing using sequential files

d.

all of the above use the destructive update approach

a.

releasing incorrect data to authorized individuals

b.

permitting computer operators unlimited access to the computer room

c.

permitting access to data by unauthorized individuals

d.

providing correct data to unauthorized individuals

a.

natural disasters such as fires

b.

unauthorized access

c.

data corruption caused by program errors

d.

system crashes

a.

off-site storage of backups

b.

computer services function

c.

second site backup

d.

critical applications identified

a.

backups of systems software

b.

backups of application software

c.

documentation and blank forms

d.

results of the latest test of the disaster recovery program

a.

network management

b.

systems operations

c.

systems development

d.

server maintenance

a.

reconciling program version numbers

b.

program testing

c.

user involvement

d.

internal audit participation

a.

using passwords to limit access to application programs

b.

assigning a test name to all programs undergoing maintenance

c.

combining access to the development and maintenance test libraries

d.

assigning version numbers to programs to record program modifications

a.

conceptual level

b.

context level

c.

intermediate level

d.

elementary level

a.

operational feasibility study

b.

schedule feasibility study

c.

legal feasibility study

d.

economic feasibility study

a.

a detailed review of the source code

b.

contact with user groups

c.

preparation of a request for proposal

d.

comparison of the results of a benchmark problem

a.

the ability to process data without the help of a programmer

b.

the ability to control access to the data

c.

constant production of backups

d.

the inability to determine what data is available

a.

by direct query

b.

by developing operating software

c.

by constantly interacting with systems programmers

d.

all of the above

a.

links between related records are implicit

b.

the way to access data is by following a predefined data path

c.

an owner (parent) record may own just one member (child) record

d.

a member (child) record may have more than one owner (parent)

a.

hierarchical

b.

network

c.

sequential

d.

relational

a.

partitioning the database

b.

using a lockout procedure

c.

replicating the database

d.

implementing concurrency controls

a.

detect unauthorized access to systems

b.

facilitate reconstruction of events

c.

reduce the need for other forms of security

d.

promote personal accountability

a.

the vendor's price list file

b.

the vendor's accounts payable file

c.

the vendor's open purchase order file

d.

none of the above

a.

all EDI transactions are authorized

b.

unauthorized trading partners cannot gain access to database records

c.

a complete audit trail of EDI transactions is maintained

d.

backup procedures are in place and functioning properly

a.

firewalls

b.

one-time passwords

c.

field interrogation

d.

data encryption

a.

a smurf attack.

b.

IP Spoofing.

c.

an ACK echo attack

d.

a ping attack.

e.

none of the above