What should be the GREATEST concern to an IS auditor when employees use portable media
(MP3 players, flash drives)?

A.
The copying of sensitive data on them

B.
The copying of songs and videos on them

C.
The cost of these devices multiplied by all the employees could be high

D.
They facilitate the spread of malicious code through the corporate network

Explanation:
The MAIN concern with MP3 players and flash drives is data leakage, especially sensitive
information. This could occur if the devices were lost or stolen. The risk when copying songs and
videos is copyright infringement, but this is normally aless important risk than information leakage.
Choice C is hardly an issue because employees normally buy the portable media with their own
funds. Choice D is a possible risk, but not as important as information leakage and can be reduced
by other controls.