What should be the GREATEST concern to an IS auditor when employees use portable media (MP3 players,
flash drives)?

A.
The copying of sensitive data on them

B.
The copying of songs and videos on them

C.
The cost of these devices multiplied by all the employees could be high

D.
They facilitate the spread of malicious code through the corporate network

Explanation:
The MAIN concern with MP3 players and flash drives is data leakage, especially sensitive information. This
could occur if the devices were lost or stolen. The risk when copying songs and videos is copyright
infringement, but this is normally aless important risk than information leakage. Choice C is hardly an issue
because employees normally buy the portable media with their own funds. Choice D is a possible risk, but not
as important as information leakage and can be reduced by other controls.