In an IS audit of several critical servers, the IS auditor wants to analyze audit trails to discover potential
anomalies in user or system behavior. Which of the following tools are MOST suitable for performing that task?

A.
CASE tools

B.
Embedded data collection tools

C.
Heuristic scanning tools

D.
Trend/variance detection tools

Explanation:
Trend/variance detection tools look for anomalies in user or system behavior, for example, determining whether
the numbers for prenumbered documents are sequential or increasing. CASE tools are used to assist software
development. Embedded (audit) data collection software is used for sampling and to provide production
statistics. Heuristic scanning tools can be used to scan for viruses to indicate possible infected code.