The IS auditor should:
When reviewing input controls, an IS auditor observes that, in accordance with corporate policy,
procedures allow supervisory override of data validation edits. The IS auditor should:
In order to ensure effective management of business risks, exceptions to such policies should be:
As an organization grows, exceptions to information security policies that were not originally
specified may become necessary at a later date. In order to ensure effective management of
business risks, exceptions to such policies should be:
When using an integrated test facility (ITF), an IS auditor should ensure that:
When using an integrated test facility (ITF), an IS auditor should ensure that:
Which is the BEST way to identify an application backdoor?
There is reason to believe that a recently modified web application has allowed unauthorized
access. Which is the BEST way to identify an application backdoor?
Which of the following controls is MOST effective in providing reasonable assurance that the change was author
A clerk changed the interest rate for a loan on a master file. The rate entered is outside the normal
range for such a loan. Which of the following controls is MOST effective in providing reasonable
assurance that the change was authorized?
Which of the following vulnerabilities does il always introduce?
Simple Network Management Protocol v2 (SNMP v2) is used frequently to monitor networks.
Which of the following vulnerabilities does il always introduce?
The GREATEST advantage of using web services for the exchange of information between two systems is:
The GREATEST advantage of using web services for the exchange of information between two
systems is:
which security should be addressed in the development cycle of a project?
Which of the following is the FIRST phase in which security should be addressed in the
development cycle of a project?
The BEST response the auditor can make is to:
An IS auditor reviewing an accounts payable system discovers that audit logs are not being
reviewed. When this issue is raised with management the response is that additional controls are
not necessary because effective system access controls are inplace. The BEST response the
auditor can make is to:
Which of the following should be determined FIRST when establishing a business continuity program?
Which of the following should be determined FIRST when establishing a business continuity
program?