1. After identifying potential security vulnerabilities, what should be the IS auditor's next step?
A) To evaluate potential countermeasures and compensatory controls B) To implement effective countermeasures and compensatory controls C) To perform a business impact analysis of the threats that would exploit the vulnerabilities D) To immediately advise senior management of the findings
2. What is the primary security concern for EDI environments?
A) Transaction authentication B) Transaction completeness C) Transaction accuracy D) Transaction authorization
3. Which of the following exploit vulnerabilities to cause loss or damage to the organization and its assets?
A) Exposures B) Threats C) Hazards D) Insufficient controls
4. Business process re-engineering often results in ___________________ automation, which results in ____________ number of people using technology. Fill in the blanks.
A) Increased; a greater B) Increased; a fewer C) Less; a fewer D) Increased; the same
5. Whenever business processes have been re-engineered, the IS auditor attempts to identify and quantify the impact of any controls that might have been removed, or controls that might not work as effectively after business process changes. True or false?
A) True B) False C) D)
1. Right Answer: C Explanation: After identifying potential security vulnerabilities, the IS auditor's next step is to perform a business impact analysis of the threats that would exploit the vulnerabilities.
2. Right Answer: D Explanation: Transaction authorization is the primary security concern for EDI environments.
3. Right Answer: B Explanation: Threats exploit vulnerabilities to cause loss or damage to the organization and its assets.
4. Right Answer: A Explanation: Business process re-engineering often results in increased automation, which results in a greater number of people using technology.
5. Right Answer: A Explanation: Whenever business processes have been re-engineered, the IS auditor should attempt to identify and quantify the impact of any controls that might have been removed, or controls that might not work as effectively after business process changes.
Leave a comment