CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CISA—Certified Information Systems Auditor - Part 198
1. When segregation of duties concerns exists between IT support staff and end users, what would be suitable compensating control?
A) Restricting physical access to computing equipment
B) Reviewing transaction and application logs
C) Performing background checks prior to hiring IT staff
D) Locking user sessions after a specified period of inactivity
2. An IS auditor reviewing an organization that uses cross-training practices should assess the risk of:
A) dependency on a single person.
B) inadequate succession planning.
C) one person knowing all parts of a system.
D) a disruption of operations.
3. Which of the following controls would an IS auditor look for in an environment where duties cannot be appropriately segregated?
A) Overlapping controls
B) Boundary controls
C) Access controls
D) Compensating controls
4. Which of the following reduces the potential impact of social engineering attacks?
A) Compliance with regulatory requirements
B) Promoting ethical understanding
C) Security awareness programs
D) Effective performance incentives
5. Which of the following activities performed by a database administrator (DBA) should be performed by a different person?
A) Deleting database activity logs
B) Implementing database optimization tools
C) Monitoring database usage
D) Defining backup and recovery procedures
A) Restricting physical access to computing equipment
B) Reviewing transaction and application logs
C) Performing background checks prior to hiring IT staff
D) Locking user sessions after a specified period of inactivity
2. An IS auditor reviewing an organization that uses cross-training practices should assess the risk of:
A) dependency on a single person.
B) inadequate succession planning.
C) one person knowing all parts of a system.
D) a disruption of operations.
3. Which of the following controls would an IS auditor look for in an environment where duties cannot be appropriately segregated?
A) Overlapping controls
B) Boundary controls
C) Access controls
D) Compensating controls
4. Which of the following reduces the potential impact of social engineering attacks?
A) Compliance with regulatory requirements
B) Promoting ethical understanding
C) Security awareness programs
D) Effective performance incentives
5. Which of the following activities performed by a database administrator (DBA) should be performed by a different person?
A) Deleting database activity logs
B) Implementing database optimization tools
C) Monitoring database usage
D) Defining backup and recovery procedures
1. Right Answer: B
Explanation: Only reviewing transaction and application logs directly addresses the threat posed by poor segregation of duties. The review is a means of detecting inappropriate behavior and also discourages abuse, because people who may otherwise be tempted to exploit the situation are aware of the likelihood of being caught. Inadequate segregation of duties is more likely to be exploited via logical access to data and computing resources rather than physical access. Choice C is a useful control to ensure IT staff are trustworthy and competent but does not directly address the lack of an optimal segregation of duties. Choice D acts to prevent unauthorized users from gaining system access, but the issue of a lack of segregation of duties is more the misuse (deliberately or inadvertently} of access privileges that have officially been granted.
2. Right Answer: C
Explanation: Cross-training is a process of training more than one individual to perform a specific job or procedure. This practice helps decrease the dependence on a single person and assists in succession planning. This provides for the backup of personnel in the event of an absence and, thereby, provides for the continuity of operations. However, in using this approach, it is prudent to have first assessed the risk of any person knowing all parts of a system and the related potential exposures. Cross-training reduces the risks addressed in choices A, B and D.
3. Right Answer: D
Explanation: Compensating controls are internal controls that are intended to reduce the risk of an existing or potential control weakness that may arise when duties cannot be appropriately segregated.Overlapping controls are two controls addressing the same control objective or exposure. Since primary controls cannot be achieved when duties cannot or are not appropriately segregated, it is difficult to install overlapping controls. Boundary controls establish the interface between the would-be user of a computer system and the computer system itself, and are individual-based, not role-based, controls. Access controls for resources are based on individuals and not on roles.
4. Right Answer: C
Explanation: Because social engineering is based on deception of the user, the best countermeasure or defense is a security awareness program. The other choices are not user-focused.
5. Right Answer: A
Explanation: Since database activity logs record activities performed by the database administrator (DBA), deleting them should be performed by an individual other than theDBA. This is a compensating control to aid in ensuring an appropriate segregation of duties and is associated with the DBA's role. A DBA should perform the other activities as part of the normal operations.
Explanation: Only reviewing transaction and application logs directly addresses the threat posed by poor segregation of duties. The review is a means of detecting inappropriate behavior and also discourages abuse, because people who may otherwise be tempted to exploit the situation are aware of the likelihood of being caught. Inadequate segregation of duties is more likely to be exploited via logical access to data and computing resources rather than physical access. Choice C is a useful control to ensure IT staff are trustworthy and competent but does not directly address the lack of an optimal segregation of duties. Choice D acts to prevent unauthorized users from gaining system access, but the issue of a lack of segregation of duties is more the misuse (deliberately or inadvertently} of access privileges that have officially been granted.
2. Right Answer: C
Explanation: Cross-training is a process of training more than one individual to perform a specific job or procedure. This practice helps decrease the dependence on a single person and assists in succession planning. This provides for the backup of personnel in the event of an absence and, thereby, provides for the continuity of operations. However, in using this approach, it is prudent to have first assessed the risk of any person knowing all parts of a system and the related potential exposures. Cross-training reduces the risks addressed in choices A, B and D.
3. Right Answer: D
Explanation: Compensating controls are internal controls that are intended to reduce the risk of an existing or potential control weakness that may arise when duties cannot be appropriately segregated.Overlapping controls are two controls addressing the same control objective or exposure. Since primary controls cannot be achieved when duties cannot or are not appropriately segregated, it is difficult to install overlapping controls. Boundary controls establish the interface between the would-be user of a computer system and the computer system itself, and are individual-based, not role-based, controls. Access controls for resources are based on individuals and not on roles.
4. Right Answer: C
Explanation: Because social engineering is based on deception of the user, the best countermeasure or defense is a security awareness program. The other choices are not user-focused.
5. Right Answer: A
Explanation: Since database activity logs record activities performed by the database administrator (DBA), deleting them should be performed by an individual other than theDBA. This is a compensating control to aid in ensuring an appropriate segregation of duties and is associated with the DBA's role. A DBA should perform the other activities as part of the normal operations.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment