Practice Questions From Chapters 6-9

Front 1

A user's authentication credentials are of most value when they:

Back 1

can pass a compatibility test at logon.

Front 2

User reviews are an example of

Back 2

output controls.

Front 3

The edit check that would catch the erroneous entry of the letter "A" instead of the digit "1" in the zip code field is called a(n):

Back 3

field check.

Front 4

Peabody Enterprises suffered greatly when their system was down longer than expected for system maintenance. The issue was that the changes that were to be implemented during maintenance proved to be incomplete. Which control should have been implemented to prevent this from happening?

Back 4

Engineers should have developed backout plans.

Front 5

Information about data entry errors should be provided to management in a(n):

Back 5

error log.

Front 6

A text file created by a website and stored on a visitor's hard disk.

Back 6

cookie.

Front 7

A data transmission control that checks the number of bits in each character and turns on an extra bit if necessary to make the number always odd or even is called:

Back 7

parity checking.

Front 8

Forms design is an example of this type of control.

Back 8

source data controls.

Front 9

The downside of passwords is that they can be:

Back 9

guessed, forgotten, and given away.

Front 10

Visual scanning is an example of

Back 10

source data controls.

Front 11

Burns Inc. discovered that they were issuing more paychecks than there were employees on the payroll. Which of the following controls most likely lead them to this discovery?

Back 11

A reconciliation with external data.

Front 12

In data transmission, a good technique to let the sender know if the message has been received is called:

Back 12

message acknowledgement.

Front 13

A data entry device can be programmed to test for a(n) _________ every time an ID number is entered.

Back 13

check digit.

Front 14

Data conversion checks are an example of

Back 14

processing controls.

Front 15

A data input error was referred to the originating department for correction. A week later the department complained that the inventory in question was incorrect. Data processing could not easily determine whether or not the item had been processed by the computer. The best control procedure would be:

Back 15

an error log/report.

Front 16

This determines the correctness of the logical relationship between two data items.

Back 16

reasonableness test.

Front 17

Sensitive, confidential, or security-related documents should be:

Back 17

shredded.

Front 18

The most common input-related vulnerability is

Back 18

buffer overflow attack.

Front 19

Which message acknowledgment technique allows the sender to see if the message was received in its entirety?

Back 19

echo check.

Front 20

The master inventory file, contained on a backup tape, was destroyed by a small fire next to the area where it was stored. Since this was the only copy of the backup tape, the company had to take a special complete inventory in order to reestablish the file. The best control procedure that may have prevented the need to recreate the file would be

Back 20

an offsite copy of the backup tape.

Front 21

A twenty-minute power failure which shot down a firm's computer system resulted in loss of data for several transactions which were being entered into the system from remote terminals. The best control procedure is:

Back 21

uninterruptible power supply (UPS).

Front 22

The goal of information systems controls is

Back 22

to ensure that systems are reliable.

Front 23

A small electronic component within the control unit of the central processor failed during a peak processing period, causing the system to be down for two hours. The component, normally lasting 6 months, had not been replaced for two years. The best control process would be:

Back 23

preventive maintenance.

Front 24

The AICPA and the CICA have created an evaluation service known as SysTrust. SysTrust follows four principles to determine if a system is reliable. The reliability principle that states that users must be able to enter, update, and retrieve data during agreed-upon times is known as

Back 24

availability.

Front 25

Means of controlling the accuracy and completeness of data entered online into a computer system includes all of the following except:

Back 25

trailer labels.

Front 26

Which of the following preventive controls are necessary to provide adequate security that deals with social engineering?

Back 26

training

Front 27

Inputting data, a user accidentally keys in a customer's name in the area reserved for the quantity sold. One control which should be effective in detecting this would be:

Back 27

field check

Front 28

The system and processes used to issue and manage asymmetric keys and digital certificates

Back 28

public key infrastructure

Front 29

A factory worker entering production transactions over an on-line terminal mistakenly failed to enter the product stock number. A control which should detect this is:

Back 29

completeness test

Front 30

The _______ disseminates information about fraud, errors, breaches and other improper system uses and their consequences.

Back 30

chief security officer

Front 31

In preparing payroll checks, the computer omitted 15 out of 2115 checks which should have been processed. The error was not detected until the foreman distributed the checks. The best control is:

Back 31

record count

Front 32

One way to circumvent the counterfeiting of public keys is by using

Back 32

a digital certificate

Front 33

What control evaluates the logical correctness of the relationship between an item of input data and another data item?

Back 33

a reasonableness test

Front 34

Concerning virtual private networks (VPN), true or false:

It is more expensive to reconfigure VPNs to include new sites than it is to add or remove the corresponding physical connections in a privately owned network.

Back 34

False

Front 35

Which internal file label usually contains control totals and summary data about the file's contents?

Back 35

trailer record

Front 36

This ensures that the input data will fit into the assigned field

Back 36

size check

Front 37

By inserting an unauthorized transaction into the batch of 50 payroll transactions, an operator was able to add a fictitious employee to the payroll file. The best control procedure would be:

Back 37

record count

Front 38

Sequentially pre-numbered forms is an example of

Back 38

source data controls

Front 39

Because of a failure in a $400 communication device serving terminals at eight drive-in windows, a bank was forced to shut down the windows for two hours during a busy Friday afternoon. The best control procedure is:

Back 39

redundant components

Front 40

This screens individual IP packets based solely on the contents of the source or destination fields in the packet header.

Back 40

static packet filtering

Front 41

The edit check most likely to signal that an error exists because the quantity on hand field negative is:

Back 41

sign check

Front 42

These are established to deal with major security breaches

Back 42

CERTs

(computer emergency response team)

Front 43

Which of the following is the best way to control physical access to the computing center?

Back 43

security cards, passwords

Front 44

If the time an attacker takes to break through the organization's preventive controls is greater than the sum of the time required to detect the attack and the time required to respond to the attack, then security is

Back 44

effective

Front 45

Password effectiveness is enhanced by frequent changes, not displaying the password on the screen, automatic disconnection after several failed attempts, but not

Back 45

user selection of passwords

Front 46

Which of the following is used to determine what rights a particular user has?

Back 46

compatibility test

Front 47

_________ involves copying only the data items that have changed since the last backup.

Back 47

Incremental backup

Front 48

The "time worked" field for salaried employees is supposed to contain a "01" for one week. for one employee, this field contained the number 40 and a check for $16,872.41 was accidentally prepared and mailed to this employee. The best control procedure would be:

Back 48

limit check

Front 49

Giving users regular, periodic reminders about security policies and training in complying with them is an example of which of the following trust services criteria?

Back 49

effective communication of policies

Front 50

Parity bits provide protection against:

Back 50

data transmission errors

Front 51

Which are the three important factors determining the strength of any encryption system?

Back 51

1. encryption algorithm
2. key length
3. key management policies

Front 52

The best method to reduce the risk of unauthorized access to data while it is transmitted across communication lines (electronic eavesdropping) is:

Back 52

data encryption

Front 53

Which of the following is not associated with asymmetric encryption?

Back 53

speed

Front 54

The capability of a system to perform when one or more of its components has failed is called:

Back 54

fault tolerance

Front 55

An arrangement for backup facilities that has a completely operational facility, including a computer configured to match the organization's needs is called a:

Back 55

hot site

Front 56

A batch total that represents total cash receipts is called a:

Back 56

financial total

Front 57

The edit check that would detect the entry of a customer number that does not exist:

Back 57

validity check

Front 58

A more rigorous test of the effectiveness of an organization's computer security.

Back 58

penetration test

Front 59

The edit check most likely to discover a transposition error in entering a part number:

Back 59

check digit verification

Front 60

The edit check that compares the amount of the salary raise to the base salary to flag an possible errors is called a:

Back 60

reasonableness test

Front 61

Which step would be inappropriate in trying to achieve good control over program changes?

Back 61

prohibiting all changes

Front 62

The device that connects an organization's information system to the Internet is a

Back 62

router

Front 63

Periodic creation of a copy of the database at a point in time is called:

Back 63

a checkpoint

Front 64

This protocol specifies the procedures for dividing files and documents into packets to be sent over the Internet

Back 64

transmission control protocol

Front 65

A backup computer center that has everything necessary to quickly install computer equipment in case of a disaster is called a _______.

Back 65

cold site

Front 66

This protocol specifies the structure of packets sent over the internet and the route to get them to the proper destination.

Back 66

Internet protocol

Front 67

Suppose a batch of data needs to be transmitted on data communication lines as part of its processing. The sending unit computes a summary measure of the data sent and the receiving unit computes the same summary measure on the data received. The totals are then compared. This is called a(n):

Back 67

echo check

Front 68

Which of the following describes on weakness of encryption?

Back 68

encrypted packets cannot be examined by a firewall

Front 69

A batch total that equals the sum of all part numbers ordered is called a:

Back 69

hash total

Front 70

Which of the following is not one of the 10 internationally recognized best practices for protecting the privacy of customers' personal information?

Back 70

reimbursement

Front 71

The control that would be used to ensure that all pay rates were less than $25.35 per hour is a(n):

Back 71

limit check

Front 72

This compares the results produced by more than one method to verify accuracy

Back 72

cross-footing balance test

Front 73

An on-line system asks the user for each item to be entered. This is called:

Back 73

prompting

Front 74

This protects records from errors that occur when two or more users attempt to update the same record simultaneously.

Back 74

concurrent update controls

Front 75

Allowing customers to access and alter information about themselves within the corporate information system is

Back 75

a best practice of privacy