Mis Exam 3

Front 1

Which of the following is a type of control that is used to ensure the development of a high quality, reliable information system?

Back 1

D) all of the above

Front 2

Why is it important for a system analyst to document formal as well as informal systems within an organization?

Back 2

B) the usage of an informal system by users means that the formal system is deficient in some way and users have designed ways to work around it.

Front 3

Which of the following elements usually includes subcomponents to filter, translate, store, and correct data that flows through it?

Back 3

D) interface

Front 4

Using a sales tracking system as an example, the customer orders and customer returns of goods are examples of which type of system components?

Back 4

B) inputs

Front 5

Using a payroll system as an example, paychecks and W-2 forms are examples of which of the following system elements?

Back 5

A) outputs

Front 6

In basic systems terminology, the process of breaking down a system into successive levels of subsystems is called:

Back 6

D) hierarchical decomposition.

Front 7

A numerical digit based on the other digits within a numerical identifier is referred to as a:

Back 7

B) check digit.

Front 8

Which of the following is an example of a goal of hierarchical decomposition?

Back 8

B) to analyze or change only part of the system

Front 9

Which of the following is not an example of a principal method for system decoupling?

Back 9

D) benchmarking

Front 10

A physical system description depicts ________ the system operaters, while a logical system description depicts ________ the system does.

Back 10

A) how; what

Front 11

Which of the following system descriptions depicts the function and purpose (the what) of the system without reference to, or implications for, the actual way in which the system will be implemented?

Back 11

B) logical system description

Front 12

Which is a basic principle of business process reengineering (BPR) suggested by Hammer ?

Back 12

A) integrating information processing into the work that produces the information

Front 13

As defined in the textbook, the generic systems development life cycle consists of the following three phases:

Back 13

B) definition, construction, and implementation.

Front 14

Which of the following best describes the definition phase of the systems life cycle?

Back 14

C) Business and systems professionals document systems needs and feasibility.

Front 15

Which of the following best describes the construction phase of the systems life cycle?

Back 15

A) The system is functionally designed, and then its physical design is specified.

Front 16

Which of the following describes an early step in the implementation phase of the systems life cycle?

Back 16

Data and procedures from the old system are converted

Front 17

Procedural-oriented approaches to systems design first involve the:

Back 17

As-Is model.

Front 18

When a physical model of a system is depicted with a diagram, cylinders are used to represent:

Back 18

databases

Front 19

Which of the following technique is most closely associated with the Logical To-Be model?

Back 19

data flow diagram

Front 20

Which of the following is not graphically represented in a data flow diagram (DFD)?

Back 20

sender

Front 21

When developing a logical data flow diagram, a circle indicates:

Back 21

a process component.

Front 22

When developing a logical data flow diagram, a rectangle (or open rectangle) indicates:

Back 22

data at rest.

Front 23

The most common approach to defining data elements in a DFD is to create a(n):

Back 23

data dictionary/directory.

Front 24

All of the following are tools for representing the Logical To-Be model of an information system except a(n):

Back 24

program chart.

Front 25

In the object-oriented (O-O) approach to software engineering, the term "encapsulation" refers to:

Back 25

storing data and related operations together within objects.

Front 26

26) Which of the following diagrams is not part of the Unified Modeling Language for O-O modeling?

Back 26

context diagram

Front 27

27) Which of the following statements is not true about system testing controls in the construction phase of the systems life cycle?

Back 27

Users are not involved in system testing.

Front 28

What set of international guidelines includes an extensive set for implementation management practices against which firms can benchmark their own practices?

Back 28

ITIL

Front 29

Controls for the validity of data entered into an application program (such as ensuring that only numbers are entered into a numeric field) are referred to as:

Back 29

edit rules.

Front 30

Security measures that are concerned with whether or not users can run an application, read a file, or change data in a database, or can change who can access to data that others have created are referred to as:

Back 30

logical access controls.

Front 31

One of the fundamental principles of systems analysis and design (SA&D) is that the logical system should be described before the physical system.

Back 31

TRUE

Front 32

System testing only occurs when systems are initially developed.

Back 32

FALSE

Front 33

In general, the term "system" is defined as a set of interrelated components that must work together to achieve some common purpose.

Back 33

TRUE

Front 34

The SDLC phase that typically requires the greatest percentage of the total cost for a custom development project is the ________ phase.

Back 34

construction

Front 35

During the feasibility analysis phase of the SDLC, which of the following types of feasibility is not assessed?

Back 35

time-driven

Front 36

Who usually takes primary responsibility for establishing the custom development costs for an SDLC project?

Back 36

IS analyst

Front 37

The ________ approach to systems development has often been referred to as the "waterfall" model.

Back 37

SDLC

Front 38

Deciding what hardware and systems software will be used to operate the system and defining the processing modules that will comprise the system are part of which SDLC step?

Back 38

system design

Front 39

Testing a new custom system before implementation is the responsibility of:

Back 39

both users and IS analysts.

Front 40

Which of the following accurately describes the order in which a system is tested?

Back 40

module testing, subsystem testing, integration testing, acceptance testing

Front 41

A conversion strategy whereby an organization continues to operate the old system together with the new one for one or more cycles, until the new system is working properly and the old system can be discontinued, is called a:

Back 41

parallel strategy.

Front 42

A conversion strategy whereby the new system is first implemented in only part of the organization to solve any problems before implemented in the rest of the organization is called a:

Back 42

pilot strategy.

Front 43

The following diagram depicts which of the following conversion strategies? zig zag

Back 43

phased strategy

Front 44

The following diagram depicts a cutover conversion strategy. Which of the following best characterizes this type of conversion strategies? Straight line

Back 44

risky

Front 45

The percentage of resources devoted to the maintenance of a system:

Back 45

generally increases over time.

Front 46

Which of the following is not typically the responsibility of an IT project manager?

Back 46

approve funds for the project

Front 47

Which of the following best describes a responsibility of a systems analyst?

Back 47

develop detailed system requirements

Front 48

Which prototyping step is not the responsibility of the system builders?

Back 48

use prototype and note desired changes

Front 49

Which of the following is not an advantage of prototyping?

Back 49

End-prototype typically has more security and control features than a system developed with an SDLC process.

Front 50

Which of the following is typical for a pure prototyping approach?

Back 50

all of the above

Front 51

When prototyping is incorporated into a traditional SDLC approach, it is most commonly included as part of which of the following steps?

Back 51

requirements definition

Front 52

Which of the following best describes a common prototyping goal when it is used as part of a prototyping/piloting approach?

Back 52

both A and B

Front 53

Which of the following is a technique where a team of users and IS specialists engage in an intensive session to minimize the total time required for gathering information from multiple participants?

Back 53

JAD

Front 54

A software tool used to automate one or more steps of a software development methodology is referred to as:

Back 54

CASE.

Front 55

All of the following are considered advantages to using RAD methodology, except:

Back 55

system quality much higher than with SDLC.

Front 56

Which is a potential advantage of having an application developed by a business user, rather than an IS professional?

Back 56

all of the above

Front 57

Which is not a potential disadvantage of having an application developed by a business user, rather than an IS professional?

Back 57

Users typically pay more attention to system controls for ensuring data quality and security, and therefore development costs are higher.

Front 58

What three characteristics should be evaluated by organizations when choosing whether or not to have a non-IS professional develop a new application?

Back 58

application, development tool, and developer characteristics

Front 59

What is a specific characteristic of an application that can be important for determining the potential risks of developing a new business application by an employee with no professional IS training?

Back 59

both A and B

Front 60

A common shortcoming of user-developed applications is:

Back 60

inadequate knowledge of the business problem.

Front 61

Which of the following is not a characteristic of eXtreme Programming (XP)?

Back 61

it works best when developing large-scale, complex transaction processing systems

Front 62

The agile method that emphasizes independent project teams, coordination and communication between and within teams with lots of team meetings, iterative and continuous monitoring of work, team ownership of the final product is called:

Back 62

Scrum.

Front 63

Which of the following is not a key guideline for managing day-to-day interactions with outsourced staff?

Back 63

closely monitor and manage the work of the outsourcer's staff

Front 64

The parallel strategy of installing a new system is the riskiest method of installation because the old system is abandoned as soon as the new system is implemented.

Back 64

FALSE

Front 65

The Construction phase of the SDLC involves installation and operations of the new system.

Back 65

FALSE

Front 66

The SDLC methodology is the best methodology when an application needs to be quickly developed.

Back 66

FALSE

Front 67

Agile methodologies are especially useful for developing smaller systems rather than largescale transaction processing applications.

Back 67

TRUE

Front 68

A type of testing where the objective is to make sure that the system performs reliably and does what it is supposed to do in a user environment is referred to as user acceptance testing.

Back 68

TRUE

Front 69

When a change made to one part of a system results in unexpected changes to another part of the system, it is commonly referred to as a ripple effect.

Back 69

TRUE

Front 70

Some consultants have claimed that up to one-third of all spreadsheets contain errors, which can include mechanical errors (typos), errors in logic, as well as errors in omission.

Back 70

TRUE

Front 71

When considering the purchase of a major software application, managers need to also consider the following potential downside:

Back 71

The package seldom totally fits the company's needs.

Front 72

Which statement is not true about using an ASP purchasing option?

Back 72

A 3rd-party organization delivers the software functionality via the Internet.

Front 73

If an organization purchases a software package and does not modify or add to the package in-house, the construction phase then is often limited to which step?

Back 73

system testing

Front 74

When comparing a traditional SDLC and a purchasing life cycle methodology, which step is found in a modified SDLC approach but not in a traditional SDLC?

Back 74

establish evaluation criteria

Front 75

When purchasing a software package, a successful definition phase ends with a(n):

Back 75

vendor contract.

Front 76

Being an Alpha site usually means that the client company:

Back 76

plays a significant role in determining the functionality of the package.

Front 77

Being a Beta site usually means that the company:

Back 77

plays a significant role in user acceptance testing for the vendor.

Front 78

plays a significant role in user acceptance testing for the vendor.

Back 78

more, less

Front 79

Which criterion should a firm consider when evaluating candidate software packages?

Back 79

all of the above

Front 80

The acronym RFP stands for:

Back 80

request for proposal.

Front 81

In addition to evaluating the vendors' responses from the formal RFP process, what other type of data collection for a leading candidate package is recommended?

Back 81

both A and B

Front 82

When matching a company's needs with the capabilities of a software package, an alternative to address a mismatch is:

Back 82

both A and B

Front 83

Which of the following statements about choosing alternative packages is false?

Back 83

If modifications are made to a package, it will not impact what modifications may need to be made when the vendor releases an upgraded version of the package.

Front 84

A contract with a vendor usually does not include:

Back 84

feasibility analysis.

Front 85

With a cost-reimbursement type of contract, the greatest risk is assumed by:

Back 85

the purchasing company.

Front 86

With a fixed-price contract, the greatest risk is typically assumed by:

Back 86

the vendor.

Front 87

Options for modifying the code of a purchased package include:

Back 87

all of the above

Front 88

Which of the following is a factor that can affect the success of the installation plan for a purchased package?

Back 88

all of the above

Front 89

A change management program as part of an IT project is used to:

Back 89

avoid resistance by business users to a new system being implemented.

Front 90

Which of the following activities is not part of the installation step of the SDLC for a purchased package?

Back 90

acceptance testing

Front 91

Which of the following statements about having a vendor perform package maintenance is false?

Back 91

Vendors continue to support all prior versions of a package.

Front 92

What types of employees outside of an organization's IS department may be involved in a purchased software project?

Back 92

) all of the above

Front 93

If extensive changes in business processes and procedures are needed to effectively implement the purchased software, business managers are typically asked to take the role of:

Back 93

project manager.

Front 94

Successful implementation of a purchased software package typically depends upon:
A) how much the package costs.

Back 94

how well the Definition phase was conducted.

Front 95

A primary advantage of purchasing an existing software package rather than developing a custom application is:

Back 95

IS people resources can be dedicated to projects for systems that can't be purchased.

Front 96

Which of the following is a long-term advantage of purchasing packaged systems?

Back 96

both A and C

Front 97

Which is not a potential disadvantage of purchasing packaged systems?

Back 97

costs more than if custom developed (in-house or contractor)

Front 98

Which of the following statements about purchasing enterprise system packages is false?

Back 98

ERP systems typically involve a lot of custom interfaces to legacy systems.

Front 99

Which of the following is not a critical success factor for ERP project success?

Back 99

The ERP system should be customized to match current business processes.

Front 100

Which is not an advantage of open source software?

Back 100

Complete documentation for the software is freely available.

Front 101

An RFP should be sent to as many vendors as possible.

Back 101

FALSE

Front 102

When there are discrepancies between a package's capabilities and a company's needs, the only way to deal with the discrepancies is by modifying the package.

Back 102

FALSE

Front 103

Employee training is part of the installation step of the SDLC.

Back 103

TRUE

Front 104

Choosing between building a custom application and purchasing a software package is called a make-or-buy decision.

Back 104

TRUE

Front 105

For large enterprise system packages, it is common for companies to contract with a consulting firm, called a third-party implementation partner, to provide installation and maintenance support.

Back 105

TRUE

Front 106

A company that elects to use a "hosted" application rather than to purchase the software application and host it on its own equipment, is making use of a(n) application service provider (or ASP).

Back 106

TRUE

Front 107

Open source software is well-suited for very specialized applications and business processes.

Back 107

FALSE

Front 108

What is the approximate total business loss (in U.S. dollars) resulting from the largest reported customer data security breach to date involving retailers or financial institutions as of 2010?

Back 108

1 billion

Front 109

When a web site mimics a legitimate site for the purpose of misleading or defrauding an Internet user, it is called:

Back 109

spoofing.

Front 110

Hackers can be differentiated from crackers by:

Back 110

their level of malicious intent.

Front 111

Which type of employee does not need to be aware of basic types of information security technologies?

Back 111

none of the above

Front 112

Research has shown that an organization's inability to return to normal business activities after a major disruption is a key predictor of:

Back 112

business survival.

Front 113

Which of the following is a typical statement included in an organization's acceptable use policy?

Back 113

all of the above.

Front 114

What is just beginning to be addressed in organizations' acceptable-use policies?

Back 114

usage of social media

Front 115

Which of the following must an organization's management do if HIPAA applies to its activities?

Back 115

assign a person or persons to be responsible for HIPAA compliance

Front 116

What is the best term to describe those who break into computers to steal information, wipe out hard drives, or do others harm?

Back 116

crackers

Front 117

Why is it difficult for companies to manage their e-mail on their own private subnets?

Back 117

all of the above

Front 118

Determining a Return Benefit for a specific security action is based on which of the following?

Back 118

annualized Expected Losses and Annualized Cost of Actions

Front 119

What are sources to use to calculate a single loss expectancy as part of a risk assessment?

Back 119

both A and B

Front 120

Which organizational position is directly responsible for the balancing of an organization's security risks with the costs to avoid them?

Back 120

the CSO

Front 121

Which of the following is one of the areas in which controls are assessed by auditors using the COSO framework?

Back 121

all of the above

Front 122

Which of the following is not one of the rules that the GLBA gives federal agencies and states the ability to enforce?

Back 122

Credit Information Rule

Front 123

What effect does The PATRIOT Act passed by Congress have on the U.S. government's ability to access an individual's personal information?

Back 123

significantly strengthens

Front 124

What are some of the benefits to organizations with written privacy policies?

Back 124

all of the above

Front 125

Which of the following is not one of the common policy areas generally included in an information security policy?

Back 125

Usage of Social Security Number Policies. (e.g., whether it is an identifier)

Front 126

Putting plans in place to ensure that employees and business processes can continue when faced with any major unanticipated disruption is called:

Back 126

Business Continuity Planning.

Front 127

What are some means to deal with key information security management issues?

Back 127

all of the above

Front 128

Which position is responsible for continually assessing an organization's information security risks and developing and implementing effective countermeasures?

Back 128

CSO or CISO

Front 129

Which statement about computer crimes is not true?

Back 129

Data and application encryption are not considered robust security approaches

Front 130

What should an ERM manager (or an ERM committee) be responsible for?

Back 130

classifying specific records based upon their importance, regulatory requirements, and duration.

Front 131

BCP shortcomings recently identified during crises include:

Back 131

all of the above

Front 132

The Sarbanes-Oxley act requires officers of publicly traded companies in the U.S. to certify that:

Back 132

they are responsible for establishing and maintaining internal financial controls

Front 133

Creating a BCP in the U.S. requires:

Back 133

identifying interdependencies between critical business processes and business units.

Front 134

Which of the following is the recommended means for disseminating an organization's information security policy?

Back 134

all of the above

Front 135

A denial of service attack is implemented by simultaneously sending a large number of messages to a target computer to create a computer or communications overload, so that legitimate users cannot obtain access.

Back 135

TRUE

Front 136

A worm is a virus that has the ability to copy itself from machine to machine, usually over a network.

Back 136

TRUE

Front 137

Due to several recent laws regarding information security, it is a good practice to provide existing civil and criminal laws rather than have a company-specific information security policy.

Back 137

FALSE

Front 138

Primary sources of thefts of intellectual property rights, trade secrets, and research and development knowledge are employees.

Back 138

TRUE

Front 139

The goal of the IS manager responsible for information security is to eliminate all information risk.

Back 139

FALSE

Front 140

Electronic Records management (ERM) practices became a more important information security management issue in the U.S. in 2006 when new legislation established new rules for timely information gathering in response to potential litigation.

Back 140

TRUE

Front 141

Which is not a social problem that is perceived to have increased due to information technology?

Back 141

difficulties in connecting with people in other regions of the world

Front 142

Which of the following is not a reason that legal systems in developed countries have not kept up with available information technologies?

Back 142

The existing laws can easily be reinterpreted to apply to new technologies.

Front 143

Ethical problems associated with the use of IT may affect all of the following except:

Back 143

all of the above

Front 144

Approximately what percentage of the U.S. public is quite sensitive to the loss of privacy of their personal information?

Back 144

25%

Front 145

Which large Internet advertising company has caused concerns among privacy organizations due to its purchase or alliance with other companies?

Back 145

DoubleClick

Front 146

What is a reason for including ethics discussions in an IT management forum?

Back 146

both A and B

Front 147

According to the textbook, which of the following is also an ethical behavior that is recognized by most world religions?

Back 147

treat others as you would like them to treat you

Front 148

In the context of developing and using IT, what is the common flaw in ethical reasoning?

Back 148

ignoring some affected parties

Front 149

Sending an e-mail that falsely claims to be a legitimate enterprise in an attempt to scam the user into providing private information is called:

Back 149

phishing.

Front 150

Which is not true about the impacts of identity theft today?

Back 150

none of the above

Front 151

Which of the following is true about investigations of identity theft in the U.S. today?

Back 151

both A and C

Front 152

Which statement is true concerning privacy in the U.S.?

Back 152

a great deal of legislation that purports to offer some privacy protection

Front 153

Which of the following is not a characteristic of intellectual property (IP)?

Back 153

sharing IP has become more difficult over the years

Front 154

When a customer wants to "opt-out" from a U.S. company sharing his or her information with third parties:

Back 154

it often takes a lot of effort and time for customers to understand how to accomplish it.

Front 155

The U.S. position on privacy can be characterized as being favorable toward:

Back 155

consumer data are primarily viewed as a saleable, usable asset that belongs to the corporation that collected the data.

Front 156

According to the Federal Trade Commission, "someone appropriating your personal information without your knowledge to commit fraud or theft" is called:

Back 156

an identity theft.

Front 157

Advances in artificial intelligence can raise social and ethical issues because:

Back 157

all of the above

Front 158

A "cookie" is:

Back 158

a small record stored on the user's computer that identifies the user to a Web site.

Front 159

In the U.S., the only federal law that limits employer surveillance of its workers is related to:

Back 159

eavesdropping on spoken personal conversation.

Front 160

Which of the following regions has the lowest rate of software piracy?

Back 160

North America

Front 161

Which of the following prevents someone else from creating another computer program that does the same thing as a copyrighted program?

Back 161

patents.

Front 162

What type of impact on the software industry from awarding a large number of patents to IT industry giants such as Microsoft has been documented?

Back 162

the growth of small software firms is inhibited

Front 163

Software piracy:

Back 163

typically is not rigorously deterred by governments in less developed countries.

Front 164

Which of the following is true of patents?

Back 164

gives the creator the exclusive right to the manufacture and uses what has been patented for a limited period of time

Front 165

Recent piracy rates for music CDs were highest in:

Back 165

Indonesia and Paraguay.

Front 166

Swapping or sharing music on the Internet:

Back 166

first gained widespread popularity with the advent of Napster.

Front 167

In 2007, Microsoft asserted that 235 company patents were infringed upon by open source programs. What effect did this announcement have?

Back 167

it slowed down the growth of open source communities.

Front 168

Which of the following is true regarding personal financial credit reports?

Back 168

inaccuracies are not usually spotted because many individuals do not review their reports regularly

Front 169

In a recent survey, what percentage of students studying in a sample of U.S. colleges and universities said it is always wrong to pirate music and movies?

Back 169

more than 10% but less than 25%

Front 170

Amazon.com settled a lawsuit with Barnes and Noble in March 2002 that centered on the infringement of what patent?

Back 170

its "one-click-ordering" process

Front 171

The U.S. has much stronger privacy laws and practices than Europe.

Back 171

FALSE

Front 172

U.S. copyright laws make it illegal to copy software and use it without the software vendor's permission.

Back 172

TRUE

Front 173

A patent gives its creator the exclusive right to the manufacture and use of a new design or method for a limited period of time.

Back 173

TRUE

Front 174

Some ethical issues are viewed differently depending upon the culture in which they arise.

Back 174

TRUE

Front 175

According to the Federal Trade Commission (FTC), identify theft is "someone appropriating your personal information without your knowledge to commit fraud or theft."

Back 175

TRUE