Computer Security - IT Audit

IT _____________ is a process that provides assurance for IT and IS and helps to mitigate risks associated with use of technology.

• control
• governance
• risk management
• review

An internal audit is typically conducted by auditors who work for the organization, but this task may be outsourced to other organizations.

• True
• False

Which of the following components is not part of IT governance?

• control planning
• security assessment
• managing incident response
• control development

Which of the following components is not part of IT compliance?

• IT audit
• security assessment
• control development
• IT compliance assessment

An audit _____________ outlines the overall authority, scope and responsibilities of the audit function.

• exit report
• comprehensive report
• letter of intent
• charter

Fieldwork is part of the ______________ process

• assessment
• reporting
• follow-up
• planning

The audit response verification can be obtained at the _______________ stage of an IT audit.

• assessment
• report
• follow-up
• planning

The scope of an IT audit often varies, but can involve any combination of the following:

• organizational, compliance, application and social
• organizational, compliance, application and technical
• regional, compliance, application and technical
• organizational, compliance, systems and technical

Which of the following is an IT security audit program goal?

•  Provide an objective and independent review of an organization’s policies, information systems and controls.
•  Provide reasonable assurance that appropriate and effective IT controls are in place.
•  Provide audit recommendations for both corrective actions and improvement to controls.
• All of the answers are correct.

A threat profile refers to:

• what is the likelihood of the threats happening.
• what threats or risks will affect the asset.
• what impact or effect would the loss of the asset have on the operation of the organization or its personnel.
• All of the above are correct.