ASI 3

An IS auditor is to assess the suitability of a service level agreement (SLA) between the organization and the supplier of outsourced services. To which of the following observations should the IS auditor pay the MOST attention? The SLA does not contain a:

• Transition clause from the old supplier to a new supplier in the case of expiration or termination.

• Late payment clause between the customer and the supplier

• Contractual commitment for service improvement

• Dispute resolution procedure between the contracting parties

An IS auditor reviewing a new outsourcing contract with a service provider would be MOST concerned if which of the following was missing?

• A clause providing a “right to audit” service provider

• A clause defining penalty payments for poor performance

• Predefined service level report templates

• A clause regarding supplier limitation of liability

When reviewing the desktop software compliance of an organization, the IS auditor should be MOST concerned if the installed software:

• Was installed, but not documented in the IT department records

• Was installed and the license has expired

• Is not listed in the approved software standards document

• License will expire in next 15 days

Due to a recent economic downturn, an IT organization has terminated several administrators at remote sites and consolidated all IT administration to the organization’s central headquarters. During the annual IT audit, the auditor determines that the organization has implemented remote admin connectivity to each site using low-cost DSL connections and an automated SNMP-based monitoring system to detect any hardware or software issues that may occur.

In the auditor’s mind, what should be the biggest area of concern?

• The authentication methods used for the remote admin may not be secure and default SNMP passwords may be in use

• Physical security at remote sites may not be adequate

• Terminated employees may retain access to systems at remote sites

• The connection to remote sites is secure through the use of a virtual private network (VPN)

An IT executive of an insurance company asked an external auditor to evaluate the user IDs for emergency access (fire call ID). The IS auditor found that fire call accounts are granted without a predefined expiration date. What should the IS auditor recommend?

• Review of the access control privilege authorization process

• Implementation of an identity management system (IMS)

• Enhancement of procedures to audit changes made to sensitive customer data

• Granting of fire call accounts only to managers

During an application audit, an IS auditor is asked to provide assurance of the database referential integrity. Which of the following should be reviewed?

• Field definition

• Master table definition

• Composite keys

• Foreign key structure

An IS auditor is reviewing database security for an organization. Which of the following is the MOST important consideration for database hardening?

• The default configurations are changed

• All tables in the database are normalized

• Stored procedures and triggers are encrypted

• The service port used by the database server is changed

In auditing a database environment, an IS auditor will be MOST concerned if the database administrator (DBA) is performing which of the following functions?

• Performing database changes according to change management procedures

• Installing patches or upgrades to the operating system

• Sizing table space and consulting on table join limitations

• Performing backup and recovery procedures

An IS auditor reviewing local area network (LAN) performance in an organization should FIRST examine:

• Connection and connection-less services

• The network topology diagram

• Data, voice and video throughput requirement

• The capacity of the wide area network (WAN) connection

An IS auditor is evaluating the effectiveness of the organization’s change management process.

What is the MOST important control that the IS auditor should look for to ensure system availability?

• That changes are authorized by IT managers at all times

• That user acceptance testing (UAT) is performed and properly documented

• That test plans and procedures exist and are closely followed

• That capacity planning is performed as part of each development project