1. Which of the following is the PRIMARY purpose of a risk-based audit?

• High-impact areas are addressed first.

• Audit resources are allocated efficiently.

• Material areas are addressed first.

• Management concerns are prioritized.

2. An IS auditor notes that failed login attempts to a core financial system are automatically logged and the logs are retained for a year by the organization. This logging is:

• An effective preventive control.

• A valid detective control.

• Not an adequate control.

• A corrective control.

3. A centralized antivirus system determines whether each personal computer has the latest signature files and installs the latest signature files before allowing a PC to connect to the network. This is an example of a:

• Directive control

• Corrective control

• Compensating control

• Detective control

4. An IS auditor is reviewing a project risk assessment and notices that the overall residual risk level is high due to confidentiality requirements. Which of the following types of risk is normally high due to the number of unauthorized users the project may affect?

• Control risk

• Compliance risk

• Inherent risk

• Residual risk

5. An IS auditor is carrying out a system configuration review. Which of the following is the BEST evidence in support of the current system configuration settings?

• System configuration values that are imported to a spreadsheet by the system administrator

• Standard report with configuration values that are retrieved from the system by the IS auditor

• Dated screenshot of the system configuration settings that are made available by the system administrator

• Annual review of approved system configuration values by the business owner

6. In a risk-based IS audit, where both inherent and control risk have been assessed as high, an IS auditor would MOST likely compensate for this scenario by performing additional:

• Stop-or-go sampling

• Substantive testing

• Compliance testing

• Discovery sampling

7. Which of the following should be the FIRST action of an IS auditor during a dispute with a department manager over audit findings?

• Retest the control to validate the finding

• Engage a third party to validate the finding

• Include the finding in the report with the department manager's comments

• Revalidate the supporting evidence for the finding

8. A PRIMARY benefit derived for an organization employing control self-assessment techniques is that it:

• Can identify high-risk areas that might need a detailed review later.

• Allows IS auditors to independently assess risk

• Can be used as a replacement for traditional audits

• Allows management to relinquish responsibility for control

9. An IS audit department considers implementing continuous auditing techniques for a multinational retail enterprise that requires high availability of its key systems. A PRIMARY benefit of continuous auditing is that:

• Effective preventive controls are enforced.

• System integrity is ensured.

• Errors can be corrected in a timely fashion.

• Fraud can be detected more quickly.

10. Which of the following represents the GREATEST potential risk in an electronic data in (EDI) environment?

• Lack of transaction authorizations

• Loss or duplication of EDI transmissions

• Transmission delay

• Deletion or manipulation of transactions prior to, or after, establishment of application controls