Activity2

In a risk based audit where both inherent and control risks have been assessed as high, and IS auditor will most likely perform:

• Substantive Testing

• Compliance Testing

• Discovery Sampling

• Stop-or-Go Sampling

An IS Auditor notes unapproved IT policies, but notes employees strictly following these policies. The IS auditor should:

• Ignore it because employees follow policies strictly

• Recommend immediate approval of policies

• Emphasize the approval of policies to management

• Report the absence of documented approval of policies

Which of the following is the best reason for placing conditions on secondary employment of IT employees:

• to prevent misuse of corporate resources

• to prevent conflict of interest

• to prevent employee performance issues

• to prevent theft of IT assets and information of the company

While reviewing information security policy, which of the following is of the BIGGEST concern for the IS Auditor:

• The policy has not been updated in more than one year

• The policy includes no revision history

• Policy is approved by security administrator

• No information security policy committee was formed to draft the policy

An IS Auditor is reviewing the software development methodology of an organization that has adopted Agile methodology. IS Auditor will be MOST concerned with:

• Certain Iterations producing unfinished code

• Not extensive documentation

• Continuous preplanning of the project

• Managers do not mange project resources, delegating these to team members

Two factor authentication can be circumvented through which of the following attacks:

• Denial of Service

• Man-in-the-Middle

• Brute force

• keylogging

Which of the following anti-spam filtering methods has the lowest possibility of false positive alerts?

• Rule based

• check sum based

• heuristic filtering

• Statistic based

Which of the following is the GREATEST concern with Peer-to-Peer computing?

• Virus infection

• Data leakage

• network performance issues

• unauthorized software usage

Validated digital signatures in an email software application will ensure:

• help detect spam

• provide confidentiality

• add to workload of email gateway servers

• significantly reduce available bandwidth

Which of the following provides the most relevant information for proactively strengthening security settings:

• Bastion host

• Intrusion detection system

• Honeypot

• Intrusion Prevention System