NEW
Font size
WorksheetsRoadtoCertificate Week1
Total questions: 10
Worksheet time: 10mins
1. Which of the following is the PRIMARY purpose of a risk-based audit?
High-impact areas are addressed first.
Audit resources are allocated efficiently.
Material areas are addressed first.
Management concerns are prioritized.
2. An IS auditor notes that failed login attempts to a core financial system are automatically logged and the logs are retained for a year by the organization. This logging is:
An effective preventive control.
A valid detective control.
Not an adequate control.
A corrective control.
3. A centralized antivirus system determines whether each personal computer has the latest signature files and installs the latest signature files before allowing a PC to connect to the network. This is an example of a:
Directive control
Corrective control
Compensating control
Detective control
4. An IS auditor is reviewing a project risk assessment and notices that the overall residual risk level is high due to confidentiality requirements. Which of the following types of risk is normally high due to the number of unauthorized users the project may affect?
Control risk
Compliance risk
Inherent risk
Residual risk
5. An IS auditor is carrying out a system configuration review. Which of the following is the BEST evidence in support of the current system configuration settings?
System configuration values that are imported to a spreadsheet by the system administrator
Standard report with configuration values that are retrieved from the system by the IS auditor
Dated screenshot of the system configuration settings that are made available by the system administrator
Annual review of approved system configuration values by the business owner
6. In a risk-based IS audit, where both inherent and control risk have been assessed as high, an IS auditor would MOST likely compensate for this scenario by performing additional:
Stop-or-go sampling
Substantive testing
Compliance testing
Discovery sampling
7. Which of the following should be the FIRST action of an IS auditor during a dispute with a department manager over audit findings?
Retest the control to validate the finding
Engage a third party to validate the finding
Include the finding in the report with the department manager's comments
Revalidate the supporting evidence for the finding
8. A PRIMARY benefit derived for an organization employing control self-assessment techniques is that it:
Can identify high-risk areas that might need a detailed review later.
Allows IS auditors to independently assess risk
Can be used as a replacement for traditional audits
Allows management to relinquish responsibility for control
9. An IS audit department considers implementing continuous auditing techniques for a multinational retail enterprise that requires high availability of its key systems. A PRIMARY benefit of continuous auditing is that:
Effective preventive controls are enforced.
System integrity is ensured.
Errors can be corrected in a timely fashion.
Fraud can be detected more quickly.
10. Which of the following represents the GREATEST potential risk in an electronic data in (EDI) environment?
Lack of transaction authorizations
Loss or duplication of EDI transmissions
Transmission delay
Deletion or manipulation of transactions prior to, or after, establishment of application controls
