NEW
Font size
WorksheetsIT General Controls - Set A
Total questions: 25
Worksheet time: 33mins
1. These are vital for safeguarding information systems and ensuring data integrity and security.
a) Network segmentation
b) Network authentication
c) Security controls
d) IT general controls
2. Which of the following actions would NOT be considered a preventive IT control?
a) User password complexity requirements
b) Antivirus software installation
c) System vulnerability scanning
d) Conducting system audits after an incident
3. It involves real-time tracking of system activities and configurations to detect anomalies and ensure compliance with security policies.
a) Checking
b) Continuous monitoring
c) Compliance assurance
d) SOC 2
4. It is performed to evaluate the effectiveness of internal controls and pinpoint areas where processes can be improved.
a) Authentication
b) Monitoring
c) Audit
d) Cross-checking
5. Which of the following is a key factor in ensuring the effectiveness of IT General Controls?
a) Allowing users to make changes to system settings without approval
b) Constant software updates
c) Clear communication of policies and procedures to all employees
d) Giving all users full access to company data
6. It is essential for safeguarding data against loss and ensuring rapid recovery in the event of incidents.
a) Data Follow-Up and Recovery
b) Data Restoration
c) Data Backup and Recovery
d) Data Protection
7. Which statement/s is/are incorrect?
I. All changes should be documented and tracked to ensure accountability.
II. Implementing a structured change management process helps organizations effectively manage change while maximizing risks.
III. A strong change management process protects organizations from potential security vulnerabilities that could emerge during transitions.
IV. Approval processes ensure that only necessary and unauthorized changes are implemented.
a) II, III, and IV
b) II and IV
c) I, II, and III
d) III and IV
8. _____________________ involves verifying the identity of users attempting to access systems, while _____________________ ensures they have the necessary permissions. Effective methods include passwords, biometrics, and multi-factor authentication.
a) User authorization; authentication
b) Access control; authentication
c) Authorization; user authentication
d) User authentication; authorization
9. Which of the following best describes the concept of "data integrity" in an IT system?
a) Preventing unauthorized access to confidential data
b) Ensuring that data is complete, accurate, and consistent over its lifecycle
c) Encrypting all sensitive data
d) Monitoring for suspicious activities
10. Which of the following is NOT a typical responsibility of an IT department when implementing general controls?
a) Establishing and enforcing system security policies
b) Managing user accounts and permissions
c) Conducting financial audits for internal controls
d) Ensuring the system remains available and resilient to threats
11. Which of the following is NOT typically part of IT General Controls?
a) Access control
b) Backup procedures
c) User training
d) Data encryption
12. Which statement/s is/are incorrect?
I. IT general controls ensure the accuracy and reliability of data by implementing frail management policies.
II. By implementing IT general controls, organizations can effectively minimize potential risks associated with data breaches and compliance.
III. Change management controls assist in overseeing modifications to IT systems and processes, reducing the risks linked to those changes.
IV. Access controls are crucial for managing who can access or utilize resources within an IT environment, ensuring sensitive information remains secure.
a) I and IV
b) II and III
c) I, II, and III
d) I and II
13. Which of the following is/are an example/s of authentication methods used to ensure security in IT General Controls?
a) Control authentication
b) Policy authentication
c) Token-based authentication
c) Access Control
14. The change management process involves:
a) strategizing, testing, and authorizing changes to IT systems to minimize disruptions and maintain compliance with security protocols
b) testing, planning, and approving changes to IT systems to minimize disruption and ensure compliance with security standards.
c) scoping and approving changes to IT systems to minimize disruption and ensure compliance with security standards.
d) planning and testing changes to IT systems to minimize disruptions and maintain compliance with security protocols
15. Which of the following is true about access controls in ITGC?
a) Access controls are only needed for applications, not for operating systems
b) Access controls ensure that users have the appropriate level of access to data and systems
c) Access controls should only be applied after a data breach has occurred
d) Access controls are not necessary if encryption is used
16. What is the importance of data backup?
a) Data retrieval
b) Business resilience
c) Security measures
d) A, B, and C
e) A and B
17. What is the key goal of disaster recovery planning under ITGC?
a) To ensure that employees know how to operate backup systems
b) To ensure the company can restore its IT systems and data in the event of a disaster
c) To eliminate all physical threats to IT systems
d) To upgrade hardware systems during non-peak hours
18. The System Development Lifecycle (SDLC) includes several key phases. What are those?
a) analysis, planning, design, development, testing, and deployment
b) planning, analysis, design, testing, development, and deployment
c) planning, analysis, design, testing, and deployment
d) planning, analysis, design, development, testing, and deployment
19. Which of the following would be part of an organization's ITGC framework for ensuring confidentiality?
a) Implementing end-to-end encryption for sensitive communications
b) Providing full system access to all employees
c) Ignoring external threats and focusing only on internal controls
d) Limiting network traffic to ensure no downtime
20. It is essential to identify potential vulnerabilities in software development.
a) Security Testing
b) Conducting Risk Assessments
c) Secure Coding Practices
d) Security Development
21. What is the purpose of the segregation of duties in IT General Controls?
a) To ensure that there is clear documentation of system configurations
b) To ensure no one person has the authority to perform conflicting functions, minimizing the risk of fraud
c) To provide training to users on system usage
d) To set up automated reports for auditing
22. Which of the following best describes the concept of “logical security” in ITGC?
a) Implementing physical barriers to protect IT infrastructure
b) Establishing procedures for data backup
c) Securing data and systems through passwords, encryption, and access controls
d) Monitoring physical security of server rooms
23. In IT General Controls, “physical security” refers to:
a) The encryption of sensitive data
b) The protection of IT infrastructure from physical threats such as fire, theft, or natural disasters
c) The management of user passwords
d) The protection of electronic communication between devices
24. Which of the following is a key component of IT General Controls related to change management?
a) Ensuring no software updates are applied without proper testing and authorization
b) Allowing all employees to access administrative systems
c) Maintaining detailed user manuals for all software
d) Automatically backing up all data every hour
25. In ITGC, what is the purpose of a “user access review”?
a) To check if employees are following security policies
b) To ensure that employees have the appropriate access levels and privileges based on their roles
c) To identify which users need additional training on software
d) To test if users are correctly using system passwords
