ISA 3.0 ICAI module 1 ISA 3.0 ICAI module 1 ICAI DISA 3.0 QUESTION BANK : MODULE 1 :- STUDY MATERIAL BASED 1 / 65 1. Question: While planning an audit M/s InfoTech Solutions should have FIRST identified: Areas of High risk Skill sets of the audit staff. Test steps in the audit. Time allotted for the audit. Explanation: (a) When designing an audit plan, it is important to identify the areas of highest risk to determine the areas to be audited. (b) Skill sets of audit staff is an important consideration. However, unless risks are identified it will not be known how and where to utilize the skills. (c) Compliance test and substantial test can be effectively carried out only once auditor is aware about areas of high risk. (d) Allotment of time is important but not the first & primary step like identification of high-risk areas 2 / 65 2. Questions:: M/s InfoTech Solutions has decided to Skip Risk Assessment Process. What is the Primary Risk involved here? Resources may not be allocated to the areas of highest concern. Budgets are more likely to be met by the IS audit staff. May not able to complete assignment as per timelines defined in SLA. Senior Auditor may not take responsibility of Audit Observations. Explanation: Primary Risk involved here is critical risks are not identified and may remain unnoticed. Other areas are not of that concern. 3 / 65 3. Reviewing management's long-term strategic plans helps the IS auditor: Gains an understanding of an organization's goals and objectives Tests the enterprise's internal controls. Assess the organization's reliance on information systems Determine the number of audit resources needed. Question explanation: Strategic planning sets corporate or departmental objectives into motion. It is time and project-oriented, but must also address and help determine priorities to meet business needs. Reviewing long-term strategic plans will not achieve objectives by other choice. 4 / 65 4. When developing a risk-based audit strategy, an IS auditor should conduct a risk assessment to ensure that: Controls needed to mitigate risks are in place. Vulnerabilities and threats are identified. Audit risks are considered. Gap analysis is appropriate Question explanation: In developing a risk-based audit strategy, risks and vulnerabilities are to be understood. This determines areas to be audited and the extent of coverage. Understanding whether appropriate controls required to mitigate risks are in place is a resultant effect of an audit. Audit risks are inherent aspects of auditing, are directly related to the audit process and are not relevant to the risk analysis of the environment to be audited. Gap analysis would normally be done to compare the actual state to an expected or desirable state. 5 / 65 5. After you enter a purchase order in an on-line system, you get the message, “The request could not be processed due to lack of funds in your budget”. This is an example of error? Detection Correction Prevention Recovery Question explanation: To stop or prevent a wrong entry is a function of error prevention. All other options work after an error. Prevention works before occurrence of error. 6 / 65 6. Which of the following cannot be classified as Audit Risk? Inherent Risk Detection Risk Controllable Risk Administrative Risk Question explanation: Inherent risk means overall risk of management which is on account of entity’s business operations as a whole. Controllable risk is the risk present in the internal control system and the enterprise can control this risk completely and eliminate it from the system. Detection risk is the risk of the IS Auditor when he is not able to detect the inherent risk or the controllable risk. 7 / 65 7. What means the rate at which opinion of the IS Auditor would change if he selects a larger sample size? Audit Risk Materiality Risk Based Audit Controls Question explanation: Audit risk means the rate at which opinion of the IS Auditor would change if he selects a larger sample size. Audit risk can be high, moderate or low depending on the sample size selected by the IS Auditor. A risk-based audit approach is usually adapted to develop and improve the continuous audit process. Materiality means importance of information to the users. It is totally the matter of the professional judgment of the IS Auditor to decide whether the information is material or immaterial. 8 / 65 8. The rate of change in technology increases the importance of: Outsourcing the IS function Implementing and enforcing good processes Hiring personnel willing to make a career within the organisation Meeting user requirements Question explanation ; Rate of change of technology increases the importance of implementing and enforcing good practices. 9 / 65 9. Which of the following are most commonly used to mitigate risks discovered by organizations? Controls Personnel Resources Threats Question explanation: Controls are most commonly used to mitigate risks discovered by organizations. This is what organizations implement as a result of the risks an organization discovers. Resources and personnel are often expended to implement controls 10 / 65 10. To conduct a system audit, the IS auditor should Be technically at par with client’s technical staff Be able to understand the system that is being audited Possess knowledge in the area of current technology Only possess a knowledge of auditing. Question explanation: To conduct IS Audit by the IS Auditor, the primary requirement is that he should be able to understand the system and technology being audited. He is not required to be the expert in all subjects. There is no comparison of his knowledge with that of auditee’s staff. He should have the knowledge of audit along with the technology in the related subject of audit. 11 / 65 11. Which of the following control classifications identify the cause of a problem and minimize the impact of threat? Administrative Controls Detective Controls Preventive Controls Corrective Controls Question explanation: Corrective Controls classification identify the cause of a problem and minimize the impact of threat. The goal of these controls is to identify the root cause of an issue whenever possible and eliminate the potential for that occurring again. The other controls are useful but perform other functions instead. 12 / 65 12. The primary purpose and existence of an audit charter is to: Document the audit process used by the enterprise Formally document the audit department’s plan of action Document a code of professional conduct for the auditor Describe the authority and responsibilities of the audit department Explanation: An audit charter describes the authority, responsibility of the audit department. These are established by the senior management. 13 / 65 13. Question: The decisions and actions of Senior Auditor of M/s InfoTech Solutions are MOST likely to affect which of the following risks? Detection Inherent Control Business Explanation: (a) Detection risks are directly affected by the auditor's selection of audit procedures and techniques. (b) Inherent risks usually are not affected by the IS auditor. (c) Control risks are controlled by the actions of the company's management. (d) Business risks are not affected by the IS auditor. 14 / 65 14. Question: What should an IS Auditor do FIRST, when he observed that two users are constantly trying to access some external sources? Inform the management and expand the sample to get further evidences. Issue an Audit Finding Seek Explanations from Management Ask for clarification from the Firewall Vendor Question explanation : IS Audit and Assurance Standards suggest that an IS Auditor should gather sufficient and appropriate audit evidence on which his opinion is based. Here the IS Auditor needs to determine whether this is an isolated incident or a systematic failure. It would be a good practice to make management informed about the incident. 15 / 65 15. Question: An IS Auditor found one security loophole in the System. However, when the IT Management got to know about it, immediately corrected it. The IS Auditor should: Report the same in his Audit Report if the finding is material. Don’t include in the Audit Report as the same is corrected. Don’t include in the Audit Report but discuss the same in Exit Interview for recommendation. Don’t include in the Audit Report and send a letter of appreciation to IT Management. Question explanation : As per the IS Audit and Assurance Standards, any finding, whether subsequently corrected or not should be included in the IS Audit Report if it is material. 16 / 65 16. Question: IS Auditor rightly found one weakness in the Firewall implementation and he recommended the name of sister concern to address the weakness. The IS Auditor hasfailed to maintain: Professional Independence Professional Competence Organizational Independence Personal Competence Question explanation: Professional Independence carries the highest weight in Assurance Services field. If due to any action of the IS Auditor, his capacity to carry out audit independently is hindered then the same amounts to failure to maintain Professional Independence. 17 / 65 17. Which of the following forms of evidence would be considered to be the most reliable when assisting an IS Auditor develop audit conclusion? A confirmation letter received from a third party for the verification of an account balance. Assurance via a control self-assessment received from the management that an application is working as designed. Trend data obtained from World Wide Web (Internet) sources. Ratio analysis developed by an IS Auditor from reports supplied by line management Question explanation: The IS Auditor requires documented evidence to be submitted during audit procedures. Control self-assessment though is a good control but it cannot work as an evidence. Trend and ratio analysis can be used to justify some conclusion but cannot be considered as a conclusive evidence whereas a confirmation letter is. 18 / 65 18. During a review of the controls over the process of defining IT service levels, an IS auditor would most likely interview the: Systems programmer Legal staff Business Unit Manager Programmer Question explanation: Business unit manager is the owner of that business unit and he is the right authority to provide the required information in this context. First point of interview should be with the person related to business not the programmer or legal staff 19 / 65 19. Which of the following procedures would an IS Auditor not perform during pre-audit planning to gain an understanding of the overall environment under review? Tour key organisation activities Interview key members of management to understand business risks Perform compliance tests to determine if regulatory requirements are met. Review prior audit reports Question explanation : During pre-audit planning there is no question of doing any compliance test. Compliance test starts during the process of audit. All other options are the process of collecting information during pre-audit process 20 / 65 20. The purpose of compliance tests is to provide reasonable assurance that: Controls are working as prescribed. Documentation is accurate and current. The duties of users and data processing personnel are segregated Exposures are defined and quantified. Question explanation: The compliance tests determine whether prescribed controls are working as intended. Answer "B" is NOT the best choice. Current and accurate documentation may be a good procedure but it is only one type of control procedure, therefore, answer 'A' is a better choice as more control procedures are evaluated. Answer "C" is NOT the best choice because segregation of duties is only one type of control procedure; therefore, answer 'A' is a better choice as more control procedures are evaluated. Answer "D" is NOT the correct choice. Exposures are defined and quantified to determine audit scope. Compliance tests provide reasonable assurance that controls are working as prescribed. 21 / 65 21. IS Auditors being most likely to perform tests of internal controls if, after their evaluation of such controls, they conclude that: A substantive approach to the audit is cost-effective The control environment is poor. Inherent risk is low. Control risks are within the acceptable limits. Question explanation: IS auditor will most probably perform the test of internal control when control environment is poor. When inherent risks are low and control risks are within acceptable limit, likelihood of testing internal controls get reduced. Concluding the cost effectiveness of substantive approach is not the outcome of testing internal controls. 22 / 65 22. Which of the following is the least important factor in determining the need for an IS Auditor to be involved in a new system development project? The cost of the system The value of the system to the organization. The potential benefits of the system. The number of lines of code to be written. Question explanation: The size of the system is the least important of the factors listed. All other factors have specific financial implications and an IS Auditor can be used to help mitigate the risk to the corporation with the development of a new system. 23 / 65 23. Each of the following is a general control concern EXCEPT: Organization of the IS Department. Documentation procedures within the IS Department. Balancing of daily control totals. Physical access controls and security measures Question explanation: Balancing of daily control totals relates to specific applications and is not considered an overall general control concern. Answer "B" is NOT the correct answer since documentation procedures within the IS Department are an important general control concern. Answer "A" is NOT the correct answer since organization of the IS Department is an important general control concern. Answer "D" is NOT the correct answer since physical access controls and security measures are important general control concerns. 24 / 65 24. Which of the following types of audits requires the highest degree of data processing expertise? Systems software audits General controls reviews Microcomputer application audits Mainframe application audits Question explanation: The IS Auditor needs specialized type of education in hardware and operating system software. Options at B, C and D can be performed when an IS auditor has a basic level of data processing technical knowledge and usually requires no special training. 25 / 65 25. A manufacturing company has implemented a new client/server system enterprise resource planning (ERP) system. Local branches transmit customer orders to a central manufacturing facility. Which of the following controls would BEST ensure that the orders are accurately entered and the corresponding products produced? Verifying production to customer orders Logging all customer orders in the ERP system Using hash totals in the order transmitting process Approving (production supervisor) orders prior to production Question explanation : Verification will ensure that production orders match customer orders. Logging can be used to detect inaccuracies, but does not in itself guarantee accurate processing. Hash totals will ensure accurate order transmission, but not accurate processing centrally. Production supervisory approval is a time-consuming manual process that does not guarantee proper control. 26 / 65 26. An IS Auditor observed that users are occasionally granted the authority to change system data. The elevated system access is not consistent with company policy yet is required for smooth functioning of business operations. Which of the following controls would the IS Auditor most likely recommend for long term resolution? Redesign the controls related to data authentication Implement additional segregation of duties controls Review policy to see if a formal exception process is required Implement additional logging controls Question explanation: C. is the correct answer. Policy is not a static document. When an exception is a regular requirement, the best control is to modify the policy accordingly. 27 / 65 27. In a public sector bank while updating master data for advances given, the bank employee does not update “INSURANCE DATA”. This includes details of Insurance Policy, Amount Insured, Expiry Date of Insurance and other related information. This defines which control lapse as per COBIT. Source Data Preparation and Authorisation Source Data Collection and Entry Accuracy, Completeness and Authenticity Checks Processing Integrity and Validity Question explanation: C. This ensures that transactions are accurate, complete and valid. Validate data that were input, and edit or send back for correction as close to the point of origination as possible. 28 / 65 28. As per Income Tax Act, 1961 and banking norms, all fixed deposit holders of banks need to submit their PAN or form 60/61(a form as per Income Tax Act/Rules). A bank in its account opening form, has not updated the need for form 60/61 in case PAN is not there. This defines which control lapse as per COBIT. Source Data Preparation and Authorisation Source Data Collection and Entry Accuracy, Completeness and Authenticity Checks Processing Integrity and Validity Question explanation: A. is the correct answer as the source data capture is not proper. Ensure that source documents are prepared by authorised and qualified personnel following established procedures, taking into account adequate segregation of duties regarding the origination and approval of these documents. Errors and omissions can be minimised through good input form design. 29 / 65 29. Application controls shall include all except Application controls are a subset of internal controls. The purpose is to collect timely, accurate and reliable information. It is part of the IS Auditor’s responsibility to implement the same. It is part of business application software. Question explanation: C. It represents what auditor verifies but not that what he/she implements. Rest is part of the definition and purpose of application controls. 30 / 65 30. The most appropriate type of CAAT tool the auditor should use to test security configuration settings for the entire application systems of any organization is: Generalised Audit Software Test Data Utility Software Expert System Question explanation: When testing the security of the entire application system including operating system, database and application security, the auditor will most likely use a utility software that assists in reviewing the configuration settings. In contrast, the Auditor may use GAS to perform a substantive testing of data and configuration files of the application. Test data are normally used to check the integrity of the data and expert systems are used to inquire on specific topics. Hence correct answer is C. 31 / 65 31. Many automated tools are designed for testing and evaluating computer systems. Which one of the following such tools impact the systems performance with a greater load and stress on the system? Test data generators Statistical software packages Test drivers Network traffic analyzers Question explanation: Statistical software packages use all data resources impacting the processing time and response time. Network traffic analyzers also use the system resources but not putting stress on production data. Test data generator is not resource intensive and test drivers are for specific use without impacting much resources. Correct answer is B. 32 / 65 32. An IS Auditor, concerned that application controls are not adequate to prevent duplicate payment of invoices, decided to review the data processing files for possible duplicate payments. Which of the following techniques/tools would be useful to the IS Auditor? An integrated test facility. Statistical sampling. Generalized audit software. The Audit Review File. Question explanation : Generalised Audit software is mainly used to find duplicate data. Options A and D are on line application audit tools and statistical sampling may not be able to find duplicates. Correct answer is C. 33 / 65 33. Which is one of the most effective tools and techniques to combat fraud? Computer Assisted Audit Techniques (CAAT) Threats of severe punishment Validation by the I.T. dept. of the police Use of authenticated hard copies Key Question explanation: CAAT is one of the tools useful for carrying out the detection of suspicious transactions as a pre-emptive or post fraud activity. Hence, answer at Option A is correct. 34 / 65 34. What is one of the key tests which can be ideally carried out using Computer Assisted Audit Tools (CAATs)? Establishing relationship between two or more areas & identify duplicate transactions Carry out market surveys for a new product launch Projections on future trends for specific parameters Estimation of competitor activity Key Question explanation: One of the many key tests that can be carried out by CAATs is establishing relationship between two or more areas & identify duplicate transactions. CAATs are more in the nature of audit tools & would not be ideal for the other purposes listed in Options B to D above. Hence, answer at Option A alone is correct. 35 / 65 35. What is one of the key tests which can be ideally carried out using Computer Assisted Audit Tools (CAATs)? Establishing whether the set controls are working as prescribed Carry out employee appraisals Projections on future trends for specific parameters Estimation of competitor activity Key. Question explanation: One of the many key tests that can be carried out by CAATs is establishing whether the set controls are working as intended. CAATs are more in the nature of audit tools & would not be ideal for the other purposes listed in Options B to D above. Hence, answer at Option A alone is correct. 36 / 65 36. What is one of the key tests which can be ideally carried out using Computer Assisted Audit Tools (CAATs)? Perform various types of statistical analysis Carry out employee appraisals Projections on future trends for specific parameters Carrying out employees’ reference checks Key Question explanation: One of the many key tests that can be carried out by CAATs is the carrying out of various types of statistical analysis which could throw up areas of inconsistencies, defaults, etc. CAATs are more in the nature of audit tools & would not be ideal for the other purposes listed in Options B to D above. Hence, answer at Option A alone is correct. 37 / 65 37. What can be ideally carried out using Computer Assisted Audit Tools (CAATs)? Identify data which is inconsistent or erroneous Carry out employee appraisals Projections on future trends for specific parameters Carrying out employees’ reference checks Key. Question explanation: One of the many key tests that can be carried out by CAATs is identification of data which is inconsistent or erroneous. The IS auditor can set the criteria based upon the sort of data which are not expected to occur on the basis of the controls which presumably have been incorporated in the organization’s systems. CAATs are more in the nature of audit tools & would not be ideal for the other purposes listed in Options B to D above. Hence, answer at Option A alone is correct. 38 / 65 38. Find out the best process carried out using Computer Assisted Audit Tools (CAATs)? Identify potential areas of fraud Carry out employee appraisals of Information Systems Assurances Services Projections on future trends for specific parameters Carrying out employees’ reference checks Key Question explanation: One of the many key tests that can be carried out by CAATs is identification of potential areas of fraud. The IS auditor can set the criteria based upon the sort of transactions which are not expected to occur on the basis of presumably have been incorporated in the organization’s systems. CAATs are more in the nature of audit tools & would not be ideal for the other purposes listed in Options B to D above. Correct answer is A. 39 / 65 39. What is one of the key tests which can be ideally carried out using Computer Assisted Audit Tools (CAATs)? Identification of exceptional transactions based upon set criteria Projections on future trends for specific parameters Carrying out employees’ reference checks Carry out employee appraisals Key Question explanation : One of the many key tests that can be carried out by CAATs is identification of exceptional transactions based upon set criteria. The IS auditor can set the criteria based upon the sort of transactions which are not expected to occur on the basis of the controls which presumably have been incorporated in the organization’s systems. CAATs are more in the nature of audit tools & would not be ideal for the other purposes listed in Options B to D above. Hence, answer at Option A alone is correct. 40 / 65 40. After initial investigation, IS auditor has reasons to believe that there is possibility of fraud, the IS auditor has to: Expand activities to determine whether an investigation is warranted. Report the matter to the audit committee. Report the possibility of fraud to top management and ask how they would like to proceed. Consult with external legal counsel to determine the course of action to be taken. Question explanation: A. An IS auditor’s responsibility for detecting fraud includes evaluating fraud indicators and deciding whether any additional action is necessary or whether an additional investigation should be recommended. The IS auditor should notify the appropriate authorities within the organization only if it has determined that the indicators of fraud are sufficient to recommend an investigation. Normally, the IS auditor does not have authority to consult with external legal counsel. 41 / 65 41. A holistic approach to deterrence & prevention of fraud would be: Strengthening of Governance and Management framework Focussing on integrity of new recruits Establishing severe punishment for fraud Compensating employees adequately to minimize temptation Question explanation : A. A holistic approach to deterrence and prevention of fraud would require strengthening of governance and management framework. The answers in options B to D address the issue in bits and pieces and, hence, are not the right answers. Answer at Option A alone is correct. 42 / 65 42. As a measure of IT General controls, an organization decides to separate those who can input data from those that can reconcile or approve data. Is this a good move? Why? Yes, it is a good move; it can help prevent unauthorised data entry. No, it is not a good move; the person who inputs the data is the best person to approve the data too. Yes, it is a good move; inputting data & reconciling data requires different skills. No, it is not a good move; data entry errors would be compounded. Question explanation: A. Segregation of duties is an important control tool whereby, conflicting roles in particular, are segregated and handled by different individuals. It reduces the risk of fraud since one person cannot independently commit any fraud but would need to collude with the second. Also, since the output of one individual may become the input for another, an independent accuracy check of one person’s work by another person becomes a built-in reality. Hence, the answer in Option A is correct. 43 / 65 43. Which of the following refers to imaging of original media in presence of an independent third party? Identify Preserve Analyze Present Question explanation: B. Preserve refers to practice of retrieving identified information and preserving it as evidence. This practice generally includes the imaging of original media in presence of an independent third party. 44 / 65 44. The FIRST step in managing the risk of a cyber-attack is to: Assess the vulnerability impact. Evaluate the likelihood of threats. Identify critical information assets. Estimate potential damage. Question explanation: C. The first step in managing risk is the identification and classification of critical information resources (assets). Once the assets have been identified, the process moves onto the identification of threats, vulnerabilities and calculation of potential damages. 45 / 65 45. Neural networks are effective in detecting fraud, because they can: Discover new trends since they are inherently linear. Solve problems where large and general sets of training data are not obtainable. Attack problems that require consideration of a large number of input variables. Make assumptions about shape of any curve relating variables of output Question explanation: C. Neural networks can be used to attack problems that require consideration of numerous input variables. They are capable of capturing relationships and patterns often missed by other statistical methods, and they will not discover new trends. Neural networks are inherently nonlinear and make no assumption about the shape of any curve relating variables to the output. Neural networks will not work well at solving problems for which sufficiently large and general sets of training data are not obtainable. 46 / 65 46. Which of the following situations would increase the likelihood of fraud? Application programmers are implementing changes to production programs. Application programmers are implementing changes to test programs. Operations support staff are implementing changes to batch schedules. Database administrators are implementing changes to data structures. Question explanation: A. Production programs are used for processing an enterprise's data. It is imperative that controls on changes to production programs are stringent. Lack of controls in this area could result in application programs being modified to manipulate the data. Application programmers are required to implement changes to test programs. These are used only in development and do not directly impact the live processing of data. The implementation of changes to batch schedules by operations support staff will affect the scheduling of the batches only; it does not impact the live data. Database administrators are required to implement changes to database structures. This is required for reorganization of the database to allow for additions, modifications or deletions of fields or tables in the database. 47 / 65 47. An IS auditor discovers evidence of fraud perpetrated with a manager's user id. The manager had written the password, inside his/her desk drawer. The IS auditor should conclude that the: Manager’s assistant perpetrated the fraud. Perpetrator cannot be established beyond doubt. Fraud must have been perpetrated by the manager. System administrator perpetrated the fraud. Question explanation: B. The password control weaknesses mean that any of the other three options could be true. Password security would normally identify the perpetrator. In this case, it does not establish guilt beyond doubt. 48 / 65 48. Which of the following is LEAST likely to be included in a review to assess the risk of fraud in application systems? Volume of transactions Likelihood of error Value of transactions Extent of existing controls Question explanation: B. An error is the least likely element to contribute to the potential for fraud. Answer A and C are incorrect since volume and value of transactions give an indication of the maximum potential loss through fraud. Answer D is incorrect since gross risk less existing controls give net risk. 49 / 65 49. Which of the following factors should not be considered in establishing the priority of audits included in an annual audit plan? Prior audit findings The time period since the last audit Auditee procedural changes Use of audit software Question explanation: D. Use of audit software merely refers to a technique that can be used in performing an audit. It has no relevance to the development of the annual audit plan. 50 / 65 50. Which are the business activities which are strong contenders for conversion to ecommerce? Those that are paper-based, time consuming & inconvenient for customers Those relating to software development Those relating to the ‘electronic’ aspects of commerce Those that are not paper-based, speedy & convenient for customers. Question explanation: Correct answer is A. Maximum mileage can be gained from e-commerce by converting those business activities which are paper-based, time consuming & inconvenient for customers as indicated in Option A. This will help us reduce paperwork, accelerate delivery & make it convenient for customers to operate from the comfort of their homes as also at any other place of their convenience. Hence, the other options are wrong. 51 / 65 51. In an inter school competition on Artificial Intelligence, four children develop software which performs the following different functions respectively. Which of them is a correct example of the use of basic Artificial Intelligence? Predictive & self-learning word-processing software A calculation software which arrives at the arithmetic total of figures keyed in A password system which allows access based upon keying in of the correct password A software which rejects invalid dates like 32nd March 2019. Question explanation: Correct answer is A. The word-processing software pops up suggested words based upon the first few words keyed in by the user. Also, when the user keys in a new word which is not available in its repertoire, it adds it to its collection & reflects it as an option the next time similar letters are initiated. In effect, the software is able to observe & record patterns and improves through ‘learning’. The other answers in Options B to D involve the basic computing functions of a computer which are based on a ‘go / no-go’ logic which does not involve pattern recognition or further learning. Hence, the correct answer is only as in Option A which displays characteristics of artificial intelligence. 52 / 65 52. Neural Networks and Fuzzy Logics are classified under which category of Artificial intelligence? Cognitive Science Robotics Natural Sciences Virtual Reality Question explanation: Correct answer is A. Cognitive Science. This is an area based on research in disciplines such as biology, neurology, psychology, mathematics and allied disciplines. It focuses on how human brain works and how humans think and learn. Applications of AI in the cognitive science are Expert Systems, Learning Systems, Neural Networks, Intelligent Agents and Fuzzy Logic. B, C and D are incorrect. B. Robotics: This technology produces robot machines with computer intelligence and human-like physical capabilities. This area includes applications that give robots visual perception, capabilities to feel by touch, dexterity and locomotion. C. Natural Languages: Being able to 'converse' with computers in human languages is the goal of research in this area. Interactive voice response and natural programming languages, closer to human conversation, are some of the applications. D. Virtual reality is another important application that can be classified under natural interfaces. 53 / 65 53. As part of auditing Information Security of a multinational bank, an auditor wants to assess the security of information in ATM facilities. Under which privacy policy should he look for details pertaining to security guards and CCTV surveillance of ATM’s? Physical Access and Security Policy Acceptable use of Information Assets Policy Asset Management Policy Business Continuity Management Policy Key. Question explanation: Correct answer is A. Physical security describes security measures that are designed to restrict unauthorized access to facilities, equipment and resources, and to protect personnel and property from damage or harm (such as espionage, theft, or terrorist attacks). Physical security involves the use of multiple layers of interdependent systems which include CCTV surveillance, security guards, Biometric access, RFID cards, access cards protective barriers, locks, access control protocols, and many other techniques. B is incorrect - An acceptable use policy (AUP), also known as an Acceptable Usage policy or Fair Use policy, is a set of rules applied by the owner or manager of a network, website or large computer system that restrict the ways in which the network, website or system may be used. C is incorrect – This policy defines the requirements for Information Asset’s protection. It includes assets like servers, desktops, handhelds, software, network devices etc. Besides, it covers all assets used by an organization- owned or leased. D is incorrect – This policy defines the requirements to ensure continuity of business-critical operations. It is designed to minimize the impact of an unforeseen event (or disaster) and to facilitate return of business to normal levels. 54 / 65 54. An employee has left the company. The first thing to do is to: Hire a replacement employee. Disable his/her access rights. Ask the employee to clear all dues/advances. Escort employee out of company premises Question explanation: Correct answer is B. the first thing to do as soon as an employee leaves the company is to disable his/her access rights in system. This needs to be done to prevent frauds being committed. Other answers may be valid but are not the first thing to do. 55 / 65 55. The cashier of a company has rights to create bank master in TALLY. This error is a reflection of poor definition for which type of control: User Controls Application Control Input Control Output Control Question explanation: Correct answer is A. User controls are not properly defined. User controls need to be defined based on NEED TO DO and NEED TO DO basis. The above is reflection of a greater problem of improper assessment of user profiles created in the system. 56 / 65 56. A retail company recently installed data warehousing client software in multiple, geographically diverse sites. Due to time zone differences between the sites, updates to the warehouse are not synchronized. This will affect which of the following most? Data availability Data completeness Data redundancy Data accuracy Question explanation: Correct answer is B. One of the major bottlenecks in data ware house is time synchronisation as the data of different time zones is merged in data ware house. It ultimately results in in-complete data for decision making purposes. 57 / 65 57. Which of the following audit tools is MOST useful to an IS auditor when an audit trail is required? Integrated test facility (ITF) Continuous and intermittent simulation (CIS) Audit hooks Snapshots Question explanation: Correct answer is D. Snapshot is the right answer as in this technique, IS auditor can create evidence through IMAGE capturing. A snapshot tool is most useful when an audit trail is required. ITF can be used to incorporate test transactions into a normal production run of a system. CIS is useful when transactions meeting certain criteria need to be examined. Audit hooks are useful when only select transactions or processes need to be examined. 58 / 65 58. Which of the following is a characteristic of a decision support system (DSS)? DSS is aimed at solving highly structured problem. DSS combines the use of models with non-traditional data access and retrieval functions. DSS emphasizes flexibility in decision making approach of users. DSS supports only structured decision-making tasks. Question explanation: Correct answer is B. It goes with the purpose and definition of decision support system. 59 / 65 59. Which of the following business purposes can be met by implementing Data warehouse in an organisation? Business continuity can be ensured in case of disaster. Data in the data ware house can work as a backup The data in the warehouse can be used for meeting regulatory requirements. Business decisions can be taken and future policies can be framed based on actual transactional data. Question explanation : Correct answer is D. Purpose of Data warehouse is to take business decisions and frame future policies based on the analysis of transactional data. It cannot act as an alternative to backup. Purpose of the data ware house is not for business continuity nor is it for regulatory requirements. 60 / 65 60. While posting message on FACEBOOK, if user posts the same message again, FACEBOOK gives a warning. The warning indicates which control. Limit Check Dependency Check Range Check Duplicate Check Question explanation: D. is the answer as this is a duplicate check. 61 / 65 61. Company’s billing system does not allow billing to those dealers who have not paid advance amount against proforma invoice. This check is best called as: Limit Check Dependency Check Range Check Duplicate Check Question explanation : B. Dependency check is one where value of one field is related to that of another. 62 / 65 62. A central antivirus system determines whether each personal computer has the latest signature files and installs the latest signature file before allowing a PC to connect to the network. This is an example of a: Directive control Corrective Control Compensating Control Detective Control Question explanation: B. is the correct answer. After detecting the deficiency, it is correcting the situation hence it is a corrective control. 63 / 65 63. RBI instructed banks to stop cash retraction in all ATMs across India from April 1, 2013. This was result of few ATM frauds detected. This action by RBI can be best classified as: Creation Rectification Repair None of above Question explanation: B. is the right answer. A, is not an answer as action by RBI is based on fraud detection. Repair is done to rectify an error which has occurred in a working system. 64 / 65 64. An IS Auditor is performing a post implementation review of an organisation’s system and identified output errors within an accounting application. The IS Auditor determined that this was caused by input errors. Which of the following controls should the IS Auditor recommend to management? Recalculations Limit Checks Run-to-run total Reconciliation Question explanation: D is correct. For finding the anomaly between input and output, reconciliation is the best option. Re-calculation and run-to-run total will provide the same result as earlier and limit check is a data validation control. 65 / 65 65. An IS Auditor, processes a dummy transaction to check whether the system is allowing cash payments in excess of Rs.20,000/-. This check by auditor represents which of the following evidence collection technique? Inquiry and confirmation Re-calculation Inspection Re-performance Question explanation: D. is the correct answer. The IS Auditor may process test data on application controls to see how it responds. Your score isThe average score is 57% LinkedIn Facebook 0% Restart quiz See review Send feedback Latest updates 53RD GST COUNCIL MEETING MAT (Minimum Alternative Tax) and Book-profits calculation under section 115JB 53RD GST COUNCIL MEETING Share this:PostLike this:Like Loading...
