Which of the following procedures would an entity most likely include in its disaster recovery plan? O A. Convert all data from external formats to an internal company format. B. Maintain a program to prevent illegal activity. C. Develop an auxiliary power supply to provide uninterrupted electricity. D. Store duplicate copies of files in a location away from the computer center.

Which of the following procedures would an entity most likely include in its disaster recovery plan? O A. Convert all data from external formats to an internal company format. B. Maintain a program to prevent illegal activity. C. Develop an auxiliary power supply to provide uninterrupted electricity. D. Store duplicate copies of files in a location away from the computer center.

Auditing: A Risk Based-Approach (MindTap Course List)

11th Edition

ISBN:9781337619455

Author:Karla M Johnstone, Audrey A. Gramling, Larry E. Rittenberg

Publisher:Karla M Johnstone, Audrey A. Gramling, Larry E. Rittenberg

Chapter3: Internal Control Over Financial Reporting: Responsibilities Of Management And The External Auditor

Section: Chapter Questions

Problem 27CYBK

See similar textbooks

Similar questions

Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (c) A criminal remotely accessed a sensitive database using the authentication credentials (user ID and strong password) of an IT manager. At the time the attack occurred, the IT manager was logged into the system at his workstation at company headquarters.
Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (i)To facilitate working from home, an employee installed a modem on his office workstation. An attacker successfully penetrated the company’s system by dialing into that modem.
Which of the following would strengthen organizational control over a large-scale data processing center?a. Requiring the user departments to specify the general control standards necessary for processing transactions.b. Requiring that requests and instructions for data processing services be submitted directly to the computer operator in the data center.c. Having the database administrator report to the manager of computer operations.d. Assigning maintenance responsibility to the original system designer who best knows its logic.e. None of the above.
Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (g) Attackers broke into the company’s information system through a wireless access point located in one of its retail stores. The wireless access point had been purchased and installed by the store manager without informing central IT or security.
3. Which of the following is not a computer facility control? (a) Place the data processing center where unauthorized individuals cannot gain entry to the facility. (b) Limit access to the data processing center all employees of the company. (c) Buy insurance to protect against loss of equipment in the computer facility. (d) Use advanced technology to identify individuals who are authorized access to the data processing center. 4.For internal control over computer program changes, a policy should be established requiring that: (a) All proposed changes be approved by a responsible individual and logged. (b) The programmer designing the change should be responsible for ensuring that the revised program is adequately tested. (c) All program changes be supervised by the information system control group. (d) To facilitate operational performance, superseded portions of programs should not be deleted from the program run manual.
3. Which of the following is not a computer facility control? (a) Place the data processing center where unauthorized individuals cannot gain entry to the facility. (b) Limit access to the data processing center all employees of the company. (c) Buy insurance to protect against loss of equipment in the computer facility. (d) Use advanced technology to identify individuals who are authorized access to the data processing center. 4.For internal control over computer program changes, a policy should be established requiring that: (a) All proposed changes be approved by a responsible individual and logged. (b) The programmer designing the change should be responsible for ensuring that the revised program is adequately tested. (c) All program changes be supervised by the information system control group. (d) To facilitate operational performance, superseded portions of programs should not be deleted from the program run manual. 5. Auditing "around the computer": (a) Assumes that accurate…
Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (j) An attacker gained access to the company’s internal network by installing a wireless access point in a wiring closet located next to the elevators on the fourth floor of a high-rise office building that the company shared with other companies.
Listed here are five scenarios. For each scenario, discuss the possible damages that can occur. Suggest a preventive control.a. An intruder taps into a telecommunications device and retrieves the identifying codes and personal identification numbers for ATM cardholders. (The user subsequently codes this information ontoa magnetic coding device and places this strip on a piece of cardboard.)b. Because of occasional noise on a transmission line, electronic messages received are extremely garbled.c. Because of occasional noise on a transmission line, data being transferred is lost or garbled.d. An intruder is temporarily delaying important strategic messages over the telecommunications lines.e. An intruder is altering electronic messages before the user receives them.
Which of the following would reduce the effectiveness of internal control in an accountinginformation system?a. The computer librarian maintains custody of computer program instructions and detailed lists.b. Computer operators have access to operator instructions and detailed program lists.c. The control group is solely responsible for the distribution of all computer output.d. Computer programmers write and debug programs that perform routines designed by thesystems analyst.
From a risk perspective, the PRIMARY objective for classifying data is: a) To ensure the completeness of the company's data inventory b) Establish appropriate control measures, depending upon the asset classification level. c) To support user account administration procedures. d) To limit access to personally identifiable information
The IT Audit Director is responsible for monitoring and approving network-related changes to the company's production network. This is an appropriately designed preventive control. a) True b) False
The ABC Company is switching from its legacy centralizedsystem to a fully distributed system. Underthe new model, all employees will work from PCsconnected to a local area network. a. Outline a plan of action to ensure that the propercontrols over hardware, software, data, people,procedures, and documentation are in place.b. Discuss any risks the company may face if thedevised plan is not implemented.