Interested to Buy Any Domain ? << Click Here >> for more details...
During a review of a large data center an IS auditor
observed computer operators acting as backup tape librarians
and security administrators. Which of these situations would
be MOST critical to report?
A. Computer operators acting as tape librarians
B. Computer operators acting as security administrators
C. Computer operators acting as a tape librarian and
security administrator
D. It is not necessary to report any of these situations.
- 1 Answers
- 4538 Views
- I also Faced
- E-Mail Answers
Answer / guest
Answer: B
Computer operators should not be given security
administrator access. Computer operators acting as security
administrators could manipulate the security system to give
themselves access. The access could be used to set up
fictitious accounts and to eliminate any record of it from
the log. Computer operators in large data centers are often
called upon to act as tape librarians. As long as the
operator cannot manipulate the system logging, it is
acceptable for the librarian to track what has taken place.
| Is This Answer Correct ? | 2 Yes | 0 No |
When reviewing a system development project at the project initiation stage, an IS auditor finds that the project team is following the organization's quality manual. To meet critical deadlines the project team proposes to fast track the validation and verification processes, commencing some elements before the previous deliverable is signed off. Under these circumstances, the IS auditor would MOST likely: A. report this as a critical finding to senior management. B. accept that different quality processes can be adopted for each project. C. report to IS management the team's failure to follow quality procedures. D. report the risks associated with fast tracking to the project steering committee.
A probable advantage to an organization that has outsourced its data processing services is that: A. needed IS expertise can be obtained from the outside. B. greater control can be exercised over processing. C. processing priorities can be established and enforced internally. D. greater user involvement is required to communicate user needs.
An IS auditor should be involved in: A. observing tests of the disaster recovery plan. B. developing the disaster recovery plan. C. maintaining the disaster recovery plan. D. reviewing the disaster recovery requirements of supplier contracts.
When developing a risk-based audit strategy, an IS auditor should conduct a risk assessment to ensure that:
Which of the following types of transmission media provide the BEST security against unauthorized access? A. Copper wire B. Twisted pair C. Fiber-optic cables D. Coaxial cables
E-mail message authenticity and confidentiality is BEST achieved by signing the message using the:
Using test data as part of a comprehensive test of program controls in a continuous online manner is called a/an: A. test data/deck. B. base case system evaluation. C. integrated test facility (ITF). D. parallel simulation.
Which of the following provides the framework for designing and developing logical access controls? A. Information systems security policy B. Access control lists C. Password management D. System configuration files
An organization has been an Internet user for several years and the business plan now calls for initiating e-commerce via web-based transactions. Which of the following will LEAST impact transactions in e-commerce? A. Encryption is required B. Timed authentication is required C. Firewall architecture hides the internal network D. Traffic is exchanged through the firewall at the application layer only
A debugging tool, which reports on the sequence of steps executed by a program, is called a/an: A. output analyzer. B. memory dump. C. compiler. D. logic path monitor.
The risk of an IS auditor using an inadequate test procedure and concluding that material errors do not exist when, in fact, they exist is:
Which of the following would not prevent the loss of an asset but would assist in recovery by transferring part of the risk to a third party? A. Full system backups B. Insurance C. Testing D. Business impact analysis
Cisco Certifications 
