Information Technology Auditing 4th Edition James A Hall- Test Bank

Information Technology Auditing 4th Edition James A Hall- Test Bank To purchase this Test Bank with answers, click the link below

https://examquizes.com/product/information-technology-auditing-4th-edition-james-a-hall-test-bank/

Description Information Technology Auditing 4th Edition James A Hall- Test Bank Sample Questions Instant Download With Answers Chapter 3—Security Part I: Auditing Operating Systems and Networks

TRUE/FALSE

1.

In a computerized environment, the audit trail log must be printed onto paper documents.

ANS: F

2.

Disguising message packets to look as if they came from another user and to gain access to the host’s network is called spooling.

ANS: F

3.

PTS: 1

A formal log-on procedure is the operating system’s last line of defense against unauthorized access.

ANS: F

4.

PTS: 1

PTS: 1

Computer viruses usually spread throughout the system before being detected.

ANS: T

5.

A worm is software program that replicates itself in areas of idle memory until the system fails.

ANS: T

6.

PTS: 1

Audit trails in computerized systems are comprised of two types of audit logs: detailed logs of individual keystrokes and event-oriented logs.

ANS: T

10.

PTS: 1

The most frequent victims of program viruses are microcomputers.

ANS: T

9.

PTS: 1

Operating system controls are of interest to system professionals but should not concern accountants and auditors.

ANS: F

8.

PTS: 1

Viruses rarely attach themselves to executable files.

ANS: F

7.

PTS: 1

PTS: 1

In a telecommunications environment, line errors can be detected by using an echo check.

ANS: T

11.

The message authentication code is calculated by the sender and the receiver of a data transmission.

ANS: T

12.

PTS: 1

A value added network can detect and reject transactions by unauthorized trading partners.

ANS: T

15.

PTS: 1

Electronic data interchange translation software interfaces with the sending firm and the value added network.

ANS: F

14.

PTS: 1

The request-response technique should detect if a data communication transmission has been diverted.

ANS: T

13.

PTS: 1

PTS: 1

Electronic data interchange customers may be given access to the vendor’s data files.

ANS: T

16.

The audit trail for electronic data interchange transactions is stored on magnetic media.

ANS: T

17.

PTS: 1

IP spoofing is a form of masquerading to gain unauthorized access to a Web server.

ANS: T

21.

PTS: 1

The network paradox is that networks exist to provide user access to shared resources while one of its most important objectives is to control access.

ANS: T

20.

PTS: 1

To preserve audit trails in a computerized environment, transaction logs are permanent records of transactions.

ANS: T

19.

PTS: 1

A firewall is a hardware partition designed to protect networks from power surges.

ANS: F

18.

PTS: 1

PTS: 1

The rules that make it possible for users of networks to communicate are called protocols.

ANS: T

PTS: 1

22.

A factor that contributes to computer crime is the reluctance of many organizations to prosecute criminals for fear of negative publicity.

ANS: T 23.

Because of network protocols, users of networks built by different manufacturers are able to communicate and share data.

ANS: T

24.

PTS: 1

A network topology is the physical arrangement of the components of the network.

ANS: T

28.

PTS: 1

The bus topology connects the nodes in parallel.

ANS: T

27.

PTS: 1

Only two types of motivation drive DoS attacks: 1) to punish an organization with which the perpetrator had a grievance; and 2) to gain bragging rights for being able to do it.

ANS: F

26.

PTS: 1

The client-server model can only be applied to ring and star topologies.

ANS: F

25.

PTS: 1

PTS: 1

A digital signature is a digital copy of the sender’s actual signature that cannot be forged.

ANS: F

29.

A smurf attack involves three participants: a zombie, an intermediary, and the victim.

ANS: F

30.

PTS: 1

The more individuals that need to exchange encrypted data, the greater the chance that the key will become known to an intruder. To overcome this problem, private key encryption was devised.

ANS: F

33.

PTS: 1

Polling is one technique used to control data collisions.

ANS: T

32.

PTS: 1

In a hierarchical topology, network nodes communicate with each other via a central host computer.

ANS: T

31.

PTS: 1

PTS: 1

A ping is used to test the state of network congestion and determine whether a particular host computer is connected and available on the network.

ANS: T

PTS: 1

34.

HTML tags are customized to delimit attributes, the content of which can be read and processed by computer applications.

ANS: F

PTS: 1

MULTIPLE CHOICE

1.

The operating system performs all of the following tasks except a.

translates third-generation languages into machine language

b.

assigns memory to applications

c.

authorizes user access

d.

schedules job processing

ANS: C

2.

PTS: 1

Which of the following is considered an unintentional threat to the integrity of the operating system? a.

a hacker gaining access to the system because of a security flaw

b.

a hardware flaw that causes the system to crash

c.

a virus that formats the hard drive

d.

the systems programmer accessing individual user files

ANS: B

3.

PTS: 1

A software program that replicates itself in areas of idle memory until the system fails is called a a.

Trojan horse

b.

worm

c.

logic bomb

d.

none of the above

ANS: B

4.

A software program that allows access to a system without going through the normal logon procedures is called a a.

logic bomb

b.

Trojan horse

c.

worm

d.

back door

ANS: D

5.

PTS: 1

PTS: 1

All of the following will reduce the exposure to computer viruses except

a.

install antivirus software

b.

install factory-sealed application software

c.

assign and control user passwords

d.

install public-domain software from reputable bulletin boards

ANS: D

6.

PTS: 1

Hackers can disguise their message packets to look as if they came from an authorized user and gain access to the host’s network using a technique called a.

spoofing.

b.

spooling.

c.

dual-homed.

d.

screening.

ANS: A

7.

Passwords are secret codes that users enter to gain access to systems. Security can be compromised by all of the following except a.

failure to change passwords on a regular basis

b.

using obscure passwords unknown to others

c.

recording passwords in obvious places

d.

selecting passwords that can be easily detected by computer criminals

ANS: B

8.

PTS: 1

Which control will not reduce the likelihood of data loss due to a line error? a.

echo check

b.

encryption

c.

vertical parity bit

d.

horizontal parity bit

ANS: B

9.

PTS: 1

PTS: 1

Which method will render useless data captured by unauthorized receivers?

a.

echo check

b.

parity bit

c.

public key encryption

d.

message sequencing

ANS: C

10.

PTS: 1

Which method is most likely to detect unauthorized access to the system?

a.

message transaction log

b.

data encryption standard

c.

vertical parity check

d.

request-response technique

ANS: A

11.

PTS: 1

All of the following techniques are used to validate electronic data interchange transactions except

a.

value added networks can compare passwords to a valid customer file before message trans

b.

prior to converting the message, the translation software of the receiving company can com

c.

the recipient’s application software can validate the password prior to processing

d.

the recipient’s application software can validate the password after the transaction has been

ANS: D

12.

PTS: 1

All of the following tests of controls will provide evidence that adequate computer virus control techniques are in place and functioning except

a.

verifying that only authorized software is used on company computers

b.

reviewing system maintenance records

c.

confirming that antivirus software is in use

d.

examining the password policy including a review of the authority table

ANS: B

13.

PTS: 1

Audit objectives for communications controls include all of the following except

a.

detection and correction of message loss due to equipment failure

b.

prevention and detection of illegal access to communication channels

c.

procedures that render intercepted messages useless

d.

all of the above

ANS: D

14.

PTS: 1

When auditors examine and test the call-back feature, they are testing which audit objective?

a.

incompatible functions have been segregated

b.

application programs are protected from unauthorized access

c.

physical security measures are adequate to protect the organization from natural disaster

d.

illegal access to the system is prevented and detected

ANS: D

15.

PTS: 1

In an electronic data interchange (EDI) environment, when the auditor compares the terms of the trading partner agreement against the access privileges stated in the database authority table, the auditor is testing which audit objective?

a.

all EDI transactions are authorized

b.

unauthorized trading partners cannot gain access to database records

c.

authorized trading partners have access only to approved data

d.

a complete audit trail is maintained

ANS: C

PTS: 1

16.

In determining whether a system is adequately protected from attacks by computer viruses, all of the following policies are relevant except

a.

the policy on the purchase of software only from reputable vendors

b.

the policy that all software upgrades are checked for viruses before they are implemented

c.

the policy that current versions of antivirus software should be available to all users

d.

the policy that permits users to take files home to work on them

ANS: D

17.

PTS: 1

In an electronic data interchange environment, customers routinely

a.

access the vendor’s accounts receivable file with read/write authority

b.

access the vendor’s price list file with read/write authority

c.

access the vendor’s inventory file with read-only authority

d.

access the vendor’s open purchase order file with read-only authority

ANS: C

18.

PTS: 1

In an electronic data interchange environment, the audit trail

a.

is a printout of all incoming and outgoing transactions

b.

is an electronic log of all transactions received, translated, and processed by the system

c.

is a computer resource authority table

d.

consists of pointers and indexes within the database

ANS: B

19.

PTS: 1

All of the following are designed to control exposures from subversive threats except

a.

firewalls

b.

one-time passwords

c.

field interrogation

d.

data encryption

ANS: C

20.

PTS: 1

Many techniques exist to reduce the likelihood and effects of data communication hardware failure. One of these is

a.

hardware access procedures

b.

antivirus software

c.

parity checks

d.

data encryption

ANS: C

21.

PTS: 1

Which of the following deal with transaction legitimacy?

a.

transaction authorization and validation

b.

access controls

c.

EDI audit trail

d.

all of the above

ANS: D

22.

PTS: 1

Firewalls are

a.

special materials used to insulate computer facilities

b.

a system that enforces access control between two networks

c.

special software used to screen Internet access

d.

none of the above

ANS: B

23.

PTS: 1

Which of the following is true?

a.

Deep Packet Inspection uses a variety of analytical and statistical techniques to evaluate the

b.

An Intrusion prevention system works in parallel with a firewall at the perimeter of the netwo before they can affect servers and networks.

c.

A distributed denial of service attack is so named because it is capable of attacking many vi

d.

None of the above are true statements.

ANS: A 24.

PTS: 1

A system of computers that connects the internal users of an organization that is distributed over a wide geographic area is a(n)

a.

LAN

b.

decentralized network

c.

multidrop network

d.

Intranet

ANS: D

25. a.

PTS: 1

Network protocols fulfill all of the following objectives except facilitate physical connection between network devices

b.

provide a basis for error checking and measuring network performance

c.

promote compatibility among network devices

d.

result in inflexible standards

ANS: D

26.

PTS: 1

To physically connect a workstation to a LAN requires a

a.

file server

b.

network interface card

c.

multiplexer

d.

bridge

ANS: B

27.

PTS: 1

Packet switching

a.

combines the messages of multiple users into one packet for transmission. At the receiving distributed to the intended users.

b.

is a method for partitioning a database into packets for easy access where no identifiable pr

c.

is used to establish temporary connections between network devices for the duration of a co

d.

is a denial of service technique that disassembles various incoming messages to targeted us order to create a useless garbled message.

ANS: C

28.

PTS: 1

A virtual private network:

a.

is a password-controlled network for private users rather than the general public.

b.

is a private network within a public network.

c.

is an Internet facility that links user sites locally and around the world.

d.

defines the path to a facility or file on the web.

e.

none of the above is true.

ANS: B

29.

PTS: 1

A ping signal is used to initiate

a.

URL masquerading

b.

digital signature forging

c.

Internet protocol spoofing

d.

a smurf attack

e.

none of the above is true

ANS: D

PTS: 1

30.

In a star topology, when the central site fails

a.

individual workstations can communicate with each other

b.

individual workstations can function locally but cannot communicate with other workstations

c.

individual workstations cannot function locally and cannot communicate with other workstat

d.

the functions of the central site are taken over by a designated workstation

ANS: B

31.

PTS: 1

Which of the following statements is correct? The client-server model

a.

is best suited to the token-ring topology because the random-access method used by this m

b.

distributes both data and processing tasks to the server’s node.

c.

is most effective used with a bus topology.

d.

is more efficient than the bus or ring topologies.

ANS: B

32.

PTS: 1

A star topology is appropriate

a.

for a wide area network with a mainframe for a central computer

b.

for centralized databases only

c.

for environments where network nodes routinely communicate with each other

d.

when the central database does not have to be concurrent with the nodes

ANS: A

33.

PTS: 1

In a ring topology

a.

the network consists of a central computer which manages all communications between nod

b.

has a host computer connected to several levels of subordinate computers

c.

all nodes are of equal status; responsibility for managing communications is distributed amo

d.

information processing units rarely communicate with each other

ANS: C

34.

PTS: 1

A distributed denial of service (DDoS) attack

a.

is more intensive that a Dos attack because it emanates from single source

b.

may take the form of either a SYN flood or smurf attack

c.

is so named because it effects many victims simultaneously, which are distributed across th

d.

turns the target victim’s computers into zombies that are unable to access the Internet

ANS: B

35.

PTS: 1

Which of the following statements is correct? TCP/IP

a.

is the basic protocol that permits communication between Internet sites.

b.

controls Web browsers that access the WWW.

c.

is the file format used to produce Web pages.

d.

is a low-level encryption scheme used to secure transmissions in HTTP format.

ANS: A

36.

PTS: 1

FTP

a.

is the document format used to produce Web pages.

b.

controls Web browsers that access the Web.

c.

is used to connect to Usenet groups on the Internet

d.

is used to transfer text files, programs, spreadsheets, and databases across the Internet.

e.

is a low-level encryption scheme used to secure transmissions in higher-level () format.

ANS: D

37. a.

PTS: 1

IP spoofing

combines the messages of multiple users into a “spoofing packet” where the IP addresses a

among the targeted users. b.

is a form of masquerading to gain unauthorized access to a web server.

c.

is used to establish temporary connections between network devices with different IP addres

d.

is a temporary phenomenon that disrupts transaction processing. It will resolve itself when t releases the IP address needed by other users.

ANS: B

38.

PTS: 1

HTML

a.

is the document format used to produce Web pages.

b.

controls Web browsers that access the Web.

c.

is used to connect to Usenet groups on the Internet.

d.

is used to transfer text files, programs, spreadsheets, and databases across the Internet.

e.

is a low-level encryption scheme used to secure transmissions in higher-level () format.

ANS: A

39.

PTS: 1

A message that is made to look as though it is coming from a trusted source but is not is called

a.

a denial of service attack

b.

digital signature forging

c.

Internet protocol spoofing

d.

URL masquerading

ANS: C

40.

PTS: 1

An IP Address:

a.

defines the path to a facility or file on the web.

b.

is the unique address that every computer node and host attached to the Internet must hav

c.

is represented by a 64-bit data packet.

d.

is the address of the protocol rules and standards that governing the design of internet hard

ANS: B

41.

PTS: 1

A digital signature is

a.

the encrypted mathematical value of the message sender’s name

b.

derived from the digest of a document that has been encrypted with the sender’s private ke

c.

the computed digest of the sender’s digital certificate

d.

allows digital messages to be sent over analog telephone lines

ANS: B

42.

PTS: 1

HTTP

a.

is the document format used to produce Web pages.

b.

controls Web browsers that access the Web.

c.

is used to connect to Usenet groups on the Internet

d.

is used to transfer text files, programs, spreadsheets, and databases across the Internet.

e.

is a low-level encryption scheme used to secure transmissions in higher-level () format.

ANS: B

43.

PTS: 1

Which of the following statements is correct?

a.

Packet switching combines the messages of multiple users into a “packet” for transmission. individual messages and distributed to the intended users.

b.

The decision to partition a database assumes that no identifiable primary user exists in the o

c.

Packet switching is used to establish temporary connections between network devices for th

d.

A deadlock is a temporary phenomenon that disrupts transaction processing. It will resolve i transaction and releases the data needed by other users.

ANS: C

SHORT ANSWER

PTS: 1

1.

What is a virus?

ANS: A virus is a program that attaches itself to another legitimate program in order to penetrate the operating system.

PTS: 1

2.

List three methods of controlling unauthorized access to telecommunication messages.

ANS: call-back devices, data encryption, message sequence numbering, message authentication codes, message transaction logs, and request-response technique

PTS: 1

3.

What are some typical problems with passwords?

ANS: users failing to remember passwords; failure to change passwords frequently; displaying passwords where others can see them; using simple, easy-to-guess passwords

PTS: 1

4.

ANS:

Discuss the key features of the one-time password technique:

The one-time password was designed to overcome the problems associated with reusable passwords.

The user’s password changes continuously.

This technology employs a credit card-sized smart card that contains a microprocessor programmed with an algorithm that generates, and electronically displays, a new and unique password every 60 seconds.

The card works in conjunction with special authentication software located on a mainframe or network server computer. Each user’s card is synchronized to the authentication software, so that at any point in time both the smart card and the network software are generating the same password for the same user.

PTS: 1

5.

What is event monitoring?

ANS: Event monitoring summarizes key activities related to system resources. Event logs typically record the IDs of all users accessing the system; the time and duration of a user’s session; programs that were executed during a session; and the files, databases, printers, and other resources accessed.

PTS: 1

6.

What are the auditor’s concerns in testing EDI controls?

ANS: When testing EDI controls, the auditor’s primary concerns are related to ascertaining that EDI transactions are authorized, validated, and in compliance with organization policy, that no unauthorized organizations gain access to records, that authorized trading partners have access only to approved data, and that adequate controls are in place to maintain a complete audit trail.

PTS: 1

7.

What can be done to defeat a DDoS Attack?

ANS: Intrusion Prevention Systems (IPS) that employ deep packet inspection (DPI) are a countermeasure to DDoS attacks.

PTS: 1

8.

What is deep packet inspection?

ANS: DPI is a technique that searches individual network packets for protocol non-compliance and can identify and classify malicious packets based on a database of known attack signatures.

PTS: 1

9.

Explain how smurf attacks can be controlled.

ANS: The targeted organization can program their firewall to ignore all communication from the attacking site, once the attackers IP address is determined.

PTS: 1

10.

Explain how SYN Flood attacks can be controlled.

ANS: Two things can be done:

First, Internet hosts can program their firewalls to block outbound message packets that contain invalid internal IP addresses.

Second, security software can scan for half-open connections that have not been followed by an ACK packet. The clogged ports can then be restored to allow legitimate connections to use them.

PTS: 1

11.

Discuss the private key encryption technique and its shortcomings.

ANS: To encode a message, the sender provides the encryption algorithm with the key, which produces the ciphertext message. This is transmitted to the receiver’s location, where it is decoded using the same key to produce a cleartext message. Because the same key is used for coding and decoding, control over the key becomes an important security issue. The more individuals that need to exchange encrypted data, the greater the chance that the key will become known to an intruder who could intercept a message and read it, change it, delay it, or destroy it.

PTS: 1

12.

Discuss the public key encryption technique.

ANS: This approach uses two different keys: one for encoding messages and the other for decoding them.

The recipient has a private key used for decoding that is kept secret. The encoding key is public and published for everyone to use. Receivers never need to share private keys with senders, which reduces the likelihood that they fall into the hands of an intruder. One of the most trusted public key encryption methods is Rivest-Shamir-Adleman (RSA). This method is, however, computationally intensive and much slower than private key encryption.

PTS: 1

ESSAY

1.

What is an operating system? What does it do? What are operating system control objectives?

ANS: An operating system is a computer’s control program. It controls user sharing of applications and resources such as processors, memory, databases, and peripherals such as printers. Common PC operating systems include Windows 2000, Windows NT, and Linux.

An operating system carries out three primary functions: translating high level languages into machine language using modules called compilers and interpreters; allocating computer resources to users, workgroups, and applications; and managing job scheduling and multiprogramming.

Operating systems have five basic control objectives: 1.

2.

to protect itself from users, to protect users from each other,

3.

4.

5.

to protect users from themselves, to protect it from itself, and to protect itself from its environment.

PTS: 1

2.

What are the three security objectives of audit trails? Explain.

ANS: Audit trails support system security objectives in three ways. By detecting unauthorized access to the system, the audit trail protects the system from outsiders trying to breach system controls. By monitoring system performance, changes in the system may be detected. The audit trail can also contribute to reconstructing events such as system failures, security breaches, and processing errors. In addition, the ability to monitor user activity can support increased personal accountability.

PTS: 1

3.

Discuss three sources of exposure (threats) to the operating system.

ANS: 1.

Privileged personnel who abuse their authority. Systems administrators and systems programmers require unlimited access to the operating system to perform maintenance and to recover from system failures. Such individuals may use this authority to access users’ programs and data files.

2.

Individuals both internal and external to the organization who browse the operating system to identify and exploit security flaws.

3.

Individuals who intentionally (or accidentally) insert computer viruses or other forms of destructive programs into the operating system.

PTS: 1

4.

Discuss three techniques for breaching operating system controls.

ANS: Browsing involves searching through areas of main memory for password information.

Masquerading is a technique where a user is made to believe that he/she has accessed the operating system and therefore enters passwords, etc., that can later be used for unauthorized access.

A virus is a program that attaches itself to legitimate software to penetrate the operating system.

Most are destructive.

A worm is software that replicates itself in memory.

A logic bomb is a destructive program triggered by some “logical” condition–a matching date, e.g., Michelangelo’s birthday.

PTS: 1

5.

A formal log-on procedure is the operating system’s first line of defense. Explain how this works.

ANS: When the user logs on, he or she is presented with a dialog box requesting the user’s ID and password. The system compares the ID and password to a database of valid users. If the system finds a match, then the log-on attempt is authenticated. If, however, the password or ID is entered incorrectly, the log-on attempt fails and a message is returned to the user. The message should not reveal whether the password or the ID caused the failure. The system should allow the user to reenter the log-on information. After a specified number of attempts (usually no more than five), the system should lock out the user from the system.

PTS: 1

6.

Explain the concept of discretionary access privileges.

ANS: In centralized systems, a system administrator usually determines who is granted access to specific resources and maintains the access control list. In distributed systems, however, resources may be controlled (owned) by end users. Resource owners in this setting may be granted discretionary access privileges, which allow them to grant access privileges to other users. For example, the controller, who is the owner of the general ledger, may grant read-only privileges to a manager in the budgeting department. The accounts payable manager, however, may be granted both read and write permissions to the ledger. Any attempt by the budgeting manager to add, delete, or change the general ledger will be denied. The use of discretionary access control needs to be closely supervised to prevent security breaches because of its liberal use.

PTS: 1

7.

Contrast a LAN and a WAN. Typically, who owns and maintains a WAN?

ANS: A LAN is a local area network covering a limited geographic area (a room, a building, several buildings within a restricted geographic distance). Information processing units connected to a LAN are usually microcomputer-based workstations. Typically, LANs are privately owned and controlled.

When networks exceed the geographic limitations of the LAN, they are called WANs. Because of the distances involved and the high cost of telecommunication infrastructure, WANs are often commercial networks (at least in part) that the organization leases. The nodes of a WAN may include microcomputer workstations, minicomputers, mainframes, and LANs. The WAN may be used to link geographically dispersed segments of a single organization or connect multiple organizations in a trading partner arrangement.

PTS: 1

8.

Network communication poses some special types of risk for a business. What are the two broad areas of concern? Explain.

ANS: Two general types of risk exist when networks communicate with each other–risks from subversive threats and risks from equipment failure.

Subversive threats include interception of information transmitted between sender and receiver, computer hackers gaining unauthorized access to the organization’s network, and denial-of-service attacks from remote locations on the Internet. Methods for controlling these risks include firewalls, encryption, digital signatures, digital certificates, message transaction logs, and call-back devices.

Equipment failure can be the result of line errors. The problems can be minimized with the help of echo checks, parity checks, and good backup control.

PTS: 1

9.

Describe the basic differences between the star, ring, and bus topologies.

ANS: The star topology is a configuration of IPUs with a large central computer (the host) at the hub (or center) that has connections to a number of smaller computers. Communication between nodes is managed from the host.

The ring topology connects many computers of equal status. There is no host. Management of communication is distributed among the nodes.

In the bus topology, all nodes are connected to a common cable, the bus. Communication and file transfer are controlled centrally by one or more server.

PTS: 1

10.

Define and contrast digital certificate and digital signature.

ANS: A digital certificate is like an electronic identification card that is used in conjunction with a public key encryption system to verify the authenticity of the message sender. These are issued by certification authorities.

A digital signature is an electronic authentication technique that ensures that the transmitted message originated with the authorized sender and that it was not tampered with after the signature was applied.

PTS: 1

11.

Explain the function of the two parts of the TCP/IP protocol.

ANS: The two parts of the TCP/IP protocol are the transfer control protocol (TCP) and the Internet protocol (IP). This controls how individual packets of data are formatted, transmitted, and received. The TCP supports the transport function of the OSI (Open System Interface) model that has been adopted by the International Standards Organization for the communication community. This ensures that the full message is received. The IP component provides the routing mechanism. It contains a network address and is used to route messages to their destinations.

PTS: 1

12.

ANS:

What are network protocols? What functions do they perform?

Network protocols are the rules and standards governing the design of hardware and software that permit users of networks manufactured by different vendors to communicate and share data.

Protocols perform a number of different functions.

1.

2.

3.

4.

5.

They They They They They

facilitate the physical connection between network devices. synchronize the transfer of data between physical devices. provide a basis for error checking and measuring network performance. promote compatibility among network devices. promote network designs that are flexible, expandable, and cost-effective.

PTS: 1

13.

ANS:

Explain a SYN flood attack.

Normally user establishes a connection on the Internet via a three-way handshake. The connecting server sends an initiation code called a SYN (SYNchronize) packet to the receiving server. The receiving server then acknowledges the request by returning a SYNchronize-AC Knowledge (SYNAC K) packet. Finally, the initiating host machine responds with an ACK packet code. The SYN flood attack is accomplished by not sending the final acknowledgment to the server’s SYNACK response, which causes the server to keep signaling for acknowledgement until the server times out.

The individual or organization perpetrating the SYN flood attack transmits hundreds of SYN packets to the targeted receiver, but never responds with an ACK to complete the connection. As a result, the ports of the receiver’s server are clogged with incomplete communication requests that prevent legitimate transactions from being received and processed. Organizations under attack may, thus, be prevented from receiving Internet messages for days at a time.

PTS: 1

14.

ANS:

Explain a smurf attack.

A smurf attack involves three parties: the perpetrator, the intermediary, and the victim. It is accomplished by exploiting an internet maintenance tool called a ping, which is used to test the state of network congestion and determine whether a particular host computer is connected and available on the network.

The perpetrator of a smurf attack uses a program to create a ping message packet that contains the forged IP address of the victim’s computer (IP spoofing) rather than that of the actual source computer. The ping message is then sent to the intermediary, which is actually an entire sub network of computers. By sending the ping to the network’s IP broadcast address, the perpetrator ensures

that each node on the intermediary network receives the echo request automatically. Consequently, each intermediary node sends echo responses to the ping message, which are returned to the victim’s IP address not the source computer’s. The resulting flood of echoes can overwhelm the victim’s computer and cause network congestion that makes it unusable for legitimate traffic.

PTS: 1

15.

ANS:

Explain a distributed denial of service attack.

A distributed denial of service (DDoS) attack may take the form of a SYN flood or smurf attack. The distinguishing feature of the DDoS is the sheer scope of the event. The perpetrator of a DDoS attack may employ a virtual army of so-called zombie or bot (robot) computers to launch the attack. Since vast numbers of unsuspecting intermediaries are needed, the attack often involves one or more Internet Relay Chat (IRC) networks as a source of zombies. The perpetrator accesses the IRC and uploads a malicious program such as a Trojan horse, which contains DDoS attack script. This program is subsequently downloaded to the PCs of the many thousands of people who visit the IRC site. The attack program runs in the background on the new zombie computers, which are now under the control of the perpetrator. Via the zombie control program the perpetrator can direct the DDoS to specific victims and turn on or off the attack at will.

PTS: 1

16.

Discuss the changing motivation behind a denial of service attack.

ANS: The motivation behind DoS attacks may originally have been to punish an organization with which the perpetrator had a grievance or simply to gain bragging rights for being able to do it. Today, DoS attacks are also perpetrated for financial gain. Financial institutions, which are particularly dependent on Internet access, have been prime targets. Organized criminals threatening a devastating attack have extorted several institutions, including the Royal Bank of Scotland. The typical scenario is for the perpetrator to launch a short DDoS attack (a day or so) to demonstrate what life would be like if the organization were isolated from the Internet. After the attack, the CEO of the organization receives a phone call demanding that a sum of money be deposited in an off-shore account, or the attack will resume. Compared to the potential loss in customer confidence, damaged reputation, and lost revenues, the ransom may appear to be a small price to pay.

PTS: 1

Chapter 5— Systems Development and Program Change Activities

TRUE/FALSE

1.

The objective of systems planning is to link systems projects to the strategic objectives of the firm.

ANS: T

2.

The Systems Development Life Cycle (SDLC) concept applies to specific applications and not to strategic systems planning.

ANS: F

3.

PTS: 1

When determining the operational feasibility of a new system, the expected ease of transition from the old system to the new system should be considered.

ANS: T

6.

PTS: 1

In the conceptual design phase of the Systems Development Life Cycle (SDLC), task force members are focused on selecting the new system design.

ANS: F

5.

PTS: 1

An accountant’s responsibility in the SDLC is to ensure that the system applies proper accounting conventions and rules and possesses adequate control.

ANS: T

4.

PTS: 1

PTS: 1

One-time costs include operating and maintenance costs.

ANS: F

7.

When preparing a cost-benefit analysis, design costs incurred in the systems planning, systems analysis and conceptual design phases of the Systems Development Life Cycle are relevant costs.

ANS: F

8.

PTS: 1

All of the steps in the Systems Development Life Cycle apply to software that is developed in-house and to commercial software.

ANS: F

12.

PTS: 1

When the nature of the project and the needs of the user permit, most organizations will seek a pre-coded commercial software package rather than develop a system in-house.

ANS: T

11.

PTS: 1

Instead of implementing an application in a single big-bang release, modern systems are delivered in parts continuously and quickly

ANS: T

10.

PTS: 1

A tangible benefit can be measured and expressed in financial terms.

ANS: T

9.

PTS: 1

PTS: 1

During the detailed feasibility study of the project, the systems professional who proposed the project should be involved in performing the study.

ANS: F

PTS: 1

13.

Recurring costs include: hardware maintenance, software acquisition, software maintenance, insurance, supplies and personnel costs.

ANS: F PTS: 1

14.

The payback method is often more useful than the net present value method for evaluating systems projects because the effective lives of information system tend to be short and shorter payback projects are often desirable.

ANS: T

15.

Intangible benefits are not physical, but can be measured and expressed in financial terms.

ANS: F

16.

PTS: 1

Programs in their compiled state are very susceptible to the threat of unauthorized modification.

ANS: F

18.

PTS: 1

Legal feasibility identifies conflicts between the proposed system and the company’s ability to discharge its legal responsibilities

ANS: T

17.

PTS: 1

PTS: 1

Maintenance access to systems increases the risk that logic will be corrupted either by the accident or intent to defraud.

ANS: T

19.

Source program library controls should prevent and detect unauthorized access to application programs.

ANS: T

20.

PTS: 1

PTS: 1

The user test and acceptance procedure is the last point at which the user can determine the system’s acceptability prior to it going into service.

ANS: T

PTS: 1

MULTIPLE CHOICE

1.

Which control is not associated with new systems development activities? a.

reconciling program version numbers

b.

program testing

c.

user involvement

d.

internal audit participation

ANS: A

PTS: 1

2.

Which test of controls will provide evidence that the system as originally implemented was free from material errors and free from fraud? Review of the documentation indicates that a.

a cost-benefit analysis was conducted

b.

the detailed design was an appropriate solution to the user’s problem

c.

tests were conducted at the individual module and total system levels prior to implementati

d.

problems detected during the conversion period were corrected in the maintenance phase

ANS: C

3.

PTS: 1

Routine maintenance activities require all of the following controls except a.

documentation updates

b.

testing

c.

formal authorization

d.

internal audit approval

ANS: D

4.

PTS: 1

Which statement is correct? a.

compiled programs are very susceptible to unauthorized modification

b.

the source program library stores application programs in source code form

c.

modifications are made to programs in machine code language

d.

the source program library management system increases operating efficiency

ANS: B

5.

PTS: 1

Which control ensures that production files cannot be accessed without specific permission? a.

Database Management System

b.

Recovery Operations Function

c.

Source Program Library Management System

d.

Computer Services Function

ANS: C

6.

PTS: 1

Program testing a.

involves individual modules only, not the full system

b.

requires creation of meaningful test data

c.

need not be repeated once the system is implemented

d.

is primarily concerned with usability

ANS: B

7.

Which statement is not true? a.

An audit objective for systems maintenance is to detect unauthorized access to application d

b.

An audit objective for systems maintenance is to ensure that applications are free from erro

c.

An audit objective for systems maintenance is to verify that user requests for maintenance r

d.

An audit objective for systems maintenance is to ensure that the production libraries are pro

ANS: A

8.

PTS: 1

PTS: 1

When the auditor reconciles the program version numbers, which audit objective is being tested? a.

protect applications from unauthorized changes

b.

ensure applications are free from error

c.

protect production libraries from unauthorized access

d.

ensure incompatible functions have been identified and segregated

ANS: A

9.

PTS: 1

Which is not a level of a data flow diagram? a.

conceptual level

b.

context level

c.

intermediate level

d.

elementary level

ANS: A

10.

PTS: 1

Which statement is not correct? The structured design approach

a.

is a top-down approach

b.

is documented by data flow diagrams and structure diagrams

c.

assembles reusable modules rather than creating systems from scratch

d.

starts with an abstract description of the system and redefines it to produce a more detailed

ANS: C

11.

PTS: 1

The benefits of the object-oriented approach to systems design include all of the following except

a.

this approach does not require input from accountants and auditors

b.

development time is reduced

c.

a standard module once tested does not have to be retested until changes are made

d.

system maintenance activities are simplified

ANS: A

12.

PTS: 1

Evaluators of the detailed feasibility study should not include

a.

the internal auditor

b.

the project manager

c.

a user representative

d.

the system designer

ANS: D

13. a.

PTS: 1

A cost-benefit analysis is a part of the detailed operational feasibility study

b.

schedule feasibility study

c.

legal feasibility study

d.

economic feasibility study

ANS: D

14.

PTS: 1

Examples of one-time costs include all of the following except

a.

hardware acquisition

b.

insurance

c.

site preparation

d.

programming

ANS: B

15.

PTS: 1

Examples of recurring costs include

a.

software acquisition

b.

data conversion

c.

personnel costs

d.

systems design

ANS: C

16.

PTS: 1

A commercial software system that is completely finished, tested, and ready for implementation is called a

a.

backbone system

b.

vendor-supported system

c.

benchmark system

d.

turnkey system

ANS: D

17.

PTS: 1

Which of the following is not an advantage of commercial software? Commercial software

a.

can be installed faster than a custom system

b.

can be easily modified to the user’s exact specifications

c.

is significantly less expensive than a system developed in-house

d.

is less likely to have errors than an equivalent system developed in-house

ANS: B

PTS: 1

18.

Which step is least likely to occur when choosing a commercial software package?

a.

a detailed review of the source code

b.

contact with user groups

c.

preparation of a request for proposal

d.

comparison of the results of a benchmark problem

ANS: A

19.

PTS: 1

The output of the detailed design phase of the Systems Development Life Cycle (SDLC) is a

a.

fully documented system report

b.

systems selection report

c.

detailed system design report

d.

systems analysis report

ANS: C

PTS: 1

20.

The detailed design report contains all of the following except

a.

input screen formats

b.

alternative conceptual designs

c.

report layouts

d.

process logic

ANS: B

21.

PTS: 1

System documentation is designed for all of the following groups except

a.

systems designers and programmers

b.

end users

c.

accountants

d.

all of the above require systems documentation

ANS: D

22.

PTS: 1

Which type of documentation shows the detailed relationship of input files, programs, and output files?

a.

structure diagrams

b.

overview diagram

c.

system flowchart

d.

program flowchart

ANS: C

23.

PTS: 1

Typical contents of a run manual include all of the following except

a.

run schedule

b.

logic flowchart

c.

file requirements

d.

explanation of error messages

ANS: B

24.

PTS: 1

Computer operators should have access to all of the following types of documentation except

a.

a list of users who receive output

b.

a program code listing

c.

a list of all master files used in the system

d.

a list of required hardware devices

ANS: B

25.

PTS: 1

Which task is not essential during a data conversion procedure?

a.

decomposing the system

b.

validating the database

c.

reconciliation of new and old databases

d.

backing up the original files

ANS: A

26.

PTS: 1

When converting to a new system, which cutover method is the most conservative?

a.

cold turkey cutover

b.

phased cutover

c.

parallel operation cutover

d.

data coupling cutover

ANS: C

27.

PTS: 1

Site preparation costs include all of the following except

a.

crane used to install equipment

b.

freight charges

c.

supplies

d.

reinforcement of the building floor

ANS: C

28.

PTS: 1

The testing of individual program modules is a part of

a.

software acquisition costs

b.

systems design costs

c.

data conversion costs

d.

programming costs

ANS: D

29.

PTS: 1

When implementing a new system, the costs associated with transferring data from one storage medium to another is an example of

a.

a recurring cost

b.

a data conversion cost

c.

a systems design cost

d.

a programming cost

ANS: B

30.

PTS: 1

An example of a tangible benefit is

a.

increased customer satisfaction

b.

more current information

c.

reduced inventories

d.

faster response to competitor actions

ANS: C

PTS: 1

31.

An example of an intangible benefit is

a.

expansion into other markets

b.

reduction in supplies and overhead

c.

more efficient operations

d.

reduced equipment maintenance

ANS: C

32.

PTS: 1

A tangible benefit

a.

can be measured and expressed in financial terms

b.

might increase revenues

c.

might decrease costs

d.

all of the above

ANS: D

33.

PTS: 1

Intangible benefits

a.

are easily measured

b.

are of relatively little importance in making information system decisions

c.

are sometimes estimated using customer satisfaction surveys

d.

when measured, do not lend themselves to manipulation

ANS: C

34.

PTS: 1

Which technique is least likely to be used to quantify intangible benefits?

a.

opinion surveys

b.

simulation models

c.

professional judgment

d.

review of accounting transaction data

ANS: D

35.

PTS: 1

The formal product of the systems evaluation and selection phase of the Systems Development Life Cycle is

a.

the report of systems analysis

b.

the systems selection report

c.

the detailed system design

d.

the systems plan

ANS: B

36.

PTS: 1

Typically a systems analysis

a.

results in a formal project schedule

b.

does not include a review of the current system

c.

identifies user needs and specifies system requirements

d.

is performed by the internal auditor

ANS: C

37.

PTS: 1

A disadvantage of surveying the current system is

a.

it constrains the generation of ideas about the new system

b.

it highlights elements of the current system that are worth preserving

c.

it pinpoints the causes of the current problems

d.

all of the above are advantages of surveying the current system

ANS: A

38.

PTS: 1

Systems analysis involves all of the following except

a.

gathering facts

b.

surveying the current system

c.

redesigning bottleneck activities

d.

reviewing key documents

ANS: C

39.

PTS: 1

The systems analysis report does not

a.

identify user needs

b.

specify requirements for the new system

c.

formally state the goals and objectives of the system

d.

specify the system processing methods

ANS: D

40.

PTS: 1

The role of the steering committee includes

a.

designing the system outputs

b.

resolving conflicts that arise from a new system

c.

selecting the programming techniques to be used

d.

approving the accounting procedures to be implemented

ANS: B

41.

PTS: 1

Project planning includes all of the following except

a.

specifying system objectives

b.

preparing a formal project proposal

c.

selecting hardware vendors

d.

producing a project schedule

ANS: C

42.

PTS: 1

Aspects of project feasibility include all of the following except

a.

technical feasibility

b.

economic feasibility

c.

logistic feasibility

d.

schedule feasibility

ANS: C

43.

PTS: 1

Which of the following is not a tool of systems analysts?

a.

observation

b.

task participation

c.

audit reports

d.

personal interviews

ANS: C

44.

PTS: 1

When developing the conceptual design of a system,

a.

all similarities and differences between competing systems are highlighted

b.

structure diagrams are commonly used

c.

the format for input screens and source documents is decided

d.

inputs, processes, and outputs that distinguish one alternative from another are identified

ANS: D

45.

PTS: 1

The role of the accountant/internal auditor in the conceptual design phase of the Systems Development Life Cycle includes all of the following except

a.

the accountant is responsible for designing the physical system

b.

the accountant is responsible to ensure that audit trails are preserved

c.

the internal auditor is responsible to confirm that embedded audit modules are included in t

d.

the accountant is responsible to make sure that the accounting conventions that apply to th

ANS: A

46.

PTS: 1

Strategic systems planning is important because the plan

a.

provides authorization control for the Systems Development Life Cycle

b.

will eliminate any crisis component in systems development

c.

provides a static goal to be attained within a five-year period

d.

all of the above

ANS: A

47.

PTS: 1

Project feasibility includes all of the following except

a.

technical feasibility

b.

conceptual feasibility

c.

operational feasibility

d.

schedule feasibility

ANS: B

PTS: 1

SHORT ANSWER

1.

Contrast the source program library (SPL) management system to the database management system (DBMS).

ANS: The SPL software manages program files and the DBMS manages data files.

PTS: 1

2.

List three methods used to control the source program library.

ANS: passwords, separate test libraries, audit trail and management reports, program version numbers, controlling access to maintenance commands

PTS: 1

3.

New system development activity controls must focus on the authorization, development, and implementation of new systems and its maintenance. Discuss at least five control activities that are found in an effective system development life cycle.

ANS: System authorization activities assure that all systems are properly authorized to ensure their economic justification and feasibility.

User specification activities should not be stifled by technical issues. Users can provide written description of the logical needs that must be satisfied by the system.

Technical design activities must lead to specifications that meet user needs. Documentation is both a control and evidence of control.

Internal audit involvement should occur throughout the process to assure that the system will serve user needs.

Program testing is to verify that data is processed as intended.

PTS: 1

4.

List three advantages and one disadvantage of commercial software.

ANS: Advantages include very quick implementation time, relatively inexpensive software, and reliable, tested software.

Disadvantages include not being able to customize the system and difficulty in modifying the software.

PTS: 1

5.

Describe a risk associated with the phased cutover procedure for data conversion.

ANS: Incompatibilities may exist between the new subsystems and the yet-to-be replaced old subsystems.

PTS: 1

6.

Why is it important that the systems professionals who design a project not perform the detailed feasibility study of the project?

ANS:

Objectivity is essential to the fair assessment of each project design. To ensure objectivity, an independent systems professional should perform the study.

PTS: 1

7.

____________________ benefits can be measured and expressed in financial terms, while ____________________ benefits cannot be easily measured and/or quantified.

ANS: Tangible, intangible

PTS: 1

8.

What is a systems selection report?

ANS: A systems selection report is a formal document that consists of a revised feasibility study, a costbenefit analysis, and a list and explanation of intangible benefits for each alternative design. The steering committee uses this report to select a system.

PTS: 1

9.

Why is the payback method often more useful than the net present value method for evaluating systems projects?

ANS: Because of brief product life cycles and rapid advances in technology, the effective lives of information system tends to be short. Shorter payback projects are often desirable.

PTS: 1

10.

What are the auditor’s objectives relating to systems development?

ANS: The auditor’s objectives are to ensure that (1) systems development activities are applied consistently and in accordance with management’s policies to all systems development projects; (2) the system as originally implemented was free from material errors and fraud; (3) the system was judged necessary and justified at various checkpoints throughout the SDLC; and (4) system documentation is sufficiently accurate and complete to facilitate audit and maintenance activities.

PTS: 1

11.

Describe a test of controls that would provide evidence that only authorized program maintenance is occurring.

ANS: reconcile program version numbers, confirm maintenance authorizations

PTS: 1

12.

What are program version numbers and how are the used?

ANS: The SPLMS assigns a version number automatically to each program stored on the SPL. When programs are first placed in the libraries (at implementation), they are assigned version number zero.

With each modification to the program, the version number is increased by one.

PTS: 1

13.

Explain why accountants are interested in the legal feasibility of a new systems project.

ANS: Legal feasibility identifies conflicts between the proposed system and the company’s ability to discharge its legal responsibilities. Accountants are often tasked with the legal requirements associated with developing the internal control system and securing information from inappropriate disclosure.

PTS: 1

14.

Explain an advantage of surveying the current system when preparing a systems analysis for a new systems project.

ANS: An analysis of the current system will identify what aspects of the current system should be retained; facilitate the conversion from the old to the new system; and may uncover causes of reported problems.

PTS: 1

15.

What are two purposes of the systems project proposal?

ANS: First, it summarizes the findings of the study conducted to this point into a general recommendation for a new or modified system. This enables management to evaluate the perceived problem along with the proposed system as a feasible solution. Second, the proposal outlines the linkage between the objectives of the proposed system and the business objectives of the firm. It shows that the proposed new system complements the strategic direction of the firm.

PTS: 1

16.

List two ways that a systems project can contribute to the strategic objectives of the firm.

ANS: A new system can improve the operational performance by eliminating nonessential activities and costs, provide a method of differentiating the product or service from the competitors, and provide information that will help improve management decision-making.

PTS: 1

17.

List four types of facts that should be gathered during an analysis of a system.

ANS: data sources; operation users; data stores; processes; data flows; controls; transaction volumes; error rates; resource costs; bottlenecks; and redundant operations

PTS: 1

18.

Distinguish between escapable and inescapable costs. Give an example.

ANS: Escapable costs are directly related to the system, and they cease to exist when the system ceases to exist. An example would be an annual software support fee for purchased software. If the system ceases to exist, the support for the software will no longer be necessary. Inescapable costs, on the other hand, represent costs which will not be eliminated if the system is scrapped. An example would be an overhead charge for office space in a building which is owned by the company. If the system ceases to exist, these costs will be allocated to the remaining departments.

PTS: 1

19.

Why is cost-benefit analysis more difficult for information systems than for many other types of investments organizations make?

ANS: The benefits of information systems are oftentimes very difficult to assess. Many times the benefits are intangible, such as improved decision making capabilities. Also, maintenance costs may be difficult to predict. Most other investments that organizations make, i.e. purchase of a new piece of equipment, tend to have more tangible and estimable costs and benefits.

PTS: 1

ESSAY

1.

Outline the five controllable activities that relate to new systems development

ANS: Systems Authorization Activities: All systems should be properly authorized to ensure their economic justification and feasibility. This requires a formal environment in which users submit requests to systems professionals in written form.

User Specification Activities: Users need to be actively involved in the systems development process. Users should create a detailed written description of their needs. It should describe the user’s view of the problem, not that of the systems professionals.

Technical Design Activities: The technical design activities translate user specifications into a set of detailed technical specifications for a system that meets the user’s needs. The scope of these activities includes systems analysis, feasibility analysis, and detailed systems design.

Internal Audit Participation: The internal auditor plays an important role in the control of systems development activities. The auditor should become involved at the inception of the process and continue through all phases of development and in the maintenance phase. In addition, the

User Test and Acceptance Procedures: Prior to system implementation, the individual modules of the system need to be formally and rigorously tested as a whole. The test team should comprise of user personnel, systems professionals, and internal auditors. The details of the tests performed and their

results need to be formally documented and analyzed. Once the test team is satisfied that the system meets its stated requirements, the system can be transferred to the user.

PTS: 1

2.

Discuss the three groups that participate in systems development.

ANS: System professionals are systems analysts, systems engineers, database designers, and programmers. These individuals actually build the system.

End users are those for whom the system is built. There are many users at all levels in an organization. These include managers and operations personnel, including accountants. During systems development, systems professionals work with primary users to obtain an understanding of users’ problems and a clear statement of their needs.

Stakeholders are individuals who have an interest in the system but are not formal end users. These include the internal steering committee and internal and external auditors. Stakeholders work with the development team to ensure user’s needs are met, adequate internal controls are designed into the systems and that the systems development process itself is properly implemented and controlled.

PTS: 1

3.

Define the feasibility measures that should be considered during project analysis and give an example of each.

ANS: Technical feasibility is an assessment as to whether the system can be developed under existing technology or if new technology is needed. An example might be a situation where a firm wants to completely automate the sales process. A question would be-Is technology available that allows sales to be made without humans?

Economic feasibility is an assessment as to the availability of funds to complete the project. A question would be-Is it cost feasible to purchase equipment to automate sales?

Legal feasibility identifies any conflicts with the proposed system and the company’s ability to discharge its legal responsibilities. An example would be a firm that is proposing a new mail order sales processing system for selling wine.

Operational feasibility shows the degree of compatibility between the firm’s existing procedures and personnel skills and the operational requirements of the new system. Do the firm have the right work force to operate the system? If not, can employees be trained? If not, can they be hired?

Schedule feasibility pertains to whether the firm can implement the project within an acceptable time frame. An example would be a new ticket sales system for a sports team. The system would need to be implemented prior to the start of the new season.

PTS: 1

4.

Explain the role of accountants in the conceptual design stage.

ANS: Accountants are responsible for the logical information flows in a new system. Alternate systems considered must be properly controlled, audit trails must be preserved, and accounting conventions and legal requirements must be met. Auditability of a new system depends in part on its design.

PTS: 1

5.

Discuss the advantages and disadvantages of the three methods of converting to a new system: cold turkey cutover, phased cutover, and parallel operation cutover.

ANS: Cold turkey–This is the fastest, quickest and least expensive cutover method. It is also the most risky. If the system does not function properly, there is no backup system to rely on.

Phased cutover–The phased cutover avoids the risk of total system failure because the conversion occurs one module at a time. The disadvantage of this method is the potential incompatibilities between new modules that have been implemented and old modules that have not yet been phased out.

Parallel operation cutover–This is the most time consuming and costly of the three methods, but it also provides the greatest security. The old system is not terminated until the new system is tested for accuracy.

PTS: 1

6.

What is the purpose of the auditor’s review of SDLC documentation?

ANS: In reviewing the SDLC documentation, the auditor seeks to determine that completed projects now in use reflect compliance with SDLC policies including:     

User and computer services management properly authorized the project.

A preliminary feasibility study showed that the project had merit.

A detailed analysis of user needs was conducted that resulted in alternative conceptual designs.

A cost-benefit analysis was conducted using reasonably accurate figures.

The detailed design was an appropriate and accurate solution to the user’s problem.

  

Test results show that the system was thoroughly tested at both the individual module and the total system level before implementation. (To confirm these test results, the auditor may decide to retest selected elements of the application.)

There is a checklist of specific problems detected during the conversion period, along with evidence that they were corrected in the maintenance phase.

Systems documentation complies with organizational requirements and standards

PTS: 1

7.

Classify each of the following as either a one-time or recurring costs: training personnel initial programming and testing system design-one hardware costs software maintenance costs site preparation rent for facilities data conversion from old system to new system insurance costs installation of original equipment hardware upgrades

ANS: training personnel-one-time initial programming and testing-one-time system design-one-time

hardware costs-one-time software maintenance costs-recurring site preparation-one-time rent for facilities-recurring data conversion from old system to new system-one-time insurance costs-recurring installation of original equipment-one-time hardware upgrades-recurring

PTS: 1

8.

Explain how application version numbers can be used as an audit to0l for assessing program change controls.

ANS: The SPLMS assigns a version number automatically to each program stored on the SPL. When programs are first placed in the libraries (at implementation), they are assigned version number zero.

With each modification to the program, the version number is increased by one. This feature, when combined with audit trail reports, provides a basis for detecting unauthorized changes to the application program. An unauthorized change is signaled by a version number on the production load module that cannot be reconciled to the number of authorized changes. For example, if 10 changes were authorized but the production program is Version 11, then two possible control violations may have happened: (1) an authorized change occurred, which for some reason went undocumented, or (2) an unauthorized change was made, which incremented the version number.

PTS: 1