1. Company.com has contracted with an external consulting firm to implement a commercial financial system to replace its existing in-house developed system. In reviewing the proposed development approach, which of the following would be of GREATEST concern?
A) Acceptance testing is to be managed by users. B) A quality plan is not part of the contracted deliverables. C) Not all business functions will be available on initial implementation. D) Prototyping is being used to confirm that the system meets business requirements.
2. In a public key infrastructure (PKI), the authority responsible for the identification and authentication of an applicant for a digital certificate (i.e., certificate subjects) is the:
A) registration authority (RA). B) issuing certification authority (CA). C) subject CA. D) policy management authority.
3. Which of the following is a data validation edit and control?
A) Hash totals B) Reasonableness checks C) Online access controls D) Before and after image reporting
4. A control that detects transmission errors by appending calculated bits onto the end of each segment of data is known as a:
A) reasonableness check. B) parity check. C) redundancy check. D) check digits.
5. What is the primary objective of a control self-assessment (CSA) program?
A) Enhancement of the audit responsibility B) Elimination of the audit responsibility C) Replacement of the audit responsibility D) Integrity of the audit responsibility
1. Right Answer: B Explanation: A quality plan is an essential element of all projects. It is critical that the contracted supplier be required to produce such a plan. The quality plan for the proposed development contract should be comprehensive and encompass all phases of the development and include which business functions will be included and when.Acceptance is normally managed by the user area, since they must be satisfied that the new system will meet their requirements. If the system is large, a phased- in approach to implementing the application is a reasonable approach. Prototyping is a valid method of ensuring that the system will meet business requirements.
2. Right Answer: A Explanation: A RA is an entity that is responsible for identification and authentication of certificate subjects, but the RA does not sign or issue certificates. The certificate subject usually interacts with the RA for completing the process of subscribing to the services of the certification authority in terms of getting identity validated with standard identification documents, as detailed in the certificate policies of the CA. In the context of a particular certificate, the issuing CA is the CA that issued the certificate. In the context of a particular CA certificate, the subject CA is the CA whose public key is certified in the certificate.
3. Right Answer: B Explanation: A reasonableness check is a data validation edit and control, used to ensure that data conforms to predetermined criteria.
4. Right Answer: C Explanation: A redundancy check detects transmission errors by appending calculated bits onto the end of each segment of data.
5. Right Answer: A Explanation: Audit responsibility enhancement is an objective of a control self-assessment (CSA) program.
Leave a comment