CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CISA—Certified Information Systems Auditor - Part 178
1. Overall business risk for a particular threat can be expressed as:
A) a product of the probability and magnitude of the impact if a threat successfully exploits a vulnerability.
B) the magnitude of the impact should a threat source successfully exploit the vulnerability.
C) the likelihood of a given threat source exploiting a given vulnerability.
D) the collective judgment of the risk assessment team.
2. Which of the following is a substantive test?
A) Checking a list of exception reports
B) Ensuring approval for parameter changes
C) Using a statistical sample to inventory the tape library
D) Reviewing password history reports
3. Which of the following is a benefit of a risk-based approach to audit planning? Audit:
A) scheduling may be performed months in advance.
B) budgets are more likely to be met by the IS audit staff.
C) staff will be exposed to a variety of technologies.
D) resources are allocated to the areas of highest concern
4. The MAJOR advantage of the risk assessment approach over the baseline approach to information security management is that it ensures:
A) information assets are overprotected.
B) a basic level of protection is applied regardless of asset value.
C) appropriate levels of protection are applied to information assets.
D) an equal proportion of resources are devoted to protecting all information assets.
5. Which of the following sampling methods is MOST useful when testing for compliance?
A) Attribute sampling
B) Variable sampling
C) Stratified mean per unit
D) Difference estimation
A) a product of the probability and magnitude of the impact if a threat successfully exploits a vulnerability.
B) the magnitude of the impact should a threat source successfully exploit the vulnerability.
C) the likelihood of a given threat source exploiting a given vulnerability.
D) the collective judgment of the risk assessment team.
2. Which of the following is a substantive test?
A) Checking a list of exception reports
B) Ensuring approval for parameter changes
C) Using a statistical sample to inventory the tape library
D) Reviewing password history reports
3. Which of the following is a benefit of a risk-based approach to audit planning? Audit:
A) scheduling may be performed months in advance.
B) budgets are more likely to be met by the IS audit staff.
C) staff will be exposed to a variety of technologies.
D) resources are allocated to the areas of highest concern
4. The MAJOR advantage of the risk assessment approach over the baseline approach to information security management is that it ensures:
A) information assets are overprotected.
B) a basic level of protection is applied regardless of asset value.
C) appropriate levels of protection are applied to information assets.
D) an equal proportion of resources are devoted to protecting all information assets.
5. Which of the following sampling methods is MOST useful when testing for compliance?
A) Attribute sampling
B) Variable sampling
C) Stratified mean per unit
D) Difference estimation
1. Right Answer: A
Explanation: Choice A takes into consideration the likelihood and magnitude of the impact and provides the best measure of the risk to an asset. Choice B provides only the likelihood of a threat exploiting a vulnerability in the asset but does not provide the magnitude of the possible damage to the asset. Similarly, choice C considers only the magnitude of the damage and not the possibility of a threat exploiting a vulnerability. Choice D defines the risk on an arbitrary basis and is not suitable for a scientific risk management process.
2. Right Answer: C
Explanation: A substantive test confirms the integrity of actual processing. A substantive test would determine if the tape library records are stated correctly. A compliance test determines if controls are being applied in a manner that is consistent with management policies and procedures. Checking the authorization of exception reports, reviewing authorization for changing parameters and reviewing password history reports are all compliance tests.
3. Right Answer: D
Explanation: The risk-based approach is designed to ensure audit time is spent on the areas of highest risk. The development of an audit schedule is not addressed by a risk- based approach. Audit schedules may be prepared months in advance using various scheduling methods. A risk approach does not have a direct correlation to the audit staff meeting time budgets on a particular audit, nor does it necessarily mean a wider variety of audits will be performed in a given year.
4. Right Answer: C
Explanation: Full risk assessment determines the level of protection most appropriate to a given level of risk, while the baseline approach merely applies a standard set of protection regardless of risk. There is a cost advantage in not overprotecting information. However, an even bigger advantage is making sure that no information assets are over- or under protected. The risk assessment approach will ensure an appropriate level of protection is applied, commensurate with the level of risk and asset value and, therefore, considering asset value. The baseline approach does not allow more resources to be directed toward the assets at greater risk, rather than equally directing resources to all assets.
5. Right Answer: A
Explanation: Attribute sampling is the primary sampling method used for compliance testing. Attribute sampling is a sampling model that is used to estimate the rate of occurrence of a specific quality (attribute) in a population and is used in compliance testing to confirm whether the quality exists. The other choices are used in substantive testing, which involves testing of details or quantity.
Explanation: Choice A takes into consideration the likelihood and magnitude of the impact and provides the best measure of the risk to an asset. Choice B provides only the likelihood of a threat exploiting a vulnerability in the asset but does not provide the magnitude of the possible damage to the asset. Similarly, choice C considers only the magnitude of the damage and not the possibility of a threat exploiting a vulnerability. Choice D defines the risk on an arbitrary basis and is not suitable for a scientific risk management process.
2. Right Answer: C
Explanation: A substantive test confirms the integrity of actual processing. A substantive test would determine if the tape library records are stated correctly. A compliance test determines if controls are being applied in a manner that is consistent with management policies and procedures. Checking the authorization of exception reports, reviewing authorization for changing parameters and reviewing password history reports are all compliance tests.
3. Right Answer: D
Explanation: The risk-based approach is designed to ensure audit time is spent on the areas of highest risk. The development of an audit schedule is not addressed by a risk- based approach. Audit schedules may be prepared months in advance using various scheduling methods. A risk approach does not have a direct correlation to the audit staff meeting time budgets on a particular audit, nor does it necessarily mean a wider variety of audits will be performed in a given year.
4. Right Answer: C
Explanation: Full risk assessment determines the level of protection most appropriate to a given level of risk, while the baseline approach merely applies a standard set of protection regardless of risk. There is a cost advantage in not overprotecting information. However, an even bigger advantage is making sure that no information assets are over- or under protected. The risk assessment approach will ensure an appropriate level of protection is applied, commensurate with the level of risk and asset value and, therefore, considering asset value. The baseline approach does not allow more resources to be directed toward the assets at greater risk, rather than equally directing resources to all assets.
5. Right Answer: A
Explanation: Attribute sampling is the primary sampling method used for compliance testing. Attribute sampling is a sampling model that is used to estimate the rate of occurrence of a specific quality (attribute) in a population and is used in compliance testing to confirm whether the quality exists. The other choices are used in substantive testing, which involves testing of details or quantity.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment