In reviewing the project timeline for a significant application software development project the IS auditor notes that no time was allocated for the design and performance of program code unit tests. Which of the following should (he auditor recommend?

• A.Unit test design should be performed before program coding begins.
• B.Unit lest design should be performed before program specifications are defined.
• C.Unit test design should be performed after user testing is performed.
• D.Unit testing is not necessary since exhaustive user testing will be performed.

Comment: *

Name: *

Email: *

Verification: *

Which significant risk is introduced by running the file transfer protocol (FTP) service on a server in a demilitarized zone (DMZ)?

• A.A user from within could send a file to an unauthorized person.
• B.FTP services could allow a user to download files from unauthorized sources.
• C.A hacker may be able to use the FTP service to bypass the firewall.
• D.FTP could significantly reduce the performance of a DMZ server.

Comment: *

Name: *

Email: *

Verification: *

During an audit of a business continuity plan (BCP), an IS auditor found that, although all departments were
housed in the same building, each department had a separate BCP. The IS auditor recommended that the
BCPs be reconciled. Which of the following areas should be reconciled FIRST?

• A.Evacuation plan
• B.Recovery priorities
• C.Backup storages
• D.Call tree

Comment: *

Name: *

Email: *

Verification: *

An IS auditor should expect the responsibility for authorizing access rights to production data and systems to be entrusted to the:

• A.process owners.
• B.system administrators.
• C.security administrator.
• D.data owners.

Comment: *

Name: *

Email: *

Verification: *

IT control objectives are useful to IS auditors, as they provide the basis for understanding the:

• A.desired result or purpose of implementing specific control procedures.
• B.best IT security control practices relevant to a specific entity.
• C.techniques for securing information.
• D.security policy.

Comment: *

Name: *

Email: *

Verification: *