CA Information Systems 3 — Questions and Answers
Question 1: An auditor reviewing an ERP system wants to ensure no single user can both approve purchase orders and record payments. This is an example of:
- Audit trail review
- Separation of duties (Correct answer)
- Password complexity enforcement
- Data masking
Correct answer: Separation of duties
Separation of duties prevents fraud and errors by requiring different individuals to perform incompatible functions within a process.
Question 2: Which encryption standard is currently recommended by NIST for protecting sensitive government and commercial data?
- DES
- 3DES
- AES (Correct answer)
- RC4
Correct answer: AES
AES (Advanced Encryption Standard) with 128-, 192-, or 256-bit keys is the NIST-approved standard for symmetric encryption.
Question 3: In the context of IT auditing, a 'logic bomb' refers to:
- A denial-of-service attack that overwhelms servers
- Malicious code that executes when a specific condition or date is met (Correct answer)
- An unauthorized backdoor inserted during software development
- A hardware failure caused by power surges
Correct answer: Malicious code that executes when a specific condition or date is met
A logic bomb is dormant malicious code triggered by a specific event, such as a date, user action, or system condition.
Question 4: Which SDLC phase involves translating system requirements into detailed technical specifications?
- Feasibility study
- System analysis
- System design (Correct answer)
- Implementation
Correct answer: System design
The system design phase converts the logical requirements identified during analysis into detailed technical blueprints for construction.
Question 5: A company uses tokenization for credit card data. What does tokenization accomplish?
- Compresses card data to reduce storage costs
- Replaces sensitive data with a non-sensitive placeholder that maps back to the original (Correct answer)
- Encrypts card data using a public key
- Fragments card data across multiple servers
Correct answer: Replaces sensitive data with a non-sensitive placeholder that maps back to the original
Tokenization substitutes sensitive data with a token that has no exploitable value, reducing PCI DSS scope.
Question 6: Which type of audit log would be most useful for investigating unauthorized changes to a general ledger?
- Network traffic log
- Change management log
- Database transaction log (Correct answer)
- Email server log
Correct answer: Database transaction log
A database transaction log records all insert, update, and delete operations, enabling forensic reconstruction of unauthorized changes.
Question 7: The concept of 'data integrity' in information systems means that data is:
- Accessible only to authorized users
- Accurate, complete, and unaltered during storage and transmission (Correct answer)
- Encrypted using industry-standard algorithms
- Backed up at least once per day
Correct answer: Accurate, complete, and unaltered during storage and transmission
Data integrity ensures information remains accurate, consistent, and unmodified except through authorized processes.
CA Information Systems 3
An auditor reviewing an ERP system wants to ensure no single user can both approve purchase orders and record payments.
This is an example of: