CA Information Systems 3

Question 1

An auditor reviewing an ERP system wants to ensure no single user can both approve purchase orders and record payments. This is an example of:

Accepted Answer

Separation of duties

Answer

Separation of duties prevents fraud and errors by requiring different individuals to perform incompatible functions within a process.

Question 2

Which encryption standard is currently recommended by NIST for protecting sensitive government and commercial data?

Accepted Answer

AES

Answer

AES (Advanced Encryption Standard) with 128-, 192-, or 256-bit keys is the NIST-approved standard for symmetric encryption.

Question 3

In the context of IT auditing, a 'logic bomb' refers to:

Accepted Answer

Malicious code that executes when a specific condition or date is met

Answer

A logic bomb is dormant malicious code triggered by a specific event, such as a date, user action, or system condition.

Question 4

Which SDLC phase involves translating system requirements into detailed technical specifications?

Accepted Answer

System design

Answer

The system design phase converts the logical requirements identified during analysis into detailed technical blueprints for construction.

Question 5

A company uses tokenization for credit card data. What does tokenization accomplish?

Accepted Answer

Replaces sensitive data with a non-sensitive placeholder that maps back to the original

Answer

Tokenization substitutes sensitive data with a token that has no exploitable value, reducing PCI DSS scope.

(CA) Certified Accountant Practice Test