ISACA Information System Auditing Process 4

Question 1

An IS auditor is assessing the adequacy of password policies. Which finding represents the HIGHEST risk?

Accepted Answer

Passwords do not expire for service accounts

Answer

Non-expiring passwords on service accounts pose significant risk because a compromised credential may go undetected indefinitely with no forced rotation.

Question 2

The ISACA IS Audit and Assurance Standard requires that IS audit conclusions be based on:

Accepted Answer

Sufficient and appropriate audit evidence

Answer

IS audit standards require that conclusions and opinions be supported by sufficient (enough) and appropriate (relevant and reliable) audit evidence.

Question 3

When assessing data integrity controls in a financial application, an IS auditor would MOST likely use which technique?

Accepted Answer

Test data containing valid and invalid records to verify system edits

Answer

Submitting test data with known valid and invalid values verifies that the application correctly accepts, rejects, and processes records per its edit and validation rules.

Question 4

Which of the following BEST describes 'audit risk'?

Accepted Answer

The risk that the auditor expresses an incorrect opinion due to undetected material errors

Answer

Audit risk is the risk that the auditor reaches an incorrect conclusion (e.g., issues a clean opinion when material errors exist) due to failures in detection.

Question 5

An IS auditor finds that developers have access to the production environment. This PRIMARILY violates the principle of:

Accepted Answer

Segregation of duties

Answer

Allowing developers access to production violates segregation of duties because the same person who creates code should not be able to deploy or modify it in production.

(ISACA) Information Systems Audit and Control Association Certification Practice Test

(ISACA) Information Systems Audit and Control Association Certification Practice Test

ISACA Information System Auditing Process 4