Accounting Information Systems, 8e—Test Bank, Chapter 16
Chapter 16—IT Controls Part II: Security and Access
TRUE/FALSE
1. In a computerized environment, the audit trail log must be printed onto paper documents.
2. Disguising message packets to look as if they came from another user and to gain access to the host’s
network is called spooling.
3. A formal log-on procedure is the operating system’s last line of defense against unauthorized
access.
4. Computer viruses usually spread throughout the system before being detected.
5. A worm is software program that replicates itself in areas of idle memory until the system fails.
6. Viruses rarely attach themselves to executable files.
7. Subschemas are used to authorize user access privileges to specific data elements.
8. A recovery module suspends all data processing while the system reconciles its journal files against
the database.
9. The database management system controls access to program files.
10. Operating system controls are of interest to system professionals but should not concern accountants
and auditors.
11. The most frequent victims of program viruses are microcomputers.
Accounting Information Systems, 8e—Test Bank, Chapter 16
12. Access controls protect databases against destruction, loss or misuse through unauthorized access.
13. Operating system integrity is not of concern to accountants because only hardware risks are involved.
14. Audit trails in computerized systems are comprised of two types of audit logs: detailed logs of
individual keystrokes and event-oriented logs.
15. In a telecommunications environment, line errors can be detected by using an echo check.
16. Firewalls are special materials used to insulate computer facilities
17. The message authentication code is calculated by the sender and the receiver of a data transmission.
18. The request-response technique should detect if a data communication transmission has been diverted.
19. Electronic data interchange translation software interfaces with the sending firm and the value added
network.
20. A value added network can detect and reject transactions by unauthorized trading partners.
21. Electronic data interchange customers may be given access to the vendor’s data files.
22. The audit trail for electronic data interchange transactions is stored on magnetic media.
23. A firewall is a hardware partition designed to protect networks from power surges.
24. To preserve audit trails in a computerized environment, transaction logs are permanent records of
transactions.
25. Examining programmer authority tables for information about who has access to Data Definition
Language commands will provide evidence about who is responsible for creating subschemas.
MULTIPLE CHOICE
1. The operating system performs all of the following tasks except
a.
translates third-generation languages into machine language
b.
assigns memory to applications
c.
authorizes user access
d.
schedules job processing
2. Which of the following is considered an unintentional threat to the integrity of the operating system?
a.
a hacker gaining access to the system because of a security flaw
b.
a hardware flaw that causes the system to crash
c.
a virus that formats the hard drive
d.
the systems programmer accessing individual user files
3. A software program that replicates itself in areas of idle memory until the system fails is called a
a.
Trojan horse
b.
worm
c.
logic bomb
d.
none of the above
4. A software program that allows access to a system without going through the normal logon procedures
is called a
a.
logic bomb
b.
Trojan horse
c.
worm
d.
back door
5. All of the following will reduce the exposure to computer viruses except
a.
install antivirus software
b.
install factory-sealed application software
c.
assign and control user passwords
d.
install public-domain software from reputable bulletin boards
6. Which backup technique is most appropriate for sequential batch systems?
a.
grandparent-parent-child approach
b.
staggered backup approach
c.
direct backup
d.
remote site, intermittent backup
7. When creating and controlling backups for a sequential batch system,
a.
the number of backup versions retained depends on the amount of data in the file
b.
off-site backups are not required
c.
backup files can never be used for scratch files
d.
the more significant the data, the greater the number of backup versions
8. Hackers can disguise their message packets to look as if they came from an authorized user and gain
access to the host’s network using a technique called
a.
spoofing.
b.
spooling.
c.
dual-homed.
d.
screening.
9. In a direct access file system
a.
backups are created using the grandfather-father-son approach
b.
processing a transaction file against a maser file creates a backup file
c.
files are backed up immediately before an update run
d.
if the master file is destroyed, it cannot be reconstructed
10. Which of the following is not an access control in a database system?
a.
antivirus software
b.
database authorization table
c.
passwords
d.
voice prints
11. Which is not a biometric device?
a.
password
b.
retina prints
c.
voice prints
d.
signature characteristics
12. Which of the following is not a basic database backup and recovery feature?
a.
checkpoint
b.
backup database
c.
transaction log
Accounting Information Systems, 8e—Test Bank, Chapter 16
d.
database authority table
13. All of the following are objectives of operating system control except
a.
protecting the OS from users
b.
protesting users from each other
c.
protecting users from themselves
d.
protecting the environment from users
14. Passwords are secret codes that users enter to gain access to systems. Security can be compromised by
all of the following except
a.
failure to change passwords on a regular basis
b.
using obscure passwords unknown to others
c.
recording passwords in obvious places
d.
selecting passwords that can be easily detected by computer criminals
15. Audit trails cannot be used to
a.
detect unauthorized access to systems
b.
facilitate reconstruction of events
c.
reduce the need for other forms of security
d.
promote personal accountability
16. Which control will not reduce the likelihood of data loss due to a line error?
a.
echo check
b.
encryption
c.
vertical parity bit
d.
horizontal parity bit
17. Which method will render useless data captured by unauthorized receivers?
a.
echo check
b.
parity bit
c.
public key encryption
d.
message sequencing
18. Which method is most likely to detect unauthorized access to the system?
a.
message transaction log
b.
data encryption standard
c.
vertical parity check
d.
request-response technique
19. All of the following techniques are used to validate electronic data interchange transactions except
Accounting Information Systems, 8e—Test Bank, Chapter 16
a.
value added networks can compare passwords to a valid customer file before message
transmission
b.
prior to converting the message, the translation software of the receiving company can
compare the password against a validation file in the firm’s database
c.
the recipient’s application software can validate the password prior to processing
d.
the recipient’s application software can validate the password after the transaction has been
processed
20. In an electronic data interchange environment, customers routinely access
a.
the vendor’s price list file
b.
the vendor’s accounts payable file
c.
the vendor’s open purchase order file
d.
none of the above
21. All of the following tests of controls will provide evidence that adequate computer virus control
techniques are in place and functioning except
a.
verifying that only authorized software is used on company computers
b.
reviewing system maintenance records
c.
confirming that antivirus software is in use
d.
examining the password policy including a review of the authority table
22. Audit objectives for the database management system include all of the following except
a.
verifying that the security group monitors and reports on fault tolerance violations
b.
confirming that backup procedures are adequate
c.
ensuring that authorized users access only those files they need to perform their duties
d.
verifying that unauthorized users cannot access data files
23. All of the following tests of controls will provide evidence that access to the data files is limited except
a.
inspecting biometric controls
b.
reconciling program version numbers
c.
comparing job descriptions with access privileges stored in the authority table
d.
attempting to retrieve unauthorized data via inference queries
24. Audit objectives for communications controls include all of the following except
a.
detection and correction of message loss due to equipment failure
b.
prevention and detection of illegal access to communication channels
c.
procedures that render intercepted messages useless
d.
all of the above
25. When auditors examine and test the call-back feature, they are testing which audit objective?
a.
incompatible functions have been segregated
b.
application programs are protected from unauthorized access
Accounting Information Systems, 8e—Test Bank, Chapter 16
c.
physical security measures are adequate to protect the organization from natural disaster
d.
illegal access to the system is prevented and detected
26. In an electronic data interchange (EDI) environment, when the auditor compares the terms of the
trading partner agreement against the access privileges stated in the database authority table, the
auditor is testing which audit objective?
a.
all EDI transactions are authorized
b.
unauthorized trading partners cannot gain access to database records
c.
authorized trading partners have access only to approved data
d.
a complete audit trail is maintained
27. Audit objectives in the electronic data interchange (EDI) environment include all of the following
except
a.
all EDI transactions are authorized
b.
unauthorized trading partners cannot gain access to database records
c.
a complete audit trail of EDI transactions is maintained
d.
backup procedures are in place and functioning properly
28. In determining whether a system is adequately protected from attacks by computer viruses, all of the
following policies are relevant except
a.
the policy on the purchase of software only from reputable vendors
b.
the policy that all software upgrades are checked for viruses before they are implemented
c.
the policy that current versions of antivirus software should be available to all users
d.
the policy that permits users to take files home to work on them
29. Which of the following is not a test of access controls?
a.
biometric controls
b.
encryption controls
c.
backup controls
d.
inference controls
30. In an electronic data interchange environment, customers routinely
a.
access the vendor’s accounts receivable file with read/write authority
b.
access the vendor’s price list file with read/write authority
c.
access the vendor’s inventory file with read-only authority
d.
access the vendor’s open purchase order file with read-only authority
31. In an electronic data interchange environment, the audit trail
a.
is a printout of all incoming and outgoing transactions
b.
is an electronic log of all transactions received, translated, and processed by the system
c.
is a computer resource authority table
d.
consists of pointers and indexes within the database
Accounting Information Systems, 8e—Test Bank, Chapter 16
32. All of the following are designed to control exposures from subversive threats except
a.
firewalls
b.
one-time passwords
c.
field interrogation
d.
data encryption
33. Many techniques exist to reduce the likelihood and effects of data communication hardware failure.
One of these is
a.
hardware access procedures
b.
antivirus software
c.
parity checks
d.
data encryption
34. Which of the following deal with transaction legitimacy?
a.
transaction authorization and validation
b.
access controls
c.
EDI audit trail
d.
all of the above
35. Firewalls are
a.
special materials used to insulate computer facilities
b.
a system that enforces access control between two networks
c.
special software used to screen Internet access
d.
none of the above
36. The database attributes that individual users have permission to access are defined in
a.
operating system.
b.
user manual.
c.
database schema.
d.
user view.
e.
application listing.
37. An integrated group of programs that supports the applications and facilitates their access to specified
resources is called a (an)
a.
operating system.
b.
database management system.
c.
utility system
d.
facility system.
e.
object system.
38. Transmitting numerous SYN packets to a targeted receiver, but NOT responding to an ACK, is
a.
a smurf attack.
b.
IP Spoofing.
c.
an ACK echo attack
d.
a ping attack.
e.
none of the above
39. Which of the following is true?
a.
Deep Packet Inspection uses a variety of analytical and statistical techniques to evaluate
the contents of message packets.
b.
An Intrusion prevention system works in parallel with a firewall at the perimeter of the
network to act as a filer that removes malicious packets from the flow before they can
affect servers and networks.
c.
A distributed denial of service attack is so named because it is capable of attacking many
victims simultaneously who are distributed across the internet.
d.
None of the above are true statements.
40. Advance encryption standard (AES) is
a.
a 64 -bit private key encryption technique
b.
a 128-bit private key encryption technique
c.
a 128-bit public key encryption technique
d.
a 256-bit public encryption technique that has become a U.S. government standard
SHORT ANSWER
1. Briefly define an operating system.
2. What is a virus?
3. Describe one benefit of using a call-back device.
4. Contrast the Private Encryption Standard approach with the Public Key Encryption approach to
controlling access to telecommunication messages.
5. List three methods of controlling unauthorized access to telecommunication messages.
6. Describe two ways that passwords are used to authorize and validate messages in the electronic data
interchange environment.
7. Explain how transactions are audited in an electronic data interchange environment.
8. What are some typical problems with passwords?
9. Discuss the key features of the one-time password technique:
10. Describe two tests of controls that would provide evidence that the database management system is
protected against unauthorized access attempts.
11. What is event monitoring?
12. What are the auditor’s concerns in testing EDI controls?
13. What is a database authorization table?
14. What is a user-defined procedure?
15. What are biometric devices?
16. What can be done to defeat a DDoS Attack?
17. What is deep packet inspection?
18. Explain how smurf attacks can be controlled.
19. Explain how SYN Flood attacks can be controlled.
20. What problem is common to all private key encryption techniques?
1. What are the three security objectives of audit trails? Explain.
2. What is an operating system? What does it do? What are operating system control objectives?
3. Discuss three sources of exposure (threats) to the operating system.
4. Discuss three techniques for breaching operating system controls.
5. A formal log-on procedure is the operating system’s first line of defense. Explain how this works.
6. Explain the concept of discretionary access privileges.
7. One purpose of a database system is the easy sharing of data. But this ease of sharing can also
jeopardize security. Discuss at least three forms of access control designed to reduce this risk.
8. Explain how the one-time password approach works.
9. Network communication poses some special types of risk for a business. What are the two broad areas
of concern? Explain.
10. What is EDI? How does its use affect the audit trail?
11. Describe three ways in which IPS can be used to protect against DDoS Attacks?