1.

The MOST likely explanation for the use of applets in an Internet application is
that:
A. it is sent over the network from the server.
B. the server does not run the program and the output is not sent over the
network.
C. they improve the performance of the web server and network.
D. it is a JAVA program downloaded through the web browser and executed by
the web server of the client machine
The correct answer is C.
An applet is a JAVA program that is sent over the network from the web server,
through a web browser and to the client machine; the code is then run on the
machine. Since the server does not run the program and the output is not sent over
the network, the performance on the web server and networkover which the
server and client are connecteddrastically improves through the use of applets.
Performance improvement is more important than the reasons offered in choices A
and B. Since JAVA virtual machine (JVM) is embedded in most web browsers, the
applet download through the web browser runs on the client machine from the web
browser, not from the web server, making choice D incorrect.
2. During the system testing phase of an application development project the IS
auditor should review the:
A. conceptual design specifications.
B. vendor contract.
C. error reports.
D. program change requests.
The correct answer is C.
Testing is crucial in determining that user requirements have been validated. The IS
auditor should be involved in this phase and review error reports for their precision
in recognizing erroneous data and review the procedures for resolving errors. A
conceptual design specification is a document prepared during the requirements
definition phase. A vendor contract is prepared during a software acquisition
process. Program change requests would normally be reviewed as a part of the
postimplementation phase.
3. Ideally, stress testing should be carried out in a:
A. test environment using test data.
B. production environment using live workloads.
C. test environment using live workloads.
D. production environment using test data.
The correct answer is C.
Stress testing is carried out to ensure a system can cope with production workloads.
A test environment should always be used to avoid damaging the production
environment. Hence, testing should never take place in a production environment

(choices B and D), and if only test data is used, there is no certainty that the system
was stress tested adequately.
4. An advantage in using a bottom-up vs. a top-down approach to software testing
is that:
A. interface errors are detected earlier.
B. confidence in the system is achieved earlier.
C. errors in critical modules are detected earlier.
D. major functions and processing are tested earlier.
The correct answer is C.
The bottom-up approach to software testing begins with the testing of atomic units,
such as programs and modules, and works upward until a complete system testing
has taken place. The advantages of using a bottom-up approach to software testing
are the fact that there is no need for stubs or drivers and errors in critical modules
are found earlier. The other choices in this question all refer to advantages of a topdown approach, which follows the opposite path, either in depth-first or breadth-first
search order.
5. The knowledge base of an expert system that uses questionnaires to lead the
user through a series of choices before a conclusion is reached is known as:
A. rules.
B. decision trees.
C. semantic nets.
D. dataflow diagrams.
The correct answer is B.
Decision trees use questionnaires to lead a user through a series of choices until a
conclusion is reached. Rules refer to the expression of declarative knowledge
through the use of if-then relationships. Semantic nets consist of a graph in which
nodes represent physical or conceptual objects and the arcs describe the
relationship between the nodes. Semantic nets resemble a dataflow diagram and
make use of an inheritance mechanism to prevent duplication of data.
6. An IS auditor's PRIMARY concern when application developers wish to use a copy
of yesterday's production transaction file for volume tests is that:
A. users may prefer to use contrived data for testing.
B. unauthorized access to sensitive data may result.
C. error handling and credibility checks may not be fully proven.
D. the full functionality of the new process may not necessarily be tested.
The correct answer is B.
Unless the data are sanitized, there is a risk of disclosing sensitive data.
7. The IS auditor is reviewing a recently completed conversion to a new enterprise
resource planning (ERP) system. As the final stage of the conversion process, the
organization ran the old and new systems in parallel for 30 days before allowing

the new system to run on its own. What is the MOST significant advantage to the
organization by using this strategy?
A. Significant cost savings over other testing approaches
B. Assurance that new, faster hardware is compatible with the new system
C. Assurance that the new system meets functional requirements
D. Increased resiliency during the parallel processing time
The correct answer is C
Parallel operation is designed to provide assurance that a new system meets its
functional requirements. This is the safest form of system conversion testing
because, if the new system fails, the old system is ready for production use. In
addition, this form of testing allows the application developers and administrators to
simultaneously run operational tasks (batch jobs, backups) on both systems to
ensure that the new system is reliable before unplugging the old system. Although
parallel operation is generally very expensive, it provides a high level of assurance
that the new system functions properly compared to the old system. Parallel
operation is generally expensive and would not provide a cost savings over most
other testing approaches. In many cases, parallel operation is the most expensive
form of system testing due to the need for dual data entry, dual sets of hardware,
dual maintenance, dual backupsit's twice the amount of work as running a
production system and therefore costs more time and money. As a result, option A is
not the correct answer. Hardware compatibility should be determined and tested
much earlier in the conversion project and is not an advantage of parallel operation.
Compatibility is generally determined based on the application's published
specifications and on system testing in a lab environment. Parallel operation is
designed to test the application's effectiveness and integrity of application data, not
hardware compatibility. In general, hardware compatibility relates more to the
operating system level than to a particular application. While new hardware in a
system conversion must be tested under a real production load, this can be done
without parallel systems, so option B is not the correct answer. Increased resiliency
during parallel processing is a legitimate outcome from this scenario, but the
advantage it provides is temporary and minor, so option D is not the correct answer.
8. Which of the following is the most important element in the design of a data
warehouse?
A. Quality of the metadata
B. Speed of the transactions
C. Volatility of the data
D. Vulnerability of the system
The answer is A.
Quality of the metadata is the most important element in the design of a data
warehouse. A data warehouse is a copy of transaction data specifically structured
for query and analysis. Metadata aim to provide a table of contents to the

information stored in the data warehouse. Companies that have built warehouses
believe that metadata are the most important component of the warehouse.
9. An organization has an integrated development environment (IDE) on which the
program libraries reside on the server, but modification/development and testing
are done from PC workstations. Which of the following would be a strength of an
IDE?
A. Controls the proliferation of multiple versions of programs
B. Expands the programming resources and aids available
C. Increases program and processing integrity
D. Prevents valid changes from being overwritten by other changes
The correct answer is B.
A strength of an IDE is that it expands the programming resources and aids
available. The other choices are IDE weaknesses.
10.A manufacturing firm wants to automate its invoice payment system. Objectives
state that the system should require considerably less time for review and
authorization and the system should be capable of identifying errors that require
follow up. Which of the following would BEST meet these objectives?
A. Establishing an inter-networked system of client servers with suppliers for
increased efficiencies
B. Outsourcing the function to a firm specializing in automated payments and
accounts receivable/invoice processing
C. Establishing an EDI system of electronic business documents and
transactions with key suppliers, computer to computer, in a standard format
D. Reengineering the existing processing and redesigning the existing system
The correct answer is C.
EDI is the best answer. Properly implemented (e.g., agreements with trading
partners transaction standards, controls over network security mechanisms in
conjunction with application controls), EDI is best suited to identify and follow up on
errors more quickly, given reduced opportunities for review and authorization.
11.The waterfall life cycle model of software development is most appropriately
used when:
A. requirements are well understood and are expected to remain stable, as is
the business environment in which the system will operate.
B. requirements are well understood and the project is subject to time
pressures.
C. the project intends to apply an object-oriented design and programming
approach.
D. the project will involve the use of new technology.
The answer is A

Historically, the waterfall model has been best suited to the stable conditions
described in choice A. When the degree of uncertainty of the system to be delivered
and the conditions in which it will be used rises, the waterfall model has not been
successful. In these circumstances, the various forms of iterative development life
cycle gives the advantage of breaking down the scope of the overall system to be
delivered, making the requirements gathering and design activities more
manageable. The ability to deliver working software earlier also acts to alleviate
uncertainty and may allow an earlier realization of benefits. The choice of a design
and programming approach is not itself a determining factor of the type of software
development life cycle that is appropriate. The use of new technology in a project
introduces a significant element of risk. An iterative form of development,
particularly one of the agile methods that focuses on early development of actual
working software, is likely to be the better option to manage this uncertainty.
12.An IS auditor is reviewing the software development process for an organization.
Which of the following functions would be appropriate for the end users to
perform?
A. Program output testing
B. System configuration
C. Program logic specification
D. Performance tuning
The answer is A.
A user can test program output by checking the program input and comparing it
with the system output. This task, although usually done by the programmer, can
also be done effectively by the user. System configuration is usually too technical to
be accomplished by a user and this situation could create security issues. Program
logic specification is a very technical task that is normally performed by a
programmer. Performance tuning also requires high levels of technical skill and will
not be effectively accomplished by a user. In addition, choices B, C and D could
introduce a segregation of duties issue.
13.Which testing approach is MOST appropriate to ensure that internal application
interface errors are identified as soon as possible?
A. Bottom up
B. Sociability testing
C. Top-down
D. System test
The correct answer is C.
The top-down approach to testing ensures that interface errors are detected early
and that testing of major functions is conducted early. A bottom-up approach to
testing begins with atomic units, such as programs and modules, and works upward
until a complete system test has taken place. Sociability testing and system tests
take place at a later stage in the development process.

14.Which of the following is a dynamic analysis tool for the purpose of testing
software modules?
A. Black box test
B. Desk checking
C. Structured walkthrough
D. Design and code
The answer is A.
A black box test is a dynamic analysis tool for testing software modules. During the
testing of software modules a black box test works first in a cohesive manner as a
single unit/entity consisting of numerous modules, and second with the user data
that flows across software modules. In some cases, this even drives the software
behavior. In choices B, C and D, the software (design or code) remains static and
someone closely examines it by applying their mind, without actually activating the
software. Therefore, these cannot be referred to as dynamic analysis tools.
15.An IS auditor is reviewing a project that is using an Agile software development
approach. Which of the following should the IS auditor expect to find?
A. Use of a process-based maturity model such as the capability maturity model
(CMM)
B. Regular monitoring of task-level progress against schedule
C. Extensive use of software development tools to maximize team productivity
D. Postiteration reviews that identify lessons learned for future use in the project
The correct answer is D.
A key tenet of the Agile approach to software project management is team learning
and the use of team learning to refine project management and software
development processes as the project progresses. One of the best ways to achieve
this is that, at the end of each iteration, the team considers and documents what
worked well and what could have worked better, and identifies improvements to be
implemented in subsequent iterations. CMM and Agile really sit at opposite poles.
CMM places heavy emphasis on predefined formal processes and formal project
management and software development deliverables. Agile projects, by contrast,
rely on refinement of process as dictated by the particular needs of the project and
team dynamics. Additionally, less importance is placed on formal paper-based
deliverables, with the preference being effective informal communication within the
team and with key outside contributors. Agile projects produce releasable software
in short iterations, typically ranging from 4 to 8 weeks. This, in itself, instills
considerable performance discipline within the team. This, combined with short
daily meetings to agree on what the team is doing and the identification of any
impediments, renders task-level tracking against a schedule redundant. Agile
projects do make use of suitable development tools; however, tools are not seen as
the primary means of achieving productivity. Team harmony, effective
communications and collective ability to solve challenges are of greater importance.

16.When implementing an application software package, which of the following

presents the GREATEST risk?
A. Uncontrolled multiple software versions
B. Source programs that are not synchronized with object code
C. Incorrectly set parameters
D. Programming errors
The correct answer is C.
Parameters that are not set correctly would be the greatest concern when
implementing an application software package. The other choices, though
important, are a concern of the provider, not the organization that is implementing
the software itself.
17.Which of the following is the MOST efficient way to test the design effectiveness
of a partially automated change control process?
A. Test a sample population of changes.
B. Perform an end-to-end walk-through of the process.
C. Test one change that has been authorized.
D. Use a computer-assisted audit test (CAAT).
The correct answer is B.
An end-to-end walk-through is the best way to confirm design effectiveness since it
ensures that controls are adequate to meet the risks associated with change
control. Testing a sample population of changes is a test of operating effectiveness.
Testing one change that has been authorized may not provide sufficient assurance
with respect to the entire process because it would not test the elements of the
process related to authorization. Using a CAAT would not cover the manual aspects
of the process.
18.During the development of an application, the quality assurance testing and user
acceptance testing were combined. The MAJOR concern for an IS auditor
reviewing the project is that there will be:
A. increased maintenance.
B. improper documentation of testing.
C. inadequate functional testing.
D. delays in problem resolution.
The correct answer is C.
The major risk of combining quality assurance testing and user acceptance testing
is that functional testing may be inadequate. Choices A, B and D are not as
important.
19.The MAJOR advantage of a component-based development approach is the:
A. ability to manage an unrestricted variety of data types.
B. provision for modeling complex relationships.
C. capacity to meet the demands of a changing environment.
D. support of multiple development environments.

The correct answer is D.

Components written in one language can interact with components written in other
languages or running on other machines, which can increase the speed of
development. Software developers can then focus on business logic. The other
choices are not the most significant advantages of a component-based
development approach.
20.Which of the following is a management technique that enables organizations to
develop strategically important systems faster, while reducing development
costs and maintaining quality?
A. Function point analysis
B. Critical path methodology
C. Rapid application development
D. Program evaluation review technique
The correct answer is C.
Rapid application development is a management technique that enables
organizations to develop strategically important systems faster, while reducing
development costs and maintaining quality. The program evaluation review
technique (PERT) and critical path methodology (CPM) are both planning and control
techniques, while function point analysis is used for estimating the complexity of
developing business applications.
21.During the audit of an acquired software package, an IS auditor finds that the
software purchase was based on information obtained through the Internet,
rather than from responses to a request for proposal (RFP). The IS auditor should
FIRST:
A. test the software for compatibility with existing hardware.
B. perform a gap analysis.
C. review the licensing policy.
D. ensure that the procedure had been approved.
The correct answer is D.
In the case of a deviation from the predefined procedures, an IS auditor should first
ensure that the procedure followed for acquiring the software is consistent with the
business objectives and has been approved by the appropriate authorities. The
other choices are not the first actions an IS auditor should take. They are steps that
may or may not be taken after determining that the procedure used to acquire the
software had been approved.
22.An IS auditor is told by IS management that the organization has recently
reached the highest level of the software capability maturity model (CMM). The
software quality process MOST recently added by the organization is:
A. continuous improvement.
B. quantitative quality goals.
C. a documented process.

D. a process tailored to specific projects.

The answer is A.
An organization would have reached the highest level of the software CMM at level
5, optimizing. Quantitative quality goals can be reached at level 4 and below, a
documented process is executed at level 3 and below, and a process tailored to
specific projects can be achieved at level 3 or below.
23.A company has contracted with an external consulting firm to implement a
commercial financial system to replace its existing system developed in-house.
In reviewing the proposed development approach, which of the following would
be of GREATEST concern?
A. Acceptance testing is to be managed by users.
B. A quality plan is not part of the contracted deliverables.
C. Not all business functions will be available on initial implementation.
D. Prototyping is being used to confirm that the system meets business
requirements
The correct answer is B.
A quality plan is an essential element of all projects. It is critical that the contracted
supplier be required to produce such a plan. The quality plan for the proposed
development contract should be comprehensive and encompass all phases of the
development and include which business functions will be included and when.
Acceptance is normally managed by the user area, since they must be satisfied that
the new system will meet their requirements. If the system is large, a phased-in
approach to implementing the application is a reasonable approach. Prototyping is a
valid method of ensuring that the system will meet business requirements.
24.During which of the following phases in system development would user
acceptance test plans normally be prepared?
A. Feasibility study
B. Requirements definition
C. Implementation planning
D. Postimplementation review
The correct answer is B.
During requirements definition, the project team will be working with the users to
define their precise objectives and functional needs. At this time, the users should
be working with the team to consider and document how the system functionality
can be tested to ensure it meets their stated needs. The feasibility study is too early
for such detailed user involvement, and the implementation planning and
postimplementation review phases are too late. An IS auditor should know at what
point user testing should be planned to ensure it is most effective and efficient.
25.Which of the following should be included in a feasibility study for a project to
implement an EDI process?

A.
B.
C.
D.

The
The
The
The

encryption algorithm format

detailed internal control procedures
necessary communication protocols
proposed trusted third-party agreement

The correct answer is C.

Encryption algorithms, third-party agreements and internal control procedures are
too detailed for this phase. They would only be outlined and any cost or
performance implications shown. The communications protocols must be included,
as there may be significant cost implications if new hardware and software are
involved, and risk implications if the technology is new to the organization.
26.An
A.
B.
C.
D.

advantage of using sanitized live transactions in test data is that:

all transaction types will be included.
every error condition is likely to be tested.
no special routines are required to assess the results.
test transactions are representative of live processing.

The correct answer is D.

Test data will be representative of live processing; however, it is unlikely that all
transaction types or error conditions will be tested in this way.
27.Following best practices, formal plans for implementation of new information
systems are developed during the:
A. development phase.
B. design phase.
C. testing phase.
D. deployment phase.
The correct answer is B.
Planning for implementation should begin well in advance of the actual
implementation date. A formal implementation plan should be constructed in the
design phase and revised as the development progresses.
28.The specific advantage of white box testing is that it:
A. verifies a program can operate successfully with other parts of the system.
B. ensures a program's functional operating effectiveness without regard to the
internal program structure.
C. determines procedural accuracy or conditions of a program's specific logic
paths.
D. examines a program's functionality by executing it in a tightly controlled or
virtual environment with restricted access to the host system.
The correct answer is C.
White box testing assesses the effectiveness of software program logic. Specifically,
test data are used in determining procedural accuracy or conditions of a program's
logic paths. Verifying the program can operate successfully with other parts of the

system is sociability testing. Testing the program's functionality without knowledge

of internal structures is black box testing. Controlled testing of programs in a semidebugged environment, either heavily controlled step-by-step or via monitoring in
virtual machines, is sand box testing
29.During the review of a web-based software development project, an IS auditor
realizes that coding standards are not enforced and code reviews are rarely
carried out. This will MOST likely increase the likelihood of a successful:
A. buffer overflow.
B. brute force attack.
C. distributed denial-of-service attack.
D. war dialing attack.
The answer is A.
Poorly written code, especially in web-based applications, is often exploited by
hackers using buffer overflow techniques. A brute force attack is used to crack
passwords. A distributed denial-of-service attack floods its target with numerous
packets, to prevent it from responding to legitimate requests. War dialing uses
modem-scanning tools to hack PBXs.
30.An organization has contracted with a vendor for a turnkey solution for their
electronic toll collection system (ETCS). The vendor has provided its proprietary
application software as part of the solution. The contract should require that:
A. a backup server be available to run ETCS operations with up-to-date data.
B. a backup server be loaded with all the relevant software and data.
C. the systems staff of the organization be trained to handle any event.
D. source code of the ETCS application be placed in escrow.
The correct answer is D.
Whenever proprietary application software is purchased, the contract should
provide for a source code agreement. This will ensure that the purchasing company
will have the opportunity to modify the software should the vendor cease to be in
business. Having a backup server with current data and staff training is critical but
not as critical as ensuring the availability of the source code.
31.An IS auditor finds that user acceptance testing of a new system is being
repeatedly interrupted as defect fixes are implemented by developers. Which of
the following would be the BEST recommendation for an IS auditor to make?
A. Consider feasibility of a separate user acceptance environment
B. Schedule user testing to occur at a given time each day
C. Implement a source code version control tool
D. Only retest high priority defects
The answer is A
A separate environment or environments is normally necessary for testing to be
efficient and effective, and to ensure the integrity of production code. It is important

that the development and testing code base be separate. When defects are
identified they can be fixed in the development environment, without interrupting
testing, before being migrated in a controlled manner to the test environment. A
separate test environment can also be used as the final staging area from which
code is migrated to production. This enforces a separation between development
and production code. The logistics of setting up and refreshing customized test data
is easier if a separate environment is maintained. If developers and testers are
sharing the same environment, they have to work effectively at separate times of
the day. It is unlikely that this would provide optimum productivity. Use of a source
code control tool is a good practice, but it does not properly mitigate the lack of an
appropriate testing environment. Even low priority fixes run the risk of introducing
unintended results when combined with the rest of the system code. To prevent this,
regular regression testing covering all code changes should occur. A separate test
environment makes the logistics of regression testing easier to manage.
32.Which of the following is an advantage of the top-down approach to software
testing?
A. Interface errors are identified early
B. Testing can be started before all programs are complete
C. It is more effective than other testing approaches
D. Errors in critical modules are detected sooner
The answer is A.
The advantage of the top-down approach is that tests of major functions are
conducted early, thus enabling the detection of interface errors sooner. The most
effective testing approach is dependent on the environment being tested. Choices B
and D are advantages of the bottom-up approach to system testing.
33.Which of the following systems or tools can recognize that a credit card
transaction is more likely to have resulted from a stolen credit card than from the
holder of the credit card?
A. Intrusion detection systems
B. Data mining techniques
C. Firewalls
D. Packet filtering routers
The correct answer is B.
Data mining is a technique used to detect trends or patterns of transactions or data.
If the historical pattern of charges against a credit card account is changed, then it
is a flag that the transaction may have resulted from a fraudulent use of the card.
34.The phases and deliverables of a system development life cycle (SDLC) project
should be determined:
A. during the initial planning stages of the project.
B. after early planning has been completed, but before work has begun.
C. throughout the work stages, based on risks and exposures.

D. only after all risks and exposures have been identified and the IS auditor has
recommended appropriate controls.
The answer is A.
It is extremely important that the project be planned properly and that the specific
phases and deliverables be identified during the early stages of the project.
35.Which of the following is a prevalent risk in the development of end-user
computing (EUC) applications?
A. Applications may not be subject to testing and IT general controls
B. Increased development and maintenance costs
C. Increased application development time
D. Decision-making may be impaired due to diminished responsiveness to
requests for information
The answer is A.
End-user developed applications may not be subjected to an independent outside
review by systems analysts and frequently are not created in the context of a formal
development methodology. These applications may lack appropriate standards,
controls, quality assurance procedures, and documentation. A risk of end-user
applications is that management may rely on them as much as traditional
applications. End-user computing (EUC) systems typically result in reduced
application development and maintenance costs, and a reduced development cycle
time. EUC systems normally increase flexibility and responsiveness to
management's information requests.
36.An IS auditor reviewing a proposed application software acquisition should
ensure that the:
A. operating system (OS) being used is compatible with the existing hardware
platform.
B. planned OS updates have been scheduled to minimize negative impacts on
company needs.
C. OS has the latest versions and updates.
D. products are compatible with the current or planned OS.
The correct answer is D.
Choices A, B and C are incorrect because none of them are related to the area being
audited. In reviewing the proposed application the auditor should ensure that the
products to be purchased are compatible with the current or planned OS. Regarding
choice A, if the OS is currently being used, it is compatible with the existing
hardware platform, because if it is not it would not operate properly. In choice B, the
planned OS updates should be scheduled to minimize negative impacts on the
organization. For choice C, the installed OS should be equipped with the most recent
versions and updates (with sufficient history and stability).

37.An IS auditor is reviewing system development for a healthcare organization with

two application environmentsproduction and test. During an interview, the
auditor notes that production data are used in the test environment to test
program changes. What is the MOST significant potential risk from this situation?
A. The test environment may not have adequate controls to ensure data
accuracy.
B. The test environment may produce inaccurate results due to use of
production data.
C. Hardware in the test environment may not be identical to the production
environment.
D. The test environment may not have adequate access controls implemented
to ensure data confidentiality.
The correct answer is D.
In many cases, the test environment is not configured with the same access
controls that are enabled in the production environment. For example, programmers
may have privileged access to the test environment (for testing), but not to the
production environment. If the test environment does not have adequate access
control, the production data are subject to risk of unauthorized access and/or data
disclosure. This is the most significant risk of the choices listed. The accuracy of
data used in the test environment is not of significant concern as long as these data
are representative of the production environment. Using production data in the test
environment would not cause test results to be inaccurate. If anything, using
production data would improve the accuracy of testing processes since the data
would most closely mirror the production environment. In spite of that fact, the risk
of data disclosure or unauthorized access in the test environment is still significant
and, as a result, production data should not be used in the test environment. This is
especially important in a healthcare organization where patient data confidentiality
is critical and privacy laws in many countries impose strict penalties on misuse of
these data. Hardware in the test environment should mirror the production
environment in order to ensure that testing is reliable. However, this does not relate
to the risks from using live data in a production environment. Choice C is not the
correct answer because it does not relate to the risk presented in the scenario.
38.The GREATEST benefit in implementing an expert system is the:
A. capturing of the knowledge and experience of individuals in an organization.
B. sharing of knowledge in a central repository.
C. enhancement of personnel productivity and performance.
D. reduction of employee turnover in key departments.
The answer is A.
The basis for an expert system is the capture and recording of the knowledge and
experience of individuals in an organization. Coding and entering the knowledge in
a central repository, shareable within the enterprise, is a means of facilitating the
expert system. Enhancing personnel productivity and performance is a benefit;

however, it is not as important as capturing the knowledge and experience.

Employee turnover is not necessarily affected by an expert system.
39.By evaluating application development projects against the capability maturity
model (CMM), an IS auditor should be able to verify that:
A. reliable products are guaranteed.
B. programmers' efficiency is improved.
C. security requirements are designed
D. predictable software processes are followed.
The correct answer is D.
By evaluating the organization's development projects against the CMM, an IS
auditor determines whether the development organization follows a stable,
predictable software process. Although the likelihood of success should increase as
the software processes mature toward the optimizing level, mature processes do
not guarantee a reliable product. CMM does not evaluate technical processes such
as programming nor does it evaluate security requirements or other application
controls.
40.During which phase of software application testing should an organization
perform the testing of architectural design?
A. Acceptance testing
B. System testing
C. Integration testing
D. Unit testing
The correct answer is C.
Integration testing evaluates the connection of two or more components that pass
information from one area to another. The objective is to utilize unit-tested modules,
thus building an integrated structure according to the design. Acceptance testing
determines whether the solution meets the requirements of the business and is
performed after system staff have completed the initial system test. This testing
includes both quality assurance testing (QAT) and user acceptance testing (UAT),
although not combined. System testing relates a series of tests by the test team or
system maintenance staff to ensure that the modified program interacts correctly
with other components. System testing references the functional requirements of
the system. Unit testing references the detailed design of the system and uses a set
of cases that focus on the control structure of the procedural design to ensure that
the internal operation of the program performs according to specification.
41.The use of object-oriented design and development techniques would MOST
likely:
A. facilitate the ability to reuse modules.
B. improve system performance.
C. enhance control effectiveness.
D. speed up the system development life cycle.

The answer is A.
One of the major benefits of object-oriented design and development is the ability
to reuse modules. The other options do not normally benefit from the objectoriented technique
42.During the requirements definition phase of a software development project, the
aspects of software testing that should be addressed are developing:
A. test data covering critical applications.
B. detailed test plans.
C. quality assurance test specifications.
D. user acceptance testing specifications.
The correct answer is D.
A key objective in any software development project is to ensure that the developed
software will meet the business objectives and the requirements of the user. The
users should be involved in the requirements definition phase of a development
project and user acceptance test specification should be developed during this
phase. The other choices are generally performed during the system testing phase.
43.Which of the following is an object-oriented technology characteristic that
permits an enhanced degree of security over data?
A. Inheritance
B. Dynamic warehousing
C. Encapsulation
D. Polymorphism
The correct answer is C.
Encapsulation is a property of objects, and it prevents accessing either properties or
methods that have not been previously defined as public. This means that any
implementation of the behavior of an object is not accessible. An object defines a
communication interface with the exterior and only that which belongs to that
interface can be accessed.
44.The GREATEST advantage of rapid application development (RAD) over the
traditional system development life cycle (SDLC) is that it:
A. facilitates user involvement.
B. allows early testing of technical features.
C. facilitates conversion to the new system.
D. shortens the development time frame.
The correct answer is D.
The greatest advantage of RAD is the shorter time frame for the development of a
system. Choices A and B are true, but they are also true for the traditional systems
development life cycle. Choice C is not necessarily always true.
45.When a new system is to be implemented within a short time frame, it is MOST
important to:

A.
B.
C.
D.

finish writing user manuals.

perform user acceptance testing.
add last-minute enhancements to functionalities.
ensure that the code has been documented and reviewed.

The correct answer is B.

It would be most important to complete the user acceptance testing to ensure that
the system to be implemented is working correctly. The completion of the user
manuals is similar to the performance of code reviews. If time is tight, the last thing
one would want to do is add another enhancement, as it would be necessary to
freeze the code and complete the testing, then make any other changes as future
enhancements. It would be appropriate to have the code documented and
reviewed, but unless the acceptance testing is completed, there is no guarantee
that the system will work correctly and meet user requirements.
46.What kind of software application testing is considered the final stage of testing
and typically includes users outside the development team?
A. Alpha testing
B. White box testing
C. Regression testing
D. Beta testing
The correct answer is D.
Beta testing is the final stage of testing and typically includes users outside the
development area. Beta testing is a form of user acceptance testing (UAT), and
generally involves a limited number of users who are external to the development
effort. Alpha testing is the testing stage just before beta testing. Alpha testing is
typically performed by programmers and business analysts, instead of users. Alpha
testing is used to identify bugs or glitches that can be fixed before beta testing
begins with external users. White box testing is performed much earlier in the
software development life cycle than alpha or beta testing. White box testing is
used to assess the effectiveness of software program logic, where test data are
used to determine procedural accuracy of the programs being tested. In other
words, does the program operate the way it's supposed to, at a functional level?
White box testing does not typically involve external users. Regression testing is the
process of re-running a portion of a test scenario to ensure that changes or
corrections have not introduced more errors. In other words, the same tests are run
after multiple successive program changes to ensure that the fix for one problem
did not break another part of the program. Regression testing is not the last stage
of testing and does not typically involve external users.
47.Functionality is a characteristic associated with evaluating the quality of software
products throughout their life cycle, and is BEST described as the set of
attributes that bear on the:
A. existence of a set of functions and their specified properties.
B. ability of the software to be transferred from one environment to another.

C. capability of software to maintain its level of performance under stated

conditions.
D. relationship between the performance of the software and the amount of
resources used.
The answer is A.
Functionality is the set of attributes that bears on the existence of a set of functions
and their specified properties. The functions are those that satisfy stated or implied
needs. Choice B refers to portability, choice C refers to reliability and choice D refers
to efficiency.
48.Normally, it would be essential to involve which of the following stakeholders in
the initiation stage of a project?
A. System owners
B. System users
C. System designers
D. System builders
The answer is A.
System owners are the information systems (project) sponsors or chief advocates.
They normally are responsible for initiating and funding projects to develop, operate
and maintain information systems. System users are the individuals who use or are
affected by the information system. Their requirements are crucial in the testing
stage of a project. System designers translate business requirements and
constraints into technical solutions. System builders construct the system based on
the specifications from the systems designers. In most cases, the designers and
builders are one and the same.
49.An IS auditor is evaluating a virtual machinebased (VM-based) architecture
used for all programming and testing environments. The production
architecture is a three-tier physical architecture. What is the MOST important IT
control to test in order to ensure availability and confidentiality of the web
application in production?
A. Server configuration hardening
B. Allocated physical resources are available.
C. System administrators are trained to use the VM architecture.
D. The VM server is included in the disaster recovery plan (DRP).
The answer is A.
The most important control to test in this configuration is the server configuration
hardening. It is important to patch known vulnerabilities and to disable all nonrequired functions before production, especially when production architecture is
different from development and testing architecture. Virtual machines (VMs) are
often used for optimizing programming and testing infrastructure. In this scenario,
the development environment (VM architecture) is different from the production
infrastructure (physical three-tier). Choice B is not correct because appropriate

resource allocation does not guarantee confidentiality of data. Choices C and D are
not related to the web application in production.
50.From a risk management point of view, the BEST approach when implementing
a large and complex IT infrastructure is:
A. a big bang deployment after proof of concept.
B. prototyping and a one-phase deployment.
C. a deployment plan based on sequenced phases.
D. to simulate the new infrastructure before deployment.
The correct answer is C.
When developing a large and complex IT infrastructure, the best practice is to use a
phased approach to fitting the entire system together. This will provide greater
assurance of quality results. The other choices are riskier approaches
51.Which of the following types of testing would determine whether a new or
modified system can operate in its target environment without adversely
impacting other existing systems?
A. Parallel testing
B. Pilot testing
C. Interface/integration testing
D. Sociability testing
The correct answer is D.
The purpose of sociability testing is to confirm that a new or modified system can
operate in its target environment without adversely impacting existing systems.
This should cover the platform that will perform primary application processing and
interfaces with other systems, as well as changes to the desktop in a client-server
or web development. Parallel testing is the process of feeding data into two systems
the modified system and an alternate systemand comparing the results. In this
approach, the old and new systems operate concurrently for a period of time and
perform the same processing functions. Pilot testing takes place first at one location
and is then extended to other locations. The purpose is to see if the new system
operates satisfactorily in one place before implementing it at other locations.
Interface/integration testing is a hardware or software test that evaluates the
connection of two or more components that pass information from one area to
another. The objective is to take unit-tested modules and build an integrated
structure.
52.Which of the following would impair the independence of a quality assurance
team?
A. Ensuring compliance with development methods
B. Checking the testing assumptions
C. Correcting coding errors during the testing process
D. Checking the code to ensure proper documentation

The correct answer is C.

Correction of code should not be a responsibility of the quality assurance team as it
would not ensure segregation of duties and would impair the team's independence.
The other choices are valid quality assurance functions.
53.The reason a certification and accreditation process is performed on critical
systems is to ensure that:
A. security compliance has been technically evaluated.
B. data have been encrypted and are ready to be stored.
C. the systems have been tested to run on different platforms.
D. the systems have followed the phases of a waterfall model.
The answer is A.
Certified and accredited systems are systems that have had their security
compliance technically evaluated for running on a specific production server. Choice
B is incorrect because not all data of certified systems are encrypted. Choice C is
incorrect because certified systems are evaluated to run in a specific environment.
A waterfall model is a software development methodology and not a reason for
performing a certification and accrediting process.
54.At the end of the testing phase of software development, an IS auditor
observes that an intermittent software error has not been corrected. No action
has been taken to resolve the error. The IS auditor should:
A. report the error as a finding and leave further exploration to the auditee's
discretion.
B. attempt to resolve the error.
C. recommend that problem resolution be escalated.
D. ignore the error, as it is not possible to get objective evidence for the
software error.
The correct answer is C.
When an IS auditor observes such conditions, it is best to fully apprise the auditee
and suggest that further problem resolutions be attempted. Recording it as a minor
error and leaving it to the auditee's discretion would be inappropriate, and
neglecting the error would indicate that the auditor has not taken steps to further
probe the issue to its logical end.
55.An organization is replacing a payroll program that it developed in-house, with
the relevant subsystem of a commercial enterprise resource planning (ERP)
system. Which of the following would represent the HIGHEST potential risk?
A. Undocumented approval of some project changes
B. Faulty migration of historical data from the old system to the new system
C. Incomplete testing of the standard functionality of the ERP subsystem
D. Duplication of existing payroll permissions on the new ERP subsystem
The correct answer is B.

The most significant risk after a payroll system conversion is not being able to pay
employees in a timely and accurate manner. As a result, maintaining data integrity
and accuracy during migration is paramount. The other options are not as important
as long as the new payroll system functions as intended.
56.Which of the following is an implementation risk within the process of decision
support systems?
A. Management control
B. Semistructured dimensions
C. Inability to specify purpose and usage patterns
D. Changes in decision processes
The correct answer is C.
The inability to specify purpose and usage patterns is a risk that developers need to
anticipate while implementing a decision support system (DSS). Choices A, B and D
are not risks, but characteristics of a DSS.
57.Which of the following system and data conversion strategies provides the
GREATEST redundancy?
A. Direct cutover
B. Pilot study
C. Phased approach
D. Parallel run
The correct answer is D.
Parallel runs are the safestthough the most expensiveapproach, because both
the old and new systems are run, thus incurring what might appear to be double
costs. Direct cutover is actually quite risky, since it does not provide for a shake
down period nor does it provide an easy fallback option. Both a pilot study and a
phased approach are performed incrementally, making rollback procedures difficult
to execute.
58.An organization is migrating from a legacy system to an enterprise resource
planning (ERP) system. While reviewing the data migration activity, the MOST
important concern for the IS auditor is to determine that there is a:
A.
correlation of semantic characteristics of the data migrated between the two
systems.
B.
correlation of arithmetic characteristics of the data migrated between the two
systems.
C.
correlation of functional characteristics of the processes between the two
systems.
D.
relative efficiency of the processes between the two systems.
The answer is A.

Due to the fact that the two systems could have a different data representation,
including the database schema, the IS auditor's main concern should be to verify
that the interpretation of the data is the same in the new as it was in the old
system. Arithmetic characteristics represent aspects of data structure and internal
definition in the database, and therefore are less important than the semantic
characteristics. A review of the correlation of the functional characteristics or a
review of the relative efficiencies of the processes between the two systems is not
relevant to a data migration review.
59.During a postimplementation review, which of the following activities should be
performed?
A. User acceptance testing (UAT)
B. Return on investment (ROI) analysis
C. Activation of audit trails
D. Updates of the future state of enterprise architecture (EA) diagrams
The correct answer is B.
Following implementation, a cost-benefit analysis or ROI should be re-performed to
verify that the original business case benefits are delivered. UAT should be
performed during the development phase, not after the implementation. The audit
trail should be activated as soon as the application is implemented. While updating
the EA diagrams is a best practice, it would not normally be part of a
postimplementation review.
60.An IS auditor reports that the financial module of an enterprise resource
planning (ERP) application is very slow because the audit trails are activated on
some sensitive tables. The vendor has asked to disable audit trails on these
transactional tables and restrict auditing only to successful and unsuccessful
logons to the system. What is the GREATEST threat if this recommendation is
implemented?
A. The integrity of the financial data could not be guaranteed.
B. The integrity of the system logs could not be guaranteed.
C. Access to sensitive data is not logged.
D. Fraud could occur.
The answer is A.
Audit trails in ERP systems retain all the information on data changes, the author of
the changes, the dates of the changes, the values changed, etc. If the audit trails on
transactional data are not active, it would be difficult to identify changes to the data
and detect any unauthorized modification. Choice B is not valid because the system
logs are separate and distinct from the application audit trail. Choice C is not correct
because the access mode (read-only) is usually not logged with ERP audit trails and
so this is not a concern. Choice D is not correct because audit trails are not
preventive controls and do not prevent fraud.

61.During a postimplementation review of an enterprise resource management

system, an IS auditor would MOST likely:
A. review access control configuration.
B. evaluate interface testing.
C. review detailed design documentation.
D. evaluate system testing.
The answer is A.
Reviewing access control configuration would be the first task performed to
determine whether security has been appropriately mapped in the system. Since a
postimplementation review is done after user acceptance testing and actual
implementation, one would not engage in interface testing or detailed design
documentation. Evaluating interface testing would be part of the implementation
process. The issue of reviewing detailed design documentation is not generally
relevant to an enterprise resource management system, since these are usually
vendor packages with user manuals. System testing should be performed before
final user signoff.
62.A company has implemented a new client-server enterprise resource planning
(ERP) system. Local branches transmit customer orders to a central
manufacturing facility. Which of the following would BEST ensure that the
orders are entered accurately and the corresponding products are produced?
A. Verifying production to customer orders
B. Logging all customer orders in the ERP system
C. Using hash totals in the order transmitting process
D. Approving (production supervisor) orders prior to production
The answer is A.
Verification will ensure that production orders match customer orders. Logging can
be used to detect inaccuracies, but does not in itself guarantee accurate processing.
Hash totals will ensure accurate order transmission, but not accurate processing
centrally. Production supervisory approval is a time consuming, manual process that
does not guarantee proper control.
63.An IS auditor should ensure that review of online electronic funds transfer (EFT)
reconciliation procedures should include:
A. vouching.
B. authorizations.
C. corrections.
D. tracing
The correct answer is D.
Tracing involves following the transaction from the original source through to its
final destination. In EFT transactions, the direction on tracing may start from the
customer-printed copy of the receipt, checking the system audit trails and logs, and

finally checking the master file records for daily transactions. Vouching is usually
performed on manual or batch-processing systems. In this scenario, the funds are
transferred electronically and there is no manual processing. In online processing,
authorizations are normally done automatically by the system. Correction entries
are normally done by an individual other than the person entrusted to do
reconciliations.
64.A company uses a bank to process its weekly payroll. Time sheets and payroll
adjustment forms (e.g., hourly rate changes, terminations) are completed and
delivered to the bank, which prepares checks (cheques) and reports for
distribution. To BEST ensure payroll data accuracy:
A. payroll reports should be compared to input forms.
B. gross payroll should be recalculated manually.
C. checks (cheques) should be compared to input forms.
D. checks (cheques) should be reconciled with output reports.
The answer is A.
The best way to confirm data accuracy, when input is provided by the company and
output is generated by the bank, is to verify the data input (input forms) with the
results of the payroll reports. Hence, comparing payroll reports with input forms is
the best mechanism of verifying data accuracy. Recalculating gross payroll manually
would only verify whether the processing is correct and not the data accuracy of
inputs. Comparing checks (cheques) to input forms is not feasible as checks
(cheques) have the processed information and input forms have the input data.
Reconciling checks (cheques) with output reports only confirms that checks
(cheques) have been issued as per output reports.
65.An IS auditor who has discovered unauthorized transactions during a review of
EDI transactions is likely to recommend improving the:
A. EDI trading partner agreements.
B. physical controls for terminals.
C. authentication techniques for sending and receiving messages.
D. program change control procedures.
The correct answer is C.
Authentication techniques for sending and receiving messages play a key role in
minimizing exposure to unauthorized transactions. The EDI trading partner
agreements would minimize exposure to legal issues.
66.During an application audit, an IS auditor finds several problems related to
corrupted data in the database. Which of the following is a corrective control
that the IS auditor should recommend?
A. Implement data backup and recovery procedures.
B. Define standards and closely monitor for compliance.
C. Ensure that only authorized personnel can update the database.
D. Establish controls to handle concurrent access problems.

The answer is A.
Implementing data backup and recovery procedure is a corrective control, because
backup and recovery procedures can be used to roll back database errors. Defining
or establishing standards is a preventive control, while monitoring for compliance is
a detective control. Ensuring that only authorized personnel can update the
database is a preventive control. Establishing controls to handle concurrent access
problems is also a preventive control.
67.Web application developers sometimes use hidden fields on web pages to save
information about a client session. This technique is used, in some cases, to
store session variables that enable persistence across web pages, such as
maintaining the contents of a shopping cart on a retail web site application.
The MOST likely web-based attack due to this practice is:
A. parameter tampering.
B. cross-site scripting.
C. cookie poisoning.
D. stealth commanding.
The answer is A.
Web application developers sometimes use hidden fields to save information about
a client session or to submit hidden parameters, such as the language of the end
user, to the underlying application. Since hidden form fields do not display in the
browser, developers may feel safe passing unvalidated data in the hidden fields (to
be validated later). This practice is not safe since an attacker can intercept, modify
and submit requests which can discover information or perform functions that the
web developer never intended. The malicious modification of web application
parameters is known as parameter tampering. Cross-site scripting involves the
compromise of the web page to redirect users to content on the attacker web site.
The use of hidden fields has no impact on the likelihood of a cross-site scripting
attack since these fields are static content that cannot ordinarily be modified to
create this type of attack. Web applications use cookies to save session state
information on the client machine so that the user does not need to log on every
time a page is visited. Cookie poisoning refers to the interception and modification
of session cookies in order to impersonate the user or steal logon credentials. The
use of hidden fields has no relation to cookie poisoning. Stealth commanding is the
hijacking of a web server by the installation of unauthorized code. While the use of
hidden forms may increase the risk of server compromise, the most common server
exploits involve vulnerabilities of the server operating system or web server.
68.When transmitting a payment instruction, which of the following will help verify
that the instruction was not duplicated?
A. Use of a cryptographic hashing algorithm
B. Enciphering the message digest
C. Deciphering the message digest
D. A sequence number and time stamp

The correct answer is D.

When transmitting data, a sequence number and/or time stamp built into the
message to make it unique can be checked by the recipient to ensure that the
message was not intercepted and replayed. This is known as replay protection, and
could be used to verify that a payment instruction was not duplicated. Use of a
cryptographic hashing algorithm against the entire message helps achieve data
integrity. Enciphering the message digest using the sender's private key, which
signs the sender's digital signature to the document, helps in authenticating the
transaction. When the message is deciphered by the receiver using the sender's
public key, it ensures that the message could only have come from the sender. This
process of sender authentication achieves nonrepudiation.
69.When reviewing an organization's approved software product list, which of the
following is the MOST important thing to verify?
A. The risks associated with the use of the products are periodically assessed
B. The latest version of software is listed for each product
C. Due to licensing issues the list does not contain open source software
D. After hours support is offered
The answer is A.
Since the business conditions surrounding vendors may change, it is important for
an organization to conduct periodic risk assessments of the vendor software list.
This might be best incorporated into the IT risk management process. Choices B, C
and D are possible considerations but would not be the most important.
70.When using an integrated test facility (ITF), an IS auditor should ensure that:
A.production data are used for testing.
B.test data are isolated from production data.
C.a test data generator is used.
D.master files are updated with the test data.
The correct answer is B.
An integrated test facility (ITF) creates a fictitious file in the database, allowing for
test transactions to be processed simultaneously with live data. While this ensures
that periodic testing does not require a separate test process, there is a need to
isolate test data from production data. An IS auditor is not required to use
production data or a test data generator. Production master files should not be
updated with test data.
71.A company undertakes a business process reengineering (BPR) project in
support of a new and direct marketing approach to its customers. Which of the
following would be an IS auditor's main concern about the new process?
A. Whether key controls are in place to protect assets and information
resources
B. If the system addresses corporate customer requirements
C. Whether the system can meet the performance goals (time and resources)

D. Whether owners have been identified who will be responsible for the
process
The answer is A.
The audit team must advocate the inclusion of the key controls and verify that the
controls are in place before implementing the new process. Choices B, C and D are
objectives that the business process reengineering (BPR) process should achieve,
but they are not the auditor's primary concern.
72.The GREATEST advantage of using web services for the exchange of
information between two systems is:
A.
secure communications.
B.
improved performance.
C.
efficient interfacing.
D.
enhanced documentation.
The correct answer is C.
Web services facilitate the exchange of information between two systems,
regardless of the operating system or programming language used. Communication
is not necessarily securer or faster, and there is no documentation benefit in using
web services.
73.Which of the following is the MOST critical and contributes the greatest to the
quality of data in a data warehouse?
A. Accuracy of the source data
B. Credibility of the data source
C. Accuracy of the extraction process
D. Accuracy of the data transformation
The answer is A.
Accuracy of source data is a prerequisite for the quality of the data in a data
warehouse. Credibility of the data source, accurate extraction processes and
accurate transformation routines are all important, but would not change inaccurate
data into quality (accurate) data.
74.Which of the following would help to ensure the portability of an application
connected to a database?
A. Verification of database import and export procedures
B. Usage of a structured query language (SQL)
C. Analysis of stored procedures/triggers
D. Synchronization of the entity-relation model with the database physical
schema
The correct answer is B.
The use of SQL facilitates portability. Verification of import and export procedures
with other systems ensures better interfacing with other systems, analyzing stored
procedures/triggers ensures proper access/performance, and reviewing the design

entity-relation model will be helpful, but none of these contribute to the portability
of an application connecting to a database.
75.

An IS auditor reviewing an accounts payable system discovers that audit logs

are not being reviewed. When this issue is raised with management the
response is that additional controls are not necessary because effective
system access controls are in place. The BEST response the auditor can make
is to:
A. review the integrity of system access controls.
B. accept management's statement that effective access controls are in
place.
C. stress the importance of having a system control framework in place.
D. review the background checks of the accounts payable staff.

The correct answer is C

Experience has demonstrated that reliance purely on preventative controls is
dangerous. Preventative controls may not prove to be as strong as anticipated or
their effectiveness can deteriorate over time. Evaluating the cost of controls versus
the quantum of risk is a valid management concern. However, in a high-risk system
a comprehensive control framework is needed. Intelligent design should permit
additional detective and corrective controls to be established that don't have high
ongoing costs, e.g., automated interrogation of logs to highlight suspicious
individual transactions or data patterns. Effective access controls are, in
themselves, a positive but, for reasons outlined above, may not sufficiently
compensate for other control weaknesses. In this situation the IS auditor needs to
be proactive. The IS auditor has a fundamental obligation to point out control
weaknesses that give rise to unacceptable risks to the organization and work with
management to have these corrected. Reviewing background checks on accounts
payable staff does not provide evidence that fraud will not occur.
76.When evaluating the controls of an EDI application, an IS auditor should
PRIMARILY be concerned with the risk of:
A. excessive transaction turnaround time.
B. application interface failure.
C. improper transaction authorization.
D. nonvalidated batch totals.
The correct answer is C.
Foremost among the risks associated with electronic data interchange (EDI) is
improper transaction authorization. Since the interaction with the parties is
electronic, there is no inherent authentication. The other choices, although risks, are
not as significant.
77.Which of the following represents the GREATEST potential risk in an EDI
environment?
A. Transaction authorization

B. Loss or duplication of EDI transmissions

C. Transmission delay
D. Deletion or manipulation of transactions prior to or after establishment of
application controls
The answer is A.
Since the interaction between parties is electronic, there is no inherent
authentication occurring; therefore, transaction authorization is the greatest risk.
Choices B and D are examples of risks, but the impact is not as great as that of
unauthorized transactions. Transmission delays may terminate the process or hold
the line until the normal time for processing has elapsed; however, there will be no
loss of data.
78.Responsibility and reporting lines cannot always be established when auditing
automated systems since:
A. diversified control makes ownership irrelevant.
B. staff traditionally changes jobs with greater frequency.
C. ownership is difficult to establish where resources are shared.
D. duties change frequently in the rapid development of technology
The correct answer is C.
Because of the diversified nature of both data and application systems, the actual
owner of data and applications may be hard to establish
79.An existing system is being extensively enhanced by extracting and reusing
design and program components. This is an example of:
A. reverse engineering.
B. prototyping.
C. software reuse.
D. reengineering.
The correct answer is D.
Old (legacy) systems that have been corrected, adapted and enhanced extensively
require reengineering to remain maintainable. Reengineering is a rebuilding activity
to incorporate new technologies into existing systems. Using program language
statements, reverse engineering involves reversing a program's machine code into
the source code in which it was written to identify malicious content in a program,
such as a virus, or to adapt a program written for use with one processor for use
with a differently designed processor. Prototyping is the development of a system
through controlled trial and error. Software reuse is the process of planning,
analyzing and using previously developed software components. The reusable
components are integrated into the current software product systematically.
80.After discovering a security vulnerability in a third-party application that
interfaces with several external systems, a patch is applied to a significant

number of modules. Which of the following tests should an IS auditor

recommend?
A. Stress
B. Black box
C. Interface
D. System
The correct answer is D.
Given the extensiveness of the patch and its interfaces to external systems, system
testing is most appropriate. Interface testing is not enough, and stress or black box
testing are inadequate in these circumstances.
81.A number of system failures are occurring when corrections to previously
detected errors are resubmitted for acceptance testing. This would indicate
that the maintenance team is probably not performing adequately which of the
following types of testing?
A. Unit testing
B. Integration testing
C. Design walkthroughs
D. Configuration management
The correct answer is B.
A common system maintenance problem is that errors are often corrected quickly
(especially when deadlines are tight). Units are tested by the programmer and then
transferred to the acceptance test area; this often results in system problems that
should have been detected during integration or system testing. Integration testing
aims at ensuring that the major components of the system interface correctly.
82.When performing an audit of a client relationship management (CRM) system
migration project, which of the following should be of GREATEST concern to an
IS auditor?
A. The technical migration is planned for a Friday preceding a long weekend,
and the time window is too short for completing all tasks.
B. Employees pilot-testing the system are concerned that the data
representation in the new system is completely different from the old
system.
C. A single implementation is planned, immediately decommissioning the
legacy system.
D. Five weeks prior to the target date, there are still numerous defects in the
printing functionality of the new system's software.
The correct answer is C.
Major system migrations should include a phase of parallel operation or a phased
cut-over to reduce implementation risks. Decommissioning or disposing of the old
hardware would complicate any fallback strategy, should the new system not
operate correctly. A weekend can be used as a time buffer so that the new system
will have a better chance of being up and running after the weekend. A different

data representation does not mean different data presentation at the front end.
Even when this is the case, this issue can be solved by adequate training and user
support. The printing functionality is commonly one of the last functions to be
tested in a new system because it is usually the last step performed in any business
event. Thus, meaningful testing and the respective error fixing are only possible
after all other parts of the software have been successfully tested.