Question 1
Of the following frameworks available from ISACA, which one governs IT investments?
COBIT
Val IT
Risk IT
IT Assurance Framework

Question 2
Applying controls is a direct result of the risk assessment process combined with an analysis of the tradeoffs. Which one of the following is a tradeoff?
Operational impact
Security impact
User impact
Policy impact

Question 3
Applying controls to a system helps eliminate or reduce the risks. In many cases, the goal is not to eliminate the risk but to reduce the risk to an acceptable level. Why? Applying controls is a direct result of the risk assessment process combined with an analysis of ___________.
the benefits
management
the tradeoffs
resources

Question 4
The governing process for managing risks and opportunities is the definition of:
NIST Internal Reports (NISTIR)
Consensus Audit Guidelines (CAG)
Generally Accepted Privacy Principles (GAPP)
Enterprise risk management (ERM)

Question 5
Analyzing potential threats requires the identification of all possible threats first. This is called __________.
threat identification
policy identification
risk identification
risk analysis

Question 6
During an IT audit, which of the following administrative safeguards needs to be tested and validated?
Assignment of responsibilities
Maintenance procedures
Rotation of duties
All of the above

Question 7
When performing a security assessment, using a framework such as NIST 800-15, which is generally the first step?
Target identification
Document review
Target analysis
Exploit and validate vulnerabilities

Question 8
What is generally not tracked in a change management database?
Operating system type
Cost of software
Hardware configuration
Access permissions

Question 9
What is an example of multifactor authentication?
A fingerprint reader
A smart card with a PIN
A password
An acceptable use policy

Question 10
Of the four elements of an audit finding, which one identifies the expected or desired state, which provides context for evaluating the evidence collected by the auditor and the subsequent procedures the auditor performs?
Criteria
Circumstance
Cause
Impact

Question 11
For security controls, gap analysis involves comparing the present state of controls with a desired state of controls. At a minimum, common baseline security controls should be in place. Any gaps to various types of controls should be clearly documented, for example - "Business continuity management", which:
Defines the program to provide initial and ongoing security education across the organization.
Defines how staff will execute upon the policies, assign responsibilities, and promote accountability.
Prevents errors and unauthorized misuse of applications.
Provides methods to continue critical operations in spite of business interruptions.

Question 12
Which element does not constitute an audit finding?
Criteria
Circumstance
Summary
Impact

Question 13
During an IT audit of a social networking site, the auditor finds that users do not have the option to opt out of a new program to share portions of users' profiles automatically. Which privacy principle is most affected?
Choice and consent
Notice
Monitoring and enforcement
Quality