Utah State University

ACCT 610

Chapter 16-IT Controls Part II: Security and Access

TRUE/FALSE

1)In a computerized environment, the audit trail log must be printed onto paper documents.

2. Disguising message packets to look as if they came from another user and to gain access to the host’s network is called spooling.

3. Access controls take on increased importance in a computerized environment because all of the records may be found in one place.

4. Computer viruses usually spread throughout the system before being detected.

5. A worm is software program that replicates itself in areas of idle memory until the system fails.

6. Viruses rarely attach themselves to executable files.

7. Subschemas are used to authorize user access privileges to specific data elements.

8. A recovery module suspends all data processing while the system reconciles its journal files against the database.

9. The Database Management System controls program files.

10. Operating system controls are of interest to system professionals but should not concern accountants and auditors.

11. The most frequent victims of program viruses are microcomputers.

12. Access controls protect databases against destruction, loss or misuse through unauthorized access.

13. Operating system integrity is not of concern to accountants because only hardware risks are involved.

14. Audit trails in computerized systems are comprised of two types of audit logs: detailed logs of individual keystrokes and event-oriented logs.

15. In a telecommunications environment, line errors can be detected by using an echo check.

16. Firewalls are special materials used to insulate computer facilities
17. The message authentication code is calculated by the sender and the receiver of a data transmission.

18. The request-response technique should detect if a data communication transmission has been diverted.

19. Electronic data interchange translation software interfaces with the sending firm and the value added network.

20. A value added network can detect and reject transactions by unauthorized trading partners.

21. Electronic data interchange customers may be given access to the vendor's data files.

22. The audit trail for electronic data interchange transactions is stored on magnetic media.

23. A firewall is a hardware partition designed to protect networks from power surges.

24. To preserve audit trails in a CBIS environment, transaction logs are permanent records of transactions.

25. Examining programmer authority tables for information about who has access to Data Definition Language commands will provide evidence about who is responsible for creating subschemas.

MULTIPLE CHOICE

1. The operating system performs all of the following tasks except

2. Which of the following is considered an unintentional threat to the integrity of the operating system?

3. A software program that replicates itself in areas of idle memory until the system fails is called a

4. A software program that allows access to a system without going through the normal logon procedures is called a

5. All of the following will reduce the exposure to computer viruses except

6. Which backup technique is most appropriate for sequential batch systems?

7. When creating and controlling backups for a sequential batch system,

8. Hackers can disguise their message packets to look as if they came from an authorized user and gain access to the host’s network using a technique called

9. In a direct access file system

10. Which of the following is not an access control in a database system?

11. Which is not a biometric device?

12. Which of the following is not a basic database backup and recovery feature?

13. All of the following are objectives of operating system control except

14. Passwords are secret codes that users enter to gain access to systems. Security can be compromised by all of the following except

15. Audit trails cannot be used to

16. Which control will not reduce the likelihood of data loss due to a line error?

17. Which method will render useless data captured by unauthorized receivers?

18. Which method is most likely to detect unauthorized access to the system?

19. All of the following techniques are used to validate electronic data interchange transactions except

20. In an electronic data interchange environment, customers routinely access

21. All of the following tests of controls will provide evidence that adequate computer virus control techniques are in place and functioning except

22. Audit objectives for the database management include all of the following except

23. All of the following tests of controls will provide evidence that access to the data files is limited except

24. Audit objectives for communications controls include all of the following except

25. When auditors examine and test the call-back feature, they are testing which audit objective?

26. In an Electronic Data Interchange (EDI) environment, when the auditor compares the terms of the trading partner agreement against the access privileges stated in the database authority table, the auditor is testing which audit objective?

27. Audit objectives in the Electronic Data Interchange (EDI) environment include all of the following except

28. In determining whether a system is adequately protected from attacks by computer viruses, all of the following policies are relevant except

29. Which of the following is not a test of access controls?

30. In an electronic data interchange environment, customers routinely

31. In an electronic data interchange environment, the audit trail

32. All of the following are designed to control exposures from subversive threats except

33. Many techniques exist to reduce the likelihood and effects of data communication hardware failure. One of these is

34. Which of the following deal with transaction legitimacy?

35. Firewalls are

36. The database attributes that individual users have permission to access are defined in

37. An integrated group of programs that supports the applications and facilitates their access to specified resources is called a (an)

SHORT ANSWER

1. Briefly define an operating system.

2. What is a virus?

3. Describe one benefit of using a call-back device.

4. Contrast the Private Encryption Standard approach with the Public Key Encryption approach to controlling access to telecommunication messages.

5. List three methods of controlling unauthorized access to telecommunication messages.

6. Describe two ways that passwords are used to authorize and validate messages in the electronic data interchange environment.

7. Explain how transactions are audited in an electronic data interchange environment.

8. Describe are some typical problems with passwords?

9. Discuss the key features of the one-time password technique:

10. Describe two tests of controls that would provide evidence that the database management system is protected against unauthorized access attempts.

11. What is event monitoring?

12. What are the auditor's concerns in testing EDI controls?

13. What is a database authorization table?

:

14. What is a user-defined procedure?

15. What are biometric devices?

ESSAY

1. What are the three security objectives of audit trails? Explain.

2. What is an operating system? What does it do? What are operating system control objectives?

3. Discus three sources of exposure (threats) to the operating system.

4. There are many techniques for breaching operating system controls. Discuss three.

5. A formal log-on procedure is the operating system’s first line of defense. Explain this works.