Information Systems MCQs with Answers
Practice important Information Systems MCQs with answers and explanations.
Chapter: 35
Q621:
Fill in the blank: An IS audit approach helps organizations assess _________ in their information systems.
A. Data redundancy
B. Security policies
C. Risk factors
D. Confidentiality
Correct Answer:
C
Chapter: 35
Q622:
Which question would an IT auditor ask when evaluating "Integrity" in IS audit parameters?
A. Is the information available?
B. Is the information accurate?
C. Is the information kept confidential?
D. Is the information unique?
Correct Answer:
B
Chapter: 35
Q623:
What is the first step in a Risk-Based Audit Approach?
A. Risk categorization
B. Understanding control structure
C. Risk assessment
D. Understanding business process
Correct Answer:
D
Chapter: 35
Q624:
During risk assessment, IS audit primarily identifies which of the following?
A. System bugs
B. Control structure
C. Security vulnerabilities
D. User activity logs
Correct Answer:
C
Chapter: 35
Q625:
Which of the following is a core objective in risk management during an IS audit?
A. Implementing network protocols
B. Implementing security policy
C. Organizing data logs
D. Increasing bandwidth
Correct Answer:
B
Chapter: 35
Q626:
What does "authenticity" ensure in an information system audit?
A. Information is useful
B. Information is available
C. Information is genuine without alteration
D. Information is recoverable
Correct Answer:
C
Chapter: 35
Q627:
Which of the following is NOT a parameter for IS audit according to information assets protection?
A. Integrity
B. Ownership
C. Utility
D. Confidentiality
Correct Answer:
B
Chapter: 36
Q628:
What is the primary purpose of Risk Management?
A. Managing financial investments
B. Measuring and managing risks
C. Improving productivity
D. Implementing new technology
Correct Answer:
B
Chapter: 36
Q629:
Risk management strategies do NOT include which of the following?
A. Avoiding the risk
B. Transferring the risk
C. Reducing the risk
D. Ignoring the risk
Correct Answer:
D
Chapter: 36
Q630:
Which phase in the SDLC is associated with identifying the system's resources and information?
A. System Characterization
B. Threat Identification
C. Vulnerability Identification
D. Control Analysis
Correct Answer:
A
Chapter: 36
Q631:
_______ is a weakness that could be accidentally triggered or intentionally exploited, posing potential risks to the system.
A. Threat
B. Vulnerability
C. Control
D. Security Measure
Correct Answer:
B
Chapter: 36
Q632:
In the risk management process, what step comes after Vulnerability Identification?
A. Likelihood Determination
B. Control Analysis
C. Impact Analysis
D. Threat Identification
Correct Answer:
B
Chapter: 36
Q633:
Which method is NOT used to gather information on an IT system within its operational boundary?
A. Filling out a questionnaire
B. Conducting interviews
C. Reviewing documents
D. Hiring additional staff
Correct Answer:
D
Chapter: 36
Q634:
Which of the following terms refers to a facilitator within a company responsible for assessments related to information security?
A. Corporate Leader
B. Central Focal Point
C. System Auditor
D. Risk Controller
Correct Answer:
B
Chapter: 36
Q635:
The process of identifying potential weaknesses and flaws that could be exploited is called _______.
A. System Characterization
B. Threat Identification
C. Control Analysis
D. Vulnerability Assessment
Correct Answer:
D
Chapter: 36
Q636:
Which component of an IT system includes hardware, software, data, and people who support the IT system?
A. Threat Identification
B. System Characterization
C. Vulnerability Analysis
D. Risk Assessment
Correct Answer:
B
Chapter: 36
Q637:
The process of assessing risks for an IT system begins by defining the _______ of the effort.
A. scope
B. impact
C. vulnerability
D. solution
Correct Answer:
A
Chapter: 36
Q638:
Which step in threat identification involves understanding the motivation behind potential threats?
A. System Characterization
B. Threat Action
C. Vulnerability Assessment
D. Threat Motivation
Correct Answer:
D
Chapter: 36
Q639:
In risk management, which phase includes the step "Results Documentation"?
A. System Characterization
B. Control Recommendation
C. Implementation
D. Threat Identification
Correct Answer:
C
Chapter: 36
Q640:
A weakness in a system that could be exploited by a threat is called a _______.
A. Threat
B. Control
C. Risk
D. Vulnerability
Correct Answer:
D