Transcription
DISA Review Questions, Answers ManualThe Institute of Chartered Accountants of India(Set up by an Act of Parliament)New Delhi
The Institute of Chartered Accountants of IndiaAll rights reserved. No part of this publication may be reproduced, stored in a retrieval system,or transmitted, in any form, or by any means, electronic mechanical, photocopying, recording,or otherwise, without prior permission, in writing, from the publisher.DISCLAIMERThe views expressed in this material are those of author(s). The Institute of CharteredAccountants of India (ICAI) may not necessarily subscribe to the views expressed by theauthor(s).The information in this material has been contributed by various authors based on theirexpertise and research. While every effort has been made to keep the information cited in thismaterial error free, the Institute or its officers do not take the responsibility for anytypographical or clerical error which may have crept in while compiling the informationprovided in this material. There are no warranties/claims for ready use of this material as thismaterial is for educational purpose. The information provided in this material are subject tochanges in technology, business and regulatory environment. Hence, members are advised toapply this using professional judgement. Please visit CIT portal for the latest updates. Allcopyrights are acknowledged. Use of specific hardware/software in the material is not anendorsement by ICAI.Revised Edition:May 2018Committee/Department :Digital Accounting and Assurance BoardEmail:cit@icai.in; gdaab@icai.inWebsite:www.icai.org/ http://pqc.icai.orgPrice: ISBN No:978-81-8441-810-1Published by:The Publication Department on behalf of the Institute ofChartered Accountants of India, ICAI Bhawan, Post Box No.7100, Indraprastha Marg, New Delhi-110 002.Printed by:Sahitya Bhawan Publications, Hospital Road,Agra - 282 003.
Contents1.Primer on Information Technology, IS Infrastructure & Emerging Technologies12.Information Systems Assurances Services1813.Governance and Management of Enterprise Information Technology,Risk Management & Compliance2084.Protection of Information Assets2575.Systems Development – Acquisition, Maintenance and Implementation3696.Business Application Software Audit3937.Business Continuity Management409
Module 1Primer on Information Technology, ISInfrastructure & Emerging Technologies1.The KEY components of IT Infrastructure areA.Users, Applications, DBMS, System Software, Network & HardwareB.Computing systems, satellite dishes, ISDN lines, Radio towersC.Concrete building, air conditioning, fire extinguishers, sprinklersD.Large servers, desktop computers, laptops, tabletsKEY AJustification2.A.All information systems will have these elements as common to them sinceinteractions will take place between them in such systems. This is explained inpara 1.2.B.B, C and D are incorrect since they are not speaking of the common elements ofany information systems but are various types of equipment alone (B), physicalinfrastructure alone (C) or merely various types of computing devicesAuditors dealing with organizations deploying IT need to haveA.Adequate working knowledge of IT hardware & softwareB.Expertise in all areas of IT technologyC.Thorough knowledge on the financial aspects aloneD.Expertise both in financial and IT technology aspectsKEY AJustificationA.C.A.s knowledge of IT technology need not and cannot be complete and total.They only need adequate knowledge to effectively audit the IT functions of anorganizationB.C.A.s cannot be expected to be experts in all areas of IT technology; this is nottheir role
DISA Review Questions, Answers Manual3.C.Knowledge of financial aspects alone in a technology oriented function like IT willnot facilitate effective auditing of the IT functionD.A C.A. cannot be expected to have thorough knowledge of both financial & ITtechnology aspectsPeople, the mostimportelementofinformationsystems,A.Users of the system in the head office and branchesB.All users of the system and all information system personnelC.All employees except information system personnelD.Employees involved with maintenance of the information systemcompriseKEY BJustification4.A.It does not exclude the people managing the IT systemB.As brought out in paragraph 1.2.1, the scope of IT covers both the actual usersas well as those involved in managing the IT systemC.It includes the information system management personnelD.The actual users of the system are also KEY to the IT systemApplication software is a collection of programs whichA.Operates computer hardware & facilitates use of system softwareB.Exclusively use for generating applications to govt. bodiesC.Addresses a real life problem for its end usersD.Helps users generate complaints to IT services dept. aloneKEY CJustificationIt is system software which helps run hardware & facilitates use of application software.Options B & D are also wrong & are not generic definitions of application software. Asexplained in paragraph 1.2.2, application software are programmes that help addressbusiness, scientific or other needs of its end users5.Hardware refers toA.All computer parts except those which are soft, made of glass or plasticB.Devices performing Input, output, processing & data storage functions of acomputer2
Primer on Information Technology, IS Infrastructure & Emerging TechnologiesC.All connecting tubes, hoses, joints, cables and pipelines carrying IT cablesD.All parts of the computer which are complex and hard to understandKEY BJustification6.A.A, C & D are clearly wrong answers which have no relation to the definition inparagraph 1.2.6B.As defined clearly in paragraph 1.2.6The basic sequential steps of the machine cycle performed by the CPU areA.Fetch, Decode, Execute and StoreB.Decode, Execute, Store and FetchC.Store, Fetch, Decode and ExecuteD.Execute, Fetch, Decode and StoreKEY AJustificationAs defined clearly in paragraph 1.3.2B,C & D are clearly wrong answers which contain the wrong sequence7.Cache memoryA.Is a large, slow memory which is no longer used in computersB.Helps bridge speed difference between Registers and Primary MemoryC.Is a virtual memory which is an image of another memoryD.Is a memory where only valuable, secret information is storedKEY BJustificationCache memory is a small & fast memory very much in use even today.As brought out in paragraph 1.3.3It is not a virtual memoryIt maintains copies of most frequently used data from main memories and not only forsecret information8.Secondary Memory3
DISA Review Questions, Answers ManualA.Is volatile memory with large storage capacitiesB.Is non-volatile memory which is fast & responsiveC.Is non-volatile memory with large storage capacitiesD.Involves higher cost per unit of information than RAMKEY CJustificationSecondary memory is not volatile.It is not fast.As brought out in paragraph 1.3.3, secondary memory is non-volatile, with large storagecapacities. It is, however, slower than registers or primary storage.Its cost per unit of information is lower than RAM9.One Megabyte is equal toA.1024 x 1024 BytesB.1000 KilobytesC.1000 BytesD.1,000,000 BytesKEY AJustification1 Megabyte equals 1024 Kilobytes or 1024 x 1024 Bytes.All the other answers are, therefore, obviously wrong.10.UnicodeA.Uses 16 Bytes for character coding & has replaced other major coding systemsB.Uses 7 bits for character codingC.Uses 16 bits for character coding & has replaced other major coding systemsD.Uses 8 bits for character codingKEY CJustificationA B & D answers are, obviously wrong.C.Unicode uses 16 bits for character coding & has replaced other major codingsystems as brought out in paragraph 1.44
Primer on Information Technology, IS Infrastructure & Emerging Technologies11.Implementing Hardware Monitoring ProceduresA.Is expensive and not cost effectiveB.Reduces Total Cost of Ownership & improves Return on InvestmentC.Is cumbersome & time consumingD.Leads to increased server downtimeKEY BJustificationPra 1.5.3 establishes that the other options are wrong & it makes sense to implementhardware monitoring procedures.As brought out in paragraph 1.5.312.Some factors that affect the requirement & capacity of various hardware areA.Number of employees in the organizationB.Variety of markets in which operations happenC.Nature of the products dealt with in the organizationD.Transaction volume, Computation complexityKEY DJustificationAs brought out in paragraph 1.5.4. This para also establishes that the other options arewrong.13.A KEY issue in retirement of hardware is security & disposal of data. Robustpolicies need to be in place for hardware retirement cycles, archiving of data,closure of licensing and/or contracts.A.FALSEB.TRUEKEY BJustificationAs brought out in paragraph 1.5.5, this statement is factually correct14.Hardware AuditingA.Is best carried out by the purchase department of the I.T. departmentB.Primarily encompasses hardware acquisition & capacity management5
DISA Review Questions, Answers ManualC.Should be restricted to the financial aspects of hardware usageD.Is not as critical as software auditing which can be a more vulnerable areaKEY BHardware is a vulnerable area which needs to be closely reviewed by Audit. Hence, theother three options are not correctParagraph1.6 elaborates on the criticality of hardware acquisition & capacitymanagement as KEY Areas of Hardware auditing.15.SoftwareA.Software consists of clearly-defined instruction sets that upon execution, tell acomputer what to doB.Refers to all the soft parts of any computer systemC.Is not as important as hardware; a system can operate even without itD.Are only those programs which convert machine language to EnglishKEY AJustificationParagraph 2.1 incorporates this definition.While option B is obviously incorrect, C is wrong since it would be impossible to operateany computer without software. D, too, is wrong since software plays a role muchbeyond that of converting machine language to English16.System SoftwareA.Is specific to each application software and cannot be interchangedB.Co-ordinates instructions between application software and hardwareC.Cannot be used for application developmentD.Is not involved in I/O devices connectivityKEY BJustificationDefinition as per paragraph 2.1.1. It is actually generic and can be used with anyapplication (option A). It can actually be the basis for development of applicationdevelopment (option C). It enables I/O devices connectivity17.Application SoftwareA.Microsoft Office is not an example of application software6
Primer on Information Technology, IS Infrastructure & Emerging TechnologiesB.Cannot be directly interacted with by end usersC.Is a set of software that performs a function directly for the end userD.Can be directly used on a computer even without system softwareKEY CJustificationAs clearly defined in 2.1.2. Microsoft Office is, indeed, an example of applicationsoftware. (option A). A KEY Aspect of application software is that it can be directlyinteracted with by end users (option B). Lastly, a computer cannot be run withoutsystem software as brought out in earlier notes18.An Operating System isA.An intermediary agent that manages computer resources among variousprocessesB.An application software which is in operation in a computer networkC.A new type of software which has been introduced in the latest computers onlyD.A computer system which has been switched on and is in proper operationKEY AJustificationThe definition is as per paragraph 2.2. As for the other options, an operating system is,obviously a system software and not an application software (option B). It is not a newtype of software and has been an intrinsic part of all computer systems for long (optionC). Though option D may not appear to be factually incorrect, this is not the sense inwhich the term Operating System is used in this context.19.State True or False : Operating Systems can be single user / multi user,multi processing or real time.A.FALSEB.TRUEKEY BJustificationThis has been clearly elaborated in paragraph 2.2.120.Processor Management refers toA.Management of the various processors by the Systems ExecutiveB.Training of the end-user for optimal user of computer systems7
DISA Review Questions, Answers ManualC.Optimisation of use of application software on a personal computerD.Process or task scheduling carried out by the Operating SystemKEY DJustificationAs brought out in paragraph 2.2.2, Processor Management is one of the KEY rolesplayed by an Operating system. It enables process scheduling. The Operating system ispart of the main computer system and one of its KEY roles is process scheduling. It hasnothing to do with the management role of Systems Executives or with training of endusers (options A & B). It is not relevant to application software optimisation (option C).21.Which of the following is performed by the Operating SystemA.Supports virtual memory by carving out an area of hard diskB.Supports virtual memory on external storage deviceC.Supports secondary memory by allocating an area of hard diskD.Supports end user in carrying out specific functionsKEY AJustificationThe Operating System supports RAM by carving out an area of hard disk to create avirtual memory (option A). It does not do this on any external storage device (option B).The OS can only assist expansion of RAM space by carving out hard disk space, notsecondary memory (option C). The OS is only an intermediary agent and does notinteract directly with the end user (option D).22.Which of the following is a role of the Operating SystemA.Helps manage Data bases of various typesB.Facilitates use of spread sheets by end usersC.Manages device communication with respective driversD.Helps programmers to create computer programsKEY CJustification:One of the KEY functions of the Operating system is insulating the end user from thepeculiarities of each hardware device (option C). OS are not directly involved in use ofData Bases or spread sheets; nor are they useful for writing programs. One would needprogram development software for that purpose (options A,B & D)8
Primer on Information Technology, IS Infrastructure & Emerging Technologies23.Fifth Generation programming languageA.It comprises machine language & codeB.Is mainly used in Artificial intelligenceC.Cannot solve a problem without a programmerD.It uses long instructions & is machine dependentKEY BJustification:Fifth generation programming language is the most advanced of the languages & isused in artificial intelligence. It is, thus, not based upon primitive machine language andcode. It is also pre-programmed with options in such a way that minimum intervention ofa programmer is required. It is much simpler and platform independent as compared tofirst generation programming languages (options A, C & D).24.What is the function of a Compiler ?A.It translates Assembly language into Machine languageB.It translates statements of a program into machine code, line by lineC.A compiler translates a high level language program into a machine languageprogramD.It allows a user to create and edit filesKEY CJustificationA compiler basically translates a high level program into machine code. It does notoperate at the level of converting Assembly language into machine code or, like anInterpreter, translate into machine code line by line (options A and B) It is also not anEditor program to create and edit files (D).25.Which software controls, among other things, ownership assignment of all datafor accountability ?A.Access Control SoftwareB.Data Communications SoftwareC.Utility programsD.Defragmenters9
DISA Review Questions, Answers ManualKEY AJustificationIt is access control software which is vested with the responsibility for assigningownership of all data for purposes of accountability (para 2.3.2). Data Communicationssoftware generally assists the OS for local and remote terminal access (option B). Utilityprograms and defragmenters basically help improve computer efficiency andperformance and have nothing to do with ownership assignment of all data.26.Access control lists in the OS manage OS Controls. The lowest level of controlthat can be exercised is, generally, up to :A.The level of an individual directoryB.The level of a particular page in a fileC.The level of individual words in a fileD.The level of individual filesKEY DJustificationMost systems are designed to exercise access control only up to the level of a file andnot below. Hence the choice of D as the right option above and the rejection of theother options27.State Yes or NoIn a newly formed organization, the System Administrator is faced with requests foraccess to particular files from multiple users. On closer scrutiny, he finds that thoughthe users are different, he is able to detect a pattern whereby individuals handlingparticular functions all seek access to the same files. The System Administrator isaware that, while the individuals handling these functions may change, the actualfunctions, by and large, are permanent. He feels that it would be simpler to provideaccess control for files to particular functions and would like to know the feasibility ofdoing so in the Operating system. What is your view ? Is it possible to provide access to‘Roles’ which could comprise multiple users, instead of creating individual accesscontrols for each of the users ? :A.Yes, it would be possibleB.No, it would not be possible10
Primer on Information Technology, IS Infrastructure & Emerging TechnologiesKEY AJustificationAccess control lists are widely used with Roles comprising multiple users. The individualusers can keep changing depending upon the roles they take up. Hence, Option Aabove is correct.28.What is the first step in Software acquisition ?A.Establish criteria for selecting and rejecting alternativesB.Carry out Cost/Benefit analysis, including make or buy decisionC.Establish scope, objectives background & project charterD.Determine supplier’s technical capabilities & support servicesKEY CJustificationWithout first establishing the scope and objectives, software acquisition may end upfailing on fundamental aspects of meeting end user needs. This would be the startingpoint, therefore, for any acquisition exercise. The other options get ruled out by default.29.What is an Endpoint device ?A.A device used as a pointer during Power point presentationsB.The key-board or a mouse on a computerC.A device which identifies the end of each software programD.An internet-capable computer hardware device on a TCP/IP networkKEY DJustificationEndpoint devices can be computers, smart phones, thin clients, etc. which haveconnectivity to the internet as brought out in option D. The very fact that they have thisconnectivity raises concerns of security with respect to possible leakage of informationto the outside world or vulnerability to virus or other malicious software which mayattempt to enter the system from the internet.30.What is Digital Rights Management ?A.Management of binary digit codes in the system softwareB.Technology used for preventing users from using the content in any manner otherthan that permitted by the content providerC.Conversion of analog records to digital modeD.Optimization of binary digit codes in application software11
DISA Review Questions, Answers ManualKEY BJustificationDigital Rights Management refers to the control on use of copyrighted / IPR materialand, hence, option B is correct. The other options are wrong.31.Does the Operating system need auditing ?A.Yes; there is risk of the OS being compromisedB.No; the application software prevents direct access to the OSC.No; the OS is a robust system which cannot be tampered withD.No, it is adequate if the application software are auditedKEY AJustificationThough, in the normal course, end-users to do not have direct access to the OS, theycould find ways of by-passing the application software and reaching out to the OS.Unlike the application software which has high security features to prevent end userstampering with data which is not open to them, the OS is relatively more vulnerablesince it sees all data as simple bits/bytes & cannot even distinguish between differenttypes of data of different criticality32.Which of the following is the correct sequence of data hierarchy?A.File, Database, Record, Field, CharactersB.Database, Record, File, Field, CharactersC.Database, File, Record, Field, CharactersD.Database, File, Field, Character, RecordsKEY CJustificationThe sequence of hierarchy from higher to lower levels is clearly as per Option C and thesequence of hierarchy for the other options are, therefore, wrong.33.What are Characters ?A.Characters are a group of bytesB.Characters are a collection of bitsC.Characters are a group of 8 recordsD.Characters are a group of 16 records12
Primer on Information Technology, IS Infrastructure & Emerging TechnologiesKEY BJustificationCharacters are at the lowest in the Data hierarchy and comprise a collection of bits(Option B). The other options are wrong.34.What are some of the major outcomes of the non-existence of an efficientdatabase ?A.High redundancy and low data integrityB.Improved data sharingC.Reduced dependence between data and application softwareD.Better linkages between data originating from different sourcesKEY AJustificationAn efficient data base can reduce redundancy and improve data integrity (option A).The absence of a database will hinder data sharing & increase dependence betweendata and application software. An efficiently configured database will provide excellentnetworking of data from different sources.35.What is a Database Management System?A.A set of pre-loaded data relating to specific industriesB.Customer profile data used for managing an organizationC.Software for creation, control & manipulation of a databaseD.Hardware specifically designed to handle databasesKEY CJustificationA database management system is a software which assists in the process of managinga database as brought out in option C. It is not just a set of data or hardware asindicated in the other options.36.What are the major risks of having a Database management system ?A.Reduced speed of access to recordsB.High redundancy & duplicationC.Reduced data integrityD.Cost and data security threats13
DISA Review Questions, Answers ManualKEY DJustificationThe major risks involved are the cost (including time for implementation of a newsystem) and increased vulnerability owing to centralisation of information as indicated inOption D. Contrary to what is stated in the other options, a database managementsystem improves speed of access to records, reduces redundancy and improves dataintegrity.37.Which of the following is the logic typical of a Relational Database ManagementSystem ?A.Records have a one to many relationship in parent/child formatB.Collection of one or more relations in two dimensional table formC.Records have many-to-many relationship in network formD.Data is organized in a tree structure, in hierarchical formatKEY BJustificationThe logic behind RDBMS is in table form with domain & entity constraints which ensurerobustness of the system (Option B). The other options relate to the hierarchical andnetwork types of database and are, hence, wrong.38.Use of integrity constraints and normalisation is strongly typical of which type ofsoftware?A.Relational Database Management SystemB.Network Database Management SystemC.Hierarchical Database Management SystemD.Foxpro, Excel systems of spreadsheetKEY AJustification:The use of integrity constraints and normalization is typical of RDBMS and not of theother three options.39.Which of the following defines the logical structure of the database, its relations& constraints ?A.Internal SchemaB.External Schema14
Primer on Information Technology, IS Infrastructure & Emerging TechnologiesC.Conceptual SchemaD.Logic unit in CPUKEY CJustification:It is the Conceptual Schema which defines the logical structure of the databaseincluding its relations and constraints and not the other options indicated.40.Which of the following is a database language used to define & describe data &relationships ?A.Data Manipulation Language or DMLB.Data Control Language or DCLC.Data Definition Language or DDLD.Excel and Lotus 123KEY CJustification:DDL is a collection of instructions and commands used to define and describe data andrelationships (Option C). DML, DCL & the spread sheet softwares are not theappropriate answer.41.Which of the following are typical features of Data Definition Language?A.Not used by Database administrators or designersB.SQL commands dealing with dataC.Generally used by a common userD.Used to define both conceptual & internal schemasKEY DJustification:DDL is a database language used by administrators and designers to define bothconceptual & internal schemas. It does not deal with data but only with the structure. Itis generally not used by the common user. Hence, only Option D is correct.42.Which of the following are typical of Data Manipulation Language ?A.Cannot be used for querying the databaseB.Used to retrieve, insert, delete or modify dataC.SQL commands which do not allow changing of data15
DISA Review Questions, Answers ManualD.Application software will not be able to access itKEY BJustification:DML is a database language used to query & manipulate data. Application software areable to meet user needs only by interacting with the DML. Hence, only Option B iscorrect.43.What is a Data Dictionary ?A.It provides a definition of terms and data elementsB.A dictionary which facilitates conversion of bytes into numbersC.A software which helps convert machine language to EnglishD.A software which helps convert assembly language to EnglishKEY AJustification:It is the documentation of database providing detailed description of every data in thedatabase. It provides a standard definition of terms and data elements (Option A). Theother options are factually wrong.44.What are Meta Data ?A.Metadata refers to data of large sizes, millions, billions, etc.B.Metadata is data about one or more aspects of dataC.Metadata is data relating to meteorological parametersD.Metadata is data that is universal to different types of softwareKEY BJustification:Metadata is data about data. It covers aspects like meaning, purpose, time & date ofcreation, etc. of data. Option B, obviously, is the correct choice. The other options areincorrect.45.Centralised Deployment Strategy involvesA.Centralized database & de-centralized decision makingB.De-centralized database and centralized decision makingC.Centralized database & centralized decision makingD.Multiple server usage16
Primer on Information Technology, IS Infrastructure & Emerging TechnologiesKEY CJustificationCentralized deployment strategy uses a central database with all user communicationbeing directed to it. Decision making, too, therefore, gets centralized as a consequence(Option C). Such a strategy use of a single hardware/software platform & a singleserver; hence, the other options are not correct.46.An important drawback of Centralised Deployment Strategy isA.Vulnerability to single point of failureB.Resource sharing of reduced orderC.Poorer economies of scaleD.Reduced securityKEY AJustificationCentralized deployment strategy concentrates all its resources at one central pointmaking it vulnerable to total system failure in the event of this central point beingcompromised in any manner (Option A). Resource sharing, in fact, is a strong plus pointfor centralised deployment. Similarly, this system has better economies of scale owingto use of large size hardware & larger number of software licences. Since everything iscentralized, possibilities of leakages are reduced since the number of exposed pointsare lesser. Hence, the other options are not correct.47.An important feature of Decentralized deployment strategy would beA.Information systems would be more compatibleB.Reduced duplication of records, processesC.Business strategy based localisation of database possibleD.Adequate centralised control through security implementationKEY CJustificationThe single major advantage of decentralized deployment strategy is its potential fortweaking the database to suit local requirements (Option C). However, compatibility ofinformation systems may take a hit since multiple versions could be involved dependingupon the geographic or business segment-wise spread of the organization. Risk ofduplication of records is higher since multiple versions at different locations may beinvolved. Centralized control and security management would also be to a reducedextent. Hence, the other options are not correct.17
DISA Review Questions, Answers Manual48.A KEY disadvantage of Decentralised Deployment Strategy isA.Less flexibility to cope with internal/external changesB.Potentially higher CAPEX requirementC.Slower system developmentD.Information systems could be mutually incompatibleKEY DJustificationA major disadvantage of decentralized deployment strategy is that, with de-centralizeddecision making, different tailor-made information systems may be created at differentlocations leading to potential incompatibility (Option D). On the other hand, given theirde-centralized structure, they would have greater flexibility to cope with changes andcan be developed/implemented quickly. Capex requirement could also be lesser owingability to carry out changes in phases. Hence, the other options are not correct.49.The IT components of a Core Banking Solution Data Centre would mainly dependuponA.Number of employees in the BankB.Type of services offered, risk management & control requirementsC.Annual Business volumeD.Nature of software applications usedKEY BJustificationThe complexity of services offered including the response time, risk managementobjectives and control goals would drive the IT components of a CBS Data Centre(
DISA Review Questions, Answers Manual 2 . C. Knowledge of financial aspects alone in a technology oriented function like IT will not facilitate effective auditing of the IT function D. A C.A. cannot be expected to have thorough knowledge of both financial & IT technology aspects . 3. People, the most import element of information systems, comprise
