Soal 1

Tipe 1
An IS auditor is evaluating data mining and
auditing software to be used in future IS
audits. What is the PRIMARY ability that the
IS auditor should look for in the software
tool? The software tool should
a)Interface with various types of enterprise
resource planning (ERP) software and
databases
b)Preserve data integrity and not modify
source data in any way
c)Introduce audit hooks into the company's
financial systems to support continuous
auditing
d)Be customizable and support inclusion of
custom programming to aid in
investigative analysis
Tipe 2
Which of the following represents
an example of a preventive control
with respect to IT personnel?
a)review of visitor logs for the
data center
b)A log server which track logon
IP addreses of users
c)Implementation of a badge
entry system for the IT facility
d)An accounting system which
tracks employee telephone
calls
 Soal 2
Tipe 1
Management instructs a junior IS
auditor to prepare and deliver a final
report using his/her best judgment
since no senior IS auditor is available:
a)The loss of reputation because
the audit was not performed
according to standards
b)The audit report fails to identify
and classify critical risks
c)Client management will challenge
the findings
d)The audit report may not be
approved by audit management
Tipe 2
When performance issues are
discovered during an assessment
of the organization's network, the
MOST efficient way for the IS
auditor to proceed is to examine
the:
a)anti virus controls that have
been put in place
b)protocols used on the network
c)network topology
d)configuration of network
devices
 Soal 3
Tipe 1
An IS auditor is reviewing the process
performed for the protection of digital
evidence. Which of the following findings
should present the MOST concern to the
IS auditor?
a)The owner of the system was not
present at the time of evidence
retrieval
b)The system was powered off by an
investigator
c)There are no documented logs of the
transportation of evidence
d)The contents of the random access
memory (RAM) were not backed up
Tipe 2
The internal audit department of organization has been
developed and maintained ACL scripts for continuous
auditing purposes. These scripts were provided to IT
management for continuous monitoring purposes. This
situation resulted in a potential conflict related to the
auditor's independence and objectivity. Which of the
following actions would BEST resolve this issue?
a)The internal audit team should stop sharing the scripts
so that IT management mus developed its own scrips
b)Since continuous monitoring & continuous auditing are
similar function. IT management should assign the
continuous monitoring task to the internal audit
department
c)IT management should continue to use the scripts for
continuous monitoring purposes with the
understanding that it is responsible for testing and
maintaining the scripts that it uses
d)The internal audit team should review the areas where
these scripts are being used and reduce the audit
scope and frequency for those areas
 Soal 4
Tipe 1
Which of the following is the most
significant risk of changing from using a
traditional audit approach to a facilitated
control self-assessment (FCSA)
workshop approach without adequate
planning and preparation?
a)FCSA workshops may not provide
enough independence
b)The audit work will not be completed
on time
c)Critical risk issues may not be
identified by the process
d)The final report will not be able to be
released to senior management
Tipe 2
In a risk based audit approach, the IS
auditor must consider the inherent risk
as well as considering:
a)how to eliminate the risk through
the application of controls
b)the balance of loss potential Vs.
the cost to implement controls
c)whether the risk is material
regardless of management's
tolerance for risk
d)whether the residual risk is higher
than the insurance coverage
purchased
 Soal 5
Tipe 1
An IS auditor is developing an audit plan for a repeat
client. The auditor reviews the prior year audit plan
and finds that the previous plan was designed to
review the company network and e-mail systems,
which were newly implemented last year, but the plan
did not include reviewing the e-commerce web
server. The company IT manager indicates that this
year the organization prefers to focus the audit on a
newly-implemented enterprise resource planning
(ERP) application. How should the IS auditor
respond?
a)Audit the new ERP application as requested by
the IT manager
b)Audit the e-commerce server since it was not
audited last year
c)Determine the highest-risk systems and plan the
audit based on the results
d)Audit both the e-commerce server and the ERP
application
Tipe 2
An IS auditor has been asked to review the security
controls for a critical web-based order system shortly
before the scheduled go-live date. The auditor conducts
a penetration test which produces inconclusive results
and additional testing cannot be concluded by the
completion date agreed for the audit. Which of the
following is the BEST option for the auditor?
a)Publish a report based on the available information,
highlighting the potential security weaknesses and
the requirement for the follow-up audit testing
b)Publish a report omitting the areas where the
evidence obtained from testing was inconclusive
c)Request a delay of the go-live date until additional
security testing can be completed and evidence of
appropriate controls can be obtained
d)Inform management that audit work cannot be
completed within the agreed time frame and
recommend that the audit be postponed
 Soal 6
An IS auditor has been asked to review the security
controls for a critical web-based order system shortly
before the scheduled go-live date. The auditor conducts
a penetration test which produces inconclusive results
and additional testing cannot be concluded by the
completion date agreed for the audit. Which of the
following is the BEST option for the auditor?
a)Publish a report based on the available information,
highlighting the potential security weaknesses and
the requirement for the follow-up audit testing
b)Publish a report omitting the areas where the
evidence obtained from testing was inconclusive
c)Request a delay of the go-live date until additional
security testing can be completed and evidence of
appropriate controls can be obtained
d)Inform management that audit work cannot be
completed within the agreed time frame and
recommend that the audit be postponed
An IS auditor is developing an audit plan for a repeat
client. The auditor reviews the prior year audit plan
and finds that the previous plan was designed to
review the company network and e-mail systems,
which were newly implemented last year, but the plan
did not include reviewing the e-commerce web
server. The company IT manager indicates that this
year the organization prefers to focus the audit on a
newly-implemented enterprise resource planning
(ERP) application. How should the IS auditor
respond?
a)Audit the new ERP application as requested by
the IT manager
b)Audit the e-commerce server since it was not
audited last year
c)Determine the highest-risk systems and plan the
audit based on the results
d)Audit both the e-commerce server and the ERP
application
 Soal 7
Tipe 1 Tipe 2

In a risk based audit approach, the IS Which of the following is the most
auditor must consider the inherent risk significant risk of changing from using a
as well as considering: traditional audit approach to a facilitated
control self-assessment (FCSA)
a)how to eliminate the risk through workshop approach without adequate
the application of controls planning and preparation?
b)the balance of loss potential Vs. a)FCSA workshops may not provide
the cost to implement controls enough independence
c)whether the risk is material b)The audit work will not be completed
regardless of management's on time
tolerance for risk c)Critical risk issues may not be
d)whether the residual risk is higher identified by the process
than the insurance coverage d)The final report will not be able to be
purchased released to senior management
 Soal 8
Tipe 1
The internal audit department of organization has been
developed and maintained ACL scripts for continuous
auditing purposes. These scripts were provided to IT
management for continuous monitoring purposes. This
situation resulted in a potential conflict related to the
auditor's independence and objectivity. Which of the
following actions would BEST resolve this issue?
a)The internal audit team should stop sharing the scripts
so that IT management mus developed its own scrips
b)Since continuous monitoring & continuous auditing are
similar function. IT management should assign the
continuous monitoring task to the internal audit
department
c)IT management should continue to use the scripts for
continuous monitoring purposes with the
understanding that it is responsible for testing and
maintaining the scripts that it uses
d)The internal audit team should review the areas where
these scripts are being used and reduce the audit
scope and frequency for those areas
Tipe 2
An IS auditor is reviewing the process
performed for the protection of digital
evidence. Which of the following findings
should present the MOST concern to the
IS auditor?
a)The owner of the system was not
present at the time of evidence
retrieval
b)The system was powered off by an
investigator
c)There are no documented logs of the
transportation of evidence
d)The contents of the random access
memory (RAM) were not backed up
 Soal 9
Tipe 1
When performance issues are
discovered during an assessment
of the organization's network, the
MOST efficient way for the IS
auditor to proceed is to examine
the:
a)anti virus controls that have
been put in place
b)protocols used on the network
c)network topology
d)configuration of network
devices
Tipe 2
Management instructs a junior IS
auditor to prepare and deliver a final
report using his/her best judgment
since no senior IS auditor is available:
a)The loss of reputation because
the audit was not performed
according to standards
b)The audit report fails to identify
and classify critical risks
c)Client management will challenge
the findings
d)The audit report may not be
approved by audit management
 Soal 10
Tipe 1
Which of the following represents
an example of a preventive control
with respect to IT personnel?
a)review of visitor logs for the
data center
b)A log server which track logon
IP addreses of users
c)Implementation of a badge
entry system for the IT facility
d)An accounting system which
tracks employee telephone
calls
Tipe 2
An IS auditor is evaluating data mining and
auditing software to be used in future IS
audits. What is the PRIMARY ability that the
IS auditor should look for in the software
tool? The software tool should
a)Interface with various types of enterprise
resource planning (ERP) software and
databases
b)Preserve data integrity and not modify
source data in any way
c)Introduce audit hooks into the company's
financial systems to support continuous
auditing
d)Be customizable and support inclusion of
custom programming to aid in
investigative analysis