ACCT 307 Chapter 12 Multiple Choice Questions

Authentication is the process by which the

system verifies the identity of the user.

Data processing activities may be classified in terms of three stages or processes: input, processing, and output. An activity that is not normally associated with the input stage is

reporting

To ensure confidentiality in an asymmetric-key encryption system, knowledge of which of the following keys is required to decrypt the received message

private key

To authenticate the message sender in an asymmetric-key encryption system, which of the following keys is required to decrypt the received message

Sender's public key

To ensure the data sent over the internet are protected, which of the following keys is required to encrypt the data (before transmission using an asymmetric-key encryption method?

Receiver's private key

Which of the following groups/laws was the earliest to encourage auditors to incorporate fraud examination to audit programs

SAS No.99

Incentive to commit fraud usually will include all of the following, except

inadequate segregation of duties.

An information technology director collected the names and locations of key vendors, current hardware configuration, names of team members, and an alternative processing location. What is the director most likely preparing

Disaster recovery plan

A message digest is the result of hashing. Which of the following statements about the hashing process is true?

Hashing is the best approach to make sure that two files are identical.

Which one of the following vulnerabilities would create the most serious risk to a firm

Unauthorized access to the firm's network.

Which of the following statements is correct

Fault tolerance uses redundant units to provide a system with the ability to continue functioning when part of the system fails.

Which of the following can be considered as a good alternative to back up data and applications

Cloud computing

A digital certificate

Indicates that the subscriber identified has sole control and access to the private key.

The symmetric-key encryption method

uses the same key for both senders and receivers for encryption and decryption.

The fraud triangle indicates which of the following condition(s) exist for a fraud to be perpetrated

Rationalization and Pressure

To prevent repudiation in conducting e-business, companies must be able to authenticate their trading partners. Which of the following encryption methods can be used for authentication purposes

Asymmetric-key encryption method

Regarding GDRP, which of the following statements is/are correct

It is a regulation enforced by EU and it is to protect EU citizens' personal data.

Which organization created the Reporting on an Entity’s Cybersecurity Risk Management Program and Controls: Attestation Guide in 2017

AICPA

Business continuity management is a

Two of these options are correct.

Encryption is a

Preventive Control

What is fault tolerance

Using redundant units to continue functioning when a system is failing.

Comparing encryption with hashing

encryption results are called cypher text.

Disaster recovery plan is a

corrective control.

Select a correct statement describing encryption or hashing process

Encryption process is reversible.
Hashing results are called message digests.
Hashing process could be used to obtain a digital signature.
Symmetric-key encryption process is to maintain confidentiality.

Select a correct statement regarding encryption methods

Asymmetric-key encryption method is used to create digital signatures.

Why would a company need a SOC report

The external auditor needs to know the effectiveness of internal controls of the company's service provider(s).

The company wants to use it for marketing purposes.

It could be require by a government agency to provide a SOC report.

Which of the following statements regarding SOC is correct

Type 1 reports are for a specific date.

Which of the following frameworks could be used for SOC cybersecurity

Two of these options are correct.

Using an uninterruptible power supply is a

preventive control.

Implementing a redundant array of independent devices (RAID) is a preventive control

false