For those instances where individual users may Possible audit procedures to test backup

be granted summary and statistical query access transaction file: THE AUDITOR SHOULD…
to confidential data to which they normally are MASTER FILE
denied access, which type of control is most
Used in database systems to protect highly
suitable? INFERENCE CONTROLS (MC)
sensitive stored data making it difficult for the
Flat-file model eliminates data redundancy and intruder to read the stored data. ENCRYPTION
reduces data collection and storage costs. TRUE PROCEDURE

Provides an audit trail of all processed Users the logs and backup files to restart the
transactions. TRANSACTION LOG system after a failure. RECOVERY MODULE

Used to prevent users from inferring, through Database model centralized the organization’s
query features, specific data values that they data into a common database that is shared by
have no authority to access. INFERENCE other users. TRUE
CONTROLS
Backup controls are designed to prevent
Audit procedures for testing database access unauthorized individuals from viewing,
controls: ONLY 2 ARE CORRECT retrieving, corrupting, or destroying the entity’s
data. FALSE
User’s ability to obtain another information as
his needs change. TASK-DATA DEPENDENCY It promotes a single-user view approach to data
management whereby end users own their data
Replication of the same data in multiple files.
files rather than share them with other users.
DATA REDUNDANCY
FLAT-FILE ENVIRONMENT
Used to restrict employees who are sharing the
Subset of total database that defines the user’s
same computers to specific directories,
data domain and provides access to the
programs, and data files. MULTILEVEL
database. USER VIEW OR SUBSCHEMA
PASSOWRD
User-defined procedures contain rules that limit
Access privileges to the database should be
the actions a user can take. FALSE
commensurate with the user’s legitimate need.
TRUE ECHO CHECK- The receiver of the message returns
the message to the sender and the sender compares
As an audit procedure to test the database it with the original message.
backup controls, the auditor may verify that
backup is performed routinely and frequently to OPERATING SYSTEM SECURITY- Policies, procedures,
facilitate the recovery of lost data without and controls that determine who can access the
operating system, which resources they can use, and
excessive reprocessing. TRUE
what actions they can take.
Audit Objectives: Verify that backup procedures
No single user should obtain control of the operating
are in place to prevent data and program loss system. True
due to system failures and errors. Which of the
ff is the most appropriate audit procedure? THE In a pure electronic data interchange, authorizations,
AUDITOR COMPARES… OF BACKUP mutual obligations, and business practices that apply
to transactions are all specified under the trading
PROCEDURES
partner agreement. True
Audit procedures relating to access privileges, Encryption – conversion of data into secret code for
except. Verify… storage in databases & transmission over networks

IP spoofing – form of masquerading to gain – sender uses an encryption algorithm to

unauthorized access to a web server and/ perpetrate convert original message (called cleartext) into coded
unlawful act equivalent (called ciphertext)

Audit in passwords- its audit objectives is to verify System audit trails – logs that record activity at the
that effective management policies and procedures system, application & user level
are in place to prevent the introduction and spread
Audit procedures relating to subversive threats. 1,3,4
of destructive programs
Benefits of electric data interchange: All
Digital signatures prove that the message received
was not tampered during transmission and was To test authorization and validation controls of EDI,
being sent by the legitimate sender. True the auditor should determine that only authorized
employees an obtain access to the valid vendor file
Firewall – system of software & hardware that
or customer file. True
prevents unauthorized access to or from private
network Control log – one technique for restoring audit trail –
records the transaction’s flow thru each phase of EDI
If the user cannot provide the correct password, the
system
operating system should deny access. True
Keystroke Monitoring- Used to reconstruct the
Failure to change passwords regularly, post-it
details of an event or as a real-time control to
syndrome, possibility of forgetting the passwords are
prevent unauthorized intrusion
among the problems that may be encountered in
using passwords. True Deep packet inspection (DPI)- Searches the
individual packets for protocol noncompliance and
Request-response technique – control message from
employs predefined criteria to decide if a packet can
sender and response from receiver are sent at
proceed to its destination.
periodic, synchronized intervals

Distributed denial of service (DDoS)- Zombie –

called bot(robot) computers, virtual army that
perpetrator launch to attack.

If the company is using EDI, there is no need for the

Flat files are data files that contains record with
system to provide an audit trail. False no structured relationship to other files.

Password – secret code the user enters to gain Data storage efficient data management
access to systems, applications, data files, or a captures and stores data only once and makes
network server. this single source available to all users who need
it.
Access token – created if log-on attempt is
successful, it contains key info about the user (user Data updating requires periodic updating to
ID, password, user group, & privileges granted) reflect changes. Users keep separate and
- It contains key information about the user exclusive files.
and privileges granted.
Currency of information performing multiple
updates is the problem of failing to update all
users. If update is not properly disseminated
DATA MANAGEMENT SYSTEM is a special
software system that programmed to know
which data element each user is authorized to
access.

Access controls are designed to prevent

unauthorized individuals from viewing,
retrieving, corrupting, or destroying the entity’s
data.

Backup controls ensure that in the event of data

loss due to unauthorized access, equipment
failure, or physical disaster the org can recover
its database.

Database authorization table contains rules

that limit the actions a user can take.

User-defined procedures allows user to create a

personal security or routine to provide more
positive user ID than a single password.

Biometric devices which measure various

personal characteristics such as fingerprints

Positive compromise determines the specific

values of a data item

Negative compromise does not have a specific

value

Approximate compromise the user is unable to

determine the exact value of an item but is able
to estimate it with sufficient accuracy

Encryption controls verify sensitive data such as

passwords, are properly encrypted

Grandfather-father-son backup technique that

is used in sequential file batch system

Father or master file processed against the

transaction file to produce a new master file

Destructive replacement data values in direct

access are changed in place