Information Technology Audit MCQ

Information Technology Audit MCQ contain set of 10 Information Technology Audit MCQ questions with answers which will help you to clear beginner level quiz. In this Information Technology Audit online test, we will cover topics related to Information Technology Audit, information systems auditing, it auditing, it audit, what is it auditing, what is it, audit in it environment, it auditing process, auditing system, information system auditing, audit system, systems audit, types of it audits, computer system audit and so on.



1.      An audit charter should:

• 1. be dynamic and change often to coincide with the changing nature of technology and the audit profession.
  2. clearly state audit objectives for, and the delegation of, authority to the maintenance and review of internal controls.
  3. document the audit procedures designed to achieve the planned audit objectives.
  4. outline the overall authority, scope and responsibilities of the audit function.

2.      The extent to which data will be collected during an IS audit should be determined based on the:

• 1. viability of critical and required information.
  2. auditor’s familiarity with the circumstances.
  3. auditee’s ability to find relevant evidence.
  4. purpose and scope of the audit being done.

3.      Which of the following controls would provide the GREATEST assurance of database integrity?

• 1. Audit log procedures
  2. Table link/reference checks
  3. Query/table access time checks
  4. Rollback and rollforward database features

4.      Which of the following BEST ensures the integrity of a server’s operating system?

• 1. Protecting the server in a secure location
  2. Setting a boot password
  3. Hardening the server configuration
  4. Implementing activity logging

5.      During a review of a business continuity plan, an IS auditor noticed that the point at which a situation is declared to be a crisis has not been defined. The MAJOR risk associated with this is that:

• 1. assessment of the situation may be delayed
  2. execution of the disaster recovery plan could be impacted.
  3. notification of the teams might not occur.
  4. potential crisis recognition might be ineffective.

6.      Which of the following tests performed by an IS auditor would be the MOST effective in determining compliance with an organization’s change control procedures?

• 1. Review software migration records and verify approvals.
  2. Identify changes that have occurred and verify approvals.
  3. Review change control documentation and verify approvals.
  4. Ensure that only appropriate staff can migrate changes into production.

7.      When reviewing the IT strategic planning process, an IS auditor should ensure that the plan:

• 1. incorporates state of the art technology.
  2. addresses the required operational controls.
  3. articulates the IT mission and vision.
  4. specifies project management practices.

8.      An organization has recently installed a security patch, which crashed the production server. To minimize the probability of this occurring again, an IS auditor should:

• 1. apply the patch according to the patch’s release notes.
  2. ensure that a good change management process is in place.
  3. thoroughly test the patch before sending it to production.
  4. approve the patch after doing a risk assessment.

9.      An IS auditor selects a server for a penetration test that will be carried out by an expert. Which of the following is MOST important?

• 1. The tools used to conduct the test
  2. Certifications held by the IS auditor
  3. Permission from the data owner of the server
  4. An intrusion detection system (IDS) is enabled

10.  In a small organization, an employee performs computer operations and, when the situation demands, program modifications. Which of the following should the IS auditor recommend?

• 1. Automated logging of changes to development libraries
  2. Additional staff to provide separation of duties
  3. Procedures that verify that only approved program changes are implemented
  4. Access controls to prevent the operator from making program modifications

11.  When auditing the proposed acquisition of a new computer system, an IS auditor should FIRST establish that:

• 1. a clear business case has been approved by management.
  2. corporate security standards will be met.
  3. users will be involved in the implementation plan.
  4. the new system will meet all required user functionality.