CGA CGA Information Technology & Systems 2 — Questions and Answers
Question 1: Which cloud computing model delivers software applications over the internet on a subscription basis?
- Infrastructure as a Service (IaaS)
- Platform as a Service (PaaS)
- Software as a Service (SaaS) (Correct answer)
- Database as a Service (DBaaS)
Correct answer: Software as a Service (SaaS)
SaaS delivers fully functional applications via the internet, eliminating the need for local installation and maintenance.
Question 2: What is the primary purpose of an IT disaster recovery plan (DRP)?
- To prevent all system outages
- To restore IT systems and data after a disruptive event (Correct answer)
- To test cybersecurity defenses quarterly
- To document all software licenses
Correct answer: To restore IT systems and data after a disruptive event
A DRP specifies procedures to restore IT infrastructure, systems, and data to operational status following a disaster or major failure.
Question 3: Which of the following is an example of a detective IT control?
- Input validation that rejects invalid data entries
- Firewall blocking unauthorized network access
- System log review that identifies unusual access patterns (Correct answer)
- User authentication requiring strong passwords
Correct answer: System log review that identifies unusual access patterns
Log reviews detect problems that have already occurred, making them detective controls rather than preventive ones.
Question 4: In the context of IT governance, the COBIT framework primarily helps organizations:
- Develop software applications faster
- Align IT strategy with business objectives and manage IT risks (Correct answer)
- Encrypt all data transmissions
- Migrate data to cloud platforms
Correct answer: Align IT strategy with business objectives and manage IT risks
COBIT (Control Objectives for Information and Related Technologies) provides a framework for IT governance, aligning technology with business goals and managing IT-related risks.
Question 5: When auditing through the computer, the auditor:
- Avoids using the client's computer systems entirely
- Tests the application controls and logic within the computer system (Correct answer)
- Only reviews printed output from the system
- Relies exclusively on management's IT reports
Correct answer: Tests the application controls and logic within the computer system
Auditing through the computer involves testing the actual processing logic and controls within the system, rather than just relying on system output.
Question 6: Which control prevents a programmer from making unauthorized changes to live production code?
- Password complexity requirements
- Change management and version control procedures (Correct answer)
- Data encryption at rest
- Regular virus scanning
Correct answer: Change management and version control procedures
Change management procedures require formal approval, testing, and documentation before code changes are moved to production, preventing unauthorized modifications.
CGA CGA Information Technology & Systems 2
Which cloud computing model delivers software applications over the internet on a subscription basis?