Question 1

The CoBIT framework identifies seven information criteria; the FASB conceptual framework includes four qualitative characteristics of accounting information, as well as several assumptions, principles and constraints. Which of the following statements about them is most true?

Accepted Answer

The "reliability of information" criterion in CoBIT is most closely related to the primary qualitative characteristic of relevance in the FASB conceptual framework, which includes the secondary characteristic of reliability. Choice A is incorrect because the "confidentiality" criterion in CoBIT does not necessarily contradict the "full disclosure" principle in the FASB conceptual framework; they are two different criteria/principles that can coexist and be applied in different circumstances.

Question 2

Fill in the blanks below with appropriate terminology from CoBIT.
A. ______ auditors exchange information with one another to maintain strong corporate and IT governance.
B. ______ is directly responsible for choosing a public accounting firm to do external audits.
C. _______ holds IT and information security management accountable for value delivery, an element of IT governance.
D. __________ should provide information about risk management, an element of IT governance, to the board of directors.
E. Information about internal control flows two ways between the audit committee and ______.
F. Internal auditors exchange various kinds of information with corporate employees in ______.
G. Stakeholders rely on _____ for assurance about various forms of control.
H. The board of directors provides information about _____ to shareholders and employees.
I. Through the ___, external auditors interact with the corporate board of directors.j. Ultimately, ____ hold the board of directors accountable with respect to corporate governance.
A. internal and externalb. the audit committeec. the board of directorsd. information technology and information security managemente. external auditorsf. information technology and information security managementg. external auditorsh. financial a

Accepted Answer

The answer of Fill in the blanks below with appropriate...

Question 3

Based on the list provided in the text, indicate the type of computer criminal described in each of the following.
A. A young, inexperienced hacker who uses tools written by others for the purpose of attacking systems
b. Could seriously disrupt power grids, telecommunications and transportation
c. Hackers driven by financial gain
d. Recruit talented hackers to handle the technical aspects of crime
e. Someone who invades an information system for malicious purposes
f. Take advantage of networked systems by turning to computer intrusion techniques to gather the information they desire
g. The largest threat to a company's information systems

Accepted Answer

The answer of Based on the list provided in the...

Question 4

PCA Corporation maintains its fixed asset records in an Excel spreadsheet, as well as in its general ledger software. An internal auditor for PCA downloaded the Excel spreadsheet, then verified the information in it against both the general ledger software and the actual fixed assets in use. Which of the following statements is most true?

Accepted Answer

The internal auditor's actions help ensure the accuracy and completeness of PCA's fixed asset records, contributing to the integrity of its information. As long as the auditor is authorized to access and handle the confidential information, their actions do not conflict with the criterion of confidentiality. While internal auditors may not be the only form of internal control, they are a valuable tool for ensuring compliance and identifying areas for improvement. CoBIT is a control framework that guides the design and implementation of IT governance processes, but it is not a legal requirement for all organizations.

Question 5

An organization that uses the CoBIT framework to strengthen internal controls wants to improve the confidentiality of its information. Which of the following internal controls will best help achieve that goal?

Accepted Answer

Encryption is a process that transforms data into a secret code, which can only be decoded with the correct key. This is an effective way to protect the confidentiality of information, as unauthorized individuals cannot read or understand the encrypted data. The other options, such as security guards or using the COSO internal control framework, may also be useful for improving internal controls, but they do not specifically address the goal of improving confidentiality. Adherence to the steps in the systems development life cycle may help to ensure that security features are built into information systems, but it is not a specific internal control for improving confidentiality.

Question 6

List the elements of Carter's taxonomy of computer crime.

Accepted Answer

The answer of List the elements of Carter's taxonomy of...

Question 7

CoBIT can be used to strengthen internal controls against computer crime by:

Accepted Answer

CoBIT provides a framework for evaluating and improving internal controls over information technology. It includes seven information criteria that help ensure data is accurate, complete, valid, timely, secure, reliable, and accessible. Additionally, CoBIT assists in clarifying reporting relationships and responsibilities through an accountability framework. Therefore, both options A and B are true.

Question 8

The CoBIT framework can be used to strengthen internal controls against computer crime in various ways. Indicate whether each statement below is
(a) always true,
(b) sometimes true or
(c) never true.
a. As a form of internal control, each step of the systems development life cycle focuses on one of CoBIT's information criteria.
b. CoBIT can be used in conjunction with the COSO internal control framework to identify appropriate control activities.
c. CoBIT provides standards for evaluating information inputs and outputs that can help strengthen internal control.
d. The board of directors, as part of the CoBIT accountability framework, helps create a strong environment that values internal control and risk management.
e. The COSO enterprise risk management framework requires the use of CoBIT to identify risks.

Accepted Answer

The answer of The CoBIT framework can be used to...

Question 9

Jack conducted an Internet search for examples of computer crime that resulted in the items listed below. Which type of computer criminal is described in each? Be as specific as possible in your responses.
A. Boris and Natasha coordinated ten people who sent out e-mails asking the recipients to purchase fake lottery tickets.
B. Gil, an IT consultant for DMM Corporation, stole personal information about corporate executives and sold it to tabloid newspapers.
C. Marie, the chief information officer of RBC Corporation, planted a logic bomb in case she ever lost her job.
D. Timothy shut down traffic lights on a major street in his city in an effort to cause serious traffic accidents.
E. Zachary used a computer program he found on the Internet to "kill" characters in an online game.

Accepted Answer

The answer of Jack conducted an Internet search for examples...

Question 10

The CoBIT framework looks at the issue of internal control from three points of view. An organization's hardware and software configuration is most closely related to:

Accepted Answer

The CoBIT framework's three points of view are information, technology, and stakeholder. The hardware and software configuration is a part of information technology resources, which is one of the CoBIT framework's four domains. Therefore, the best answer is B.

Question 11

The CoBIT framework identifies seven information criteria; the FASB conceptual framework includes four qualitative characteristics of accounting information, as well as several assumptions, principles and constraints. Which of the following statements about them is most true?

Accepted Answer

The "effectiveness" criterion in CoBIT is related to the primary qualitative characteristic of "relevance" in the FASB conceptual framework, as both focus on the usefulness of information for decision-making.

Question 12

The chapter discussed the four elements of Carter's taxonomy of computer crime, eleven business risks / threats to information systems and seven common types of computer criminals. Classify each item below using each of them.

Accepted Answer

The answer of The chapter discussed the four elements of...

Question 13

Information technology controls can be classified as physical, technical or administrative. Consider each independent situation below; suggest one control from the indicated classification that would address (prevent / detect / correct) the risk.a) A bank's customer database is hacked.Administrative: _____________________________________________
b) A careless employee spills coffee on a network server.Physical: _____________________________________________
c) A corporation's sales data are manipulated by a member of the sales staff. Technical: _____________________________________________
d) A former employee introduces a logic bomb to a company's payroll system.Administrative: _____________________________________________
e) A political candidate's web site is defaced.Technical: _____________________________________________
f) A senior citizen sends money to a fake religious organization based on a fraudulent e-mail.Administrative: _____________________________________________
g) A waitress steals a customer's credit card number.Physical: _____________________________________________
h) An employee uses work time to shop online using the company's computer. Administrative: _____________________________________________
i) Corporate spies steal research and development information. Technical: _____________________________________________
j) Fake compromising photos of a corporate CEO are posted to a social networking site. Technical: _____________________________________________
A. regular security auditsb. encase the server in a cabinetc. system access logd. policy to remove employees from the system when they leave the companye. password rotationf. security trainingg. customers pay at the registerh. appropriate use poli

Accepted Answer

The answer of Information technology controls can be classified as...

Question 14

The CoBIT framework looks at the issue of internal control from three points of view. If NTS Corporation's strategic plan includes a statement about planned increases in sales, which of the following statements is most true?

Accepted Answer

The CoBIT framework looks at internal controls from three points of view: business objectives, IT resources, and IT processes. NTS Corporation's strategic plan includes a statement about planned increases in sales, which relates to the "business objective" point of view.

Question 15

The CoBIT framework identifies seven information criteria. In each example below, indicate one criterion that is met AND one that is not met in the space provided.

Accepted Answer

The answer of The CoBIT framework identifies seven information criteria....

Question 16

Which element of Carter's taxonomy of computer crime is associated with each item below?
A. Computer is not required for the crime but is related to the criminal act
b. Computer is used to commit the crime
c. Computer use may make a crime more difficult to trace
d. Growth of the Internet creates new ways of reaching victims
e. Objective is to impact the confidentiality, availability and / or integrity of data
f. Presence of computers has generated new versions of fairly traditional crimes
g. Targets the system or its data
h. Technological growth creates new crime targets
i. Use of the computer simplifies criminal actions
j. Uses the computer to further a criminal end

Accepted Answer

The answer of Which element of Carter's taxonomy of computer...

Question 17

The CoBIT framework is divided into four domains of knowledge. Suppose TPC Corporation uses the systems development life cycle for new IT projects. Which of the following statements is most true?

Accepted Answer

The systems development life cycle (SDLC) is a commonly used methodology for managing and developing IT projects. The CoBIT framework is divided into four domains of knowledge: Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate. The SDLC spans all four of these domains as it involves planning and organizing the project, acquiring and implementing necessary resources, delivering and supporting the end product or service, and evaluating and monitoring its performance. Therefore, statement B is the most true.

Question 18

The CoBIT framework is divided into four domains of knowledge; the text discussed three types of controls related to information security. Which of the following statements is most true?

Accepted Answer

The text states that in the "plan and organize" domain, all three types of controls (technical, administrative, and physical) should be considered by systems designers. Therefore, option A is the most true statement. Option B is incorrect because all three types of controls are relevant in all four domains, including "deliver and support". Option C is incorrect because administrative security controls are relevant in all four domains. Option D is incorrect because the "monitor and evaluate" domain involves monitoring the effectiveness of controls in all four domains, and making improvements if necessary.

Question 19

In each statement that follows, circle the business risk or threat that most clearly applies based on the list provided in the text.
A. Disclosure of confidential information or intrusion: Employee data are made available on the Internet.
B. DOS attacks or extortion: Prevent computer systems from functioning in accordance with their intended purpose.
C. Error or web site defacement: Digital graffiti
d. Fraud or error: Losses can vary widely depending on where the problem originated.
E. Information theft or information manipulation: An employee creates fake refunds to benefit a family member.
F. Intrusion or extortion: Main objective is to gain access to a network.
G. Intrusion or service interruption: Classified as accidental, willful neglect or malicious behavior.
H. Malicious software or information theft: Logic bombs, replicating worm, Trojan horse.
I. Service interruption or disclosure of confidential information: Can lead to missed deadlines for receivables or payables.j. Web site defacement or extortion: Criminal contacts an organization after successfully stealing information.

Accepted Answer

The answer of In each statement that follows, circle the...

Question 20

A denial-of-service attack prevents computer systems from functioning in accordance with their intended purpose. Thus, a denial-of-service attack is most closely related to which information criterion from the CoBIT framework?

Accepted Answer

A denial-of-service attack targets the availability of computer systems, making them unavailable to their intended users. Therefore, it is most closely related to the availability criterion in the CoBIT framework, which focuses on ensuring that information and technology resources are available when required by the business.

Quiz 11: Computer Crime and Information Technology Security

The CoBIT framework identifies seven information criteria; the FASB conceptual framework includes four qualitative characteristics of accounting information, as well as several assumptions, principles and constraints. Which of the following statements about them is most true?

An organization that uses the CoBIT framework to strengthen internal controls wants to improve the confidentiality of its information. Which of the following internal controls will best help achieve that goal?

List the elements of Carter's taxonomy of computer crime.

CoBIT can be used to strengthen internal controls against computer crime by:

The CoBIT framework looks at the issue of internal control from three points of view. An organization's hardware and software configuration is most closely related to:

The CoBIT framework identifies seven information criteria; the FASB conceptual framework includes four qualitative characteristics of accounting information, as well as several assumptions, principles and constraints. Which of the following statements about them is most true?

The chapter discussed the four elements of Carter's taxonomy of computer crime, eleven business risks / threats to information systems and seven common types of computer criminals. Classify each item below using each of them.

The CoBIT framework looks at the issue of internal control from three points of view. If NTS Corporation's strategic plan includes a statement about planned increases in sales, which of the following statements is most true?

The CoBIT framework identifies seven information criteria. In each example below, indicate one criterion that is met AND one that is not met in the space provided.

The CoBIT framework is divided into four domains of knowledge. Suppose TPC Corporation uses the systems development life cycle for new IT projects. Which of the following statements is most true?

The CoBIT framework is divided into four domains of knowledge; the text discussed three types of controls related to information security. Which of the following statements is most true?

A denial-of-service attack prevents computer systems from functioning in accordance with their intended purpose. Thus, a denial-of-service attack is most closely related to which information criterion from the CoBIT framework?