第1題：

In reviewing the IS short-range (tactical) plan, an IS auditor should determine whether:

A、there is an integration of IS and business staffs within projects.

B、there is a clear definition of the IS mission and vision.

C、a strategic information technology planning methodology is in place.

D、the plan correlates business objectives to IS goals and objectives.

信管網(wǎng)參考答案：A

查看解析：在審查信息系統(tǒng)短期（戰(zhàn)術(shù)性）計(jì)劃時(shí)，一個(gè)信息系統(tǒng)審計(jì)師應(yīng)該確定是否：

A、計(jì)劃中包含了信息系統(tǒng)和業(yè)務(wù)員工

B、明確定義了信息系統(tǒng)的任務(wù)與遠(yuǎn)景

C、有一套戰(zhàn)略性的信息技術(shù)計(jì)劃方法

D、該計(jì)劃將企業(yè)目標(biāo)與信息系統(tǒng)目標(biāo)聯(lián)系起來

說明：項(xiàng)目中的業(yè)務(wù)人員和業(yè)務(wù)人員的整合是一個(gè)操作問題，在審查短程計(jì)劃時(shí)應(yīng)考慮。戰(zhàn)略計(jì)劃將為短程計(jì)劃提供一個(gè)框架。選擇B，C和D是一個(gè)戰(zhàn)略計(jì)劃所涵蓋的領(lǐng)域。

第2題：

If inadequate, which of the following would be the MOST likely contributor to a denial-of-service attack?

A、Router configuration and rules

B、Design of the internal network

C、Updates to the router system software

D、Audit testing and review techniques

信管網(wǎng)參考答案：A

查看解析：如果使用不恰當(dāng)，下列哪個(gè)將是最可能的引起拒絕服務(wù)攻擊呢？

A、路由配置和規(guī)則

B、設(shè)計(jì)內(nèi)部網(wǎng)絡(luò)

C、升級(jí)路由器系統(tǒng)軟件

D、審計(jì)測(cè)試和審查技術(shù)

注釋：不恰當(dāng)?shù)穆酚膳渲煤鸵?guī)則將導(dǎo)致拒絕服務(wù)攻擊。選項(xiàng)B和C不如A。選項(xiàng)D是不正確的，因?yàn)閷徲?jì)測(cè)試和審查技術(shù)是事后應(yīng)用。