第1題：

When performing a database review, an IS auditor notices that some tables in the database are not normalized. The IS auditor should next:

A、recommend that the database be normalized.

B、review the conceptual data model.

C、review the stored procedures.

D、review the justification.

信管網(wǎng)參考答案：D

信管網(wǎng)參考解析：當(dāng)執(zhí)行數(shù)據(jù)庫(kù)檢查時(shí)，信息系統(tǒng)審計(jì)師注意到數(shù)據(jù)庫(kù)里的有些表沒(méi)有規(guī)格化。信息系統(tǒng)審計(jì)師接下來(lái)應(yīng)該：

A、推薦配置數(shù)據(jù)規(guī)格

B、檢查數(shù)據(jù)概念模型

C、檢查存儲(chǔ)過(guò)程

D、檢查說(shuō)明文件

注意：如果數(shù)據(jù)庫(kù)不規(guī)范，該審計(jì)師審查的理由，因?yàn)椋谀承┣闆r下，非規(guī)范化的推薦性能的原因。審核員不建議在進(jìn)行進(jìn)一步調(diào)查之前規(guī)范數(shù)據(jù)庫(kù)。查看概念數(shù)據(jù)模型或存儲(chǔ)過(guò)程將無(wú)法提供有關(guān)正?；男畔?。

第2題：

The potential for unauthorized system access by way of terminals or workstations within an organization's facility is increased when:

A、connecting points are available in the facility to connect laptops to the network.

B、users take precautions to keep their passwords confidential.

C、terminals with password protection are located in insecure locations.

D、terminals are located within the facility in small clusters under the supervision of an administrator.

信管網(wǎng)參考答案：A

信管網(wǎng)參考解析：使用企業(yè)內(nèi)的終端或工作臺(tái)會(huì)增加非授權(quán)訪問(wèn)的可能，當(dāng)：

A.連接點(diǎn)可以使筆記本電腦連接到網(wǎng)絡(luò)

B.用戶謹(jǐn)慎地保密他們的密碼

C.放在不安全地方的終端有密碼保護(hù)

D.在管理員的監(jiān)控下，終端放置小群集環(huán)境中

注：任何人有錯(cuò)誤的意圖可以連接筆記本電腦的網(wǎng)絡(luò)。不安全的連接點(diǎn)使未經(jīng)授權(quán)的訪問(wèn)可能，如果個(gè)人有一個(gè)有效的用戶ID和密碼的知識(shí)。其他選擇是防止未經(jīng)授權(quán)的網(wǎng)絡(luò)訪問(wèn)控制。如果系統(tǒng)密碼不容易獲得入侵者使用，他們必須猜測(cè)，引入一個(gè)額外的因素，需要時(shí)間。系統(tǒng)密碼提供保護(hù)，防止未經(jīng)授權(quán)的終端位于不安全的位置。監(jiān)督是一個(gè)非常有效的控制時(shí)，用來(lái)監(jiān)視訪問(wèn)一個(gè)小的操作單元或生產(chǎn)資源。