- (Exam Topic 4)
Users are complaining that a newly released enterprise resource planning (ERP) system is functioning too slowly. Which of the following tests during the quality assurance (QA) phase would have identified this concern?

1. A. Stress
2. B. Regression
3. C. Interface
4. D. Integration

Correct Answer: A
Stress testing is a type of QA testing that is designed to evaluate how a system responds to high load. This type of testing would have identified any performance issues with the ERP system, such as slow response times, before it was released. Other types of testing that may have identified this issue are load testing, performance testing, and volume testing.

- (Exam Topic 1)
Management is concerned about sensitive information being intentionally or unintentionally emailed as attachments outside the organization by employees. What is the MOST important task before implementing any associated email controls?

1. A. Require all employees to sign nondisclosure agreements (NDAs).
2. B. Develop an acceptable use policy for end-user computing (EUC).
3. C. Develop an information classification scheme.
4. D. Provide notification to employees about possible email monitoring.

Correct Answer: A

- (Exam Topic 2)
When auditing the alignment of IT to the business strategy, it is MOST Important for the IS auditor to:

1. A. compare the organization's strategic plan against industry best practice.
2. B. interview senior managers for their opinion of the IT function.
3. C. ensure an IT steering committee is appointed to monitor new IT projects.
4. D. evaluate deliverables of new IT initiatives against planned business services.

Correct Answer: D

- (Exam Topic 1)
Which of the following components of a risk assessment is MOST helpful to management in determining the level of risk mitigation to apply?

1. A. Risk identification
2. B. Risk classification
3. C. Control self-assessment (CSA)
4. D. Impact assessment

Correct Answer: D

- (Exam Topic 2)
Which of the following is the BEST source of information tor an IS auditor to use when determining whether an organization's information security policy is adequate?

1. A. Information security program plans
2. B. Penetration test results
3. C. Risk assessment results
4. D. Industry benchmarks

Correct Answer: C