The CISA Prep Guide: Mastering the Certified Information Systems Auditor Exam

I. Ensure that the dial-in numbers enabling toll-free outbound access are turned off.
II. Ensure that voicemail systems do not enable access to phone lines through hijacking.
III. Ensure that the access codes for the maintenance ports have been changed from the default.
IV. Ensure that outbound toll numbers, such as 900 numbers, are restricted.
V. Ensure that excessive phone usage is flagged and investigated for fraud.

Answer 1: I, II, III, and IV only
Answer 2: II, III, and IV only
Answer 3: II, III, IV, and V only
Answer 4: I, II, III, IV, and V

Explanation: The correct answer is C. All of these answers except (I) are necessary activities for a PBX review. Voice mail systems (II) need to be contained to voice mail traffic only and the ability to use these access points to the system to get a dial tone should be controlled and not allow hijacking to occur. Access codes for maintenance ports (III) should be strictly controlled and not only changed from their vendor given defaults but changed periodically. 900 numbers and other outbound toll scenarios (IV) should be controlled, and the business decisions should support any allowance for these costs to be incurred. Any excessive call tolls (V) outside of a predetermined boundary should be immediately flagged as potentially fraudulent and investigated if not shut down until an investigation can occur. The ability of obtaining an outbound toll-free line from a dial in number (I) is a business decision and may be turned off, but that is a risk and business decision that should be made by management not the IS auditor. The audit should verify that this is a conscious decision of the business, however.

Errata: The 900 numbers referred to in Selection IV are 1-900 numbers that are charged calls, not free and does not refer to 900 numbers without the 1- prefix which includes the 911 (emergency) number. Those would not be restricted.

I. Systems Design
II. Feasibility Analysis
III. Systems Testing and Acceptance
IV. Systems Specification Documentation
V. Functional Requirements Definition
VI. Systems Development

What is the natural order of the processes in an SDLC methodology?

Answer 1: V, IV, II, I, VI, III
Answer 2: V, II, IV, I, VI, III
Answer 3: II, IV, V, VI, I, III
Answer 4: II, V, I, VI, III, IV

Explanation: The correct answer is A. Classic Systems Development Life Cycle (SDLC) methodologies begin by understanding the business or functional requirements and then a feasibility analysis is performed on the solution options. Systems specifications then are further defined based on the accepted solution and approach from which a design is created. That design is developed into an application and that application is tested and finally accepted by the business.
Errata: The correct answer should be B, not A.