Skip to content

CMA Final · Cost and Management Audit · Information Systems Security Audit

In an information systems security audit, which control is a preventive control rather than a detective or corrective one?

Requiring a unique user ID and password before access to the payroll module is a preventive control because it blocks unauthorised entry before it occurs. Log reviews and exception reports are detective, while restoring backups is corrective, as both act after an event.

  1. AReview of exception reports generated after batch processing
  2. BRestoring data from the latest backup after a system crash
  3. CRequiring a unique user ID and password before a user can access the payroll moduleCorrect
  4. DReviewing system logs weekly to find unauthorised access attempts

Explanation

A preventive control stops an unwanted event before it happens. Login credentials block unauthorised access in advance. Exception reports and log reviews detect events after they occur, and restoring from backup corrects damage after a failure.

Did you get it right without looking?

One question tells you little. A timed set on Information Systems Security Audit shows your real accuracy, how long you take and where you lose marks.

Practise Information Systems Security AuditFree diagnostic mock

More Information Systems Security Audit questions