SOX Security School Final Exam

Are you ready for your next SOX audit? Take this Final Exam to see how much you've learned about SOX compliance and whether you need to revisit SOX Security School.

How to take this exam
Click the radio button of your answer choice. At the end of the exam, click the "Check Answers" box for your score. Any questions answered incorrectly will turn red. For an explanation of each answer, check the "See Answer Explanations" box at the end of the exam.

1. What organization is responsible for the internal control framework required by SOX?

The Securities and Exchange Commission
AICPA
Committee of Sponsoring Organizations
FDIC

2. What standard, referred to by the recommended internal control framework, provides goals for organizing and planning all of IT?

ISO17799
COBIT
The Common Criteria
Draft FIPS Publication 200

3. What is the main purpose of ISO17799?

A policy template for complying with COBIT
A plan for securing your enterprise
A code of practice for security
A guide for SOX compliance

4. What is one of the most common mistakes in SOX compliance projects that leads to unnecessarily increased cost?

Deployment of hardware authentication
Perimeter security enhancements
Increased log review
Expansion of project scope beyond those required for SOX compliance

5. What is the minimum acceptable level of maturity of a given practice to pass a SOX audit (at this time)?

Initial-ad hoc
Repeatable but intuitive
Defined process
Managed and measurable

6. What statement most accurately describes COBIT's applicability to SOX?

All COBIT control objectives are important to SOX compliance
Only the Monitoring objectives are critical
Only the Delivery and Support control objectives are important
Important control objectives are spread throughout the standard in every section

7. What fundamental concept underlies many of the controls required by SOX?

Independence of business and technical organizations
Importance of perimeter controls
Transparency and accountability
Preventative technical controls are favored over compensating business controls

8. Of the following, what set of factors should drive an organization's security focus for SOX compliance?

Common Web vulnerabilities and the risk of compromise of external sites
Denial-of-service attacks and mechanisms to prevent them
Authentication strength across the enterprise
Risk of impact on key business systems that affect financial reporting

9. Why is information classification an important part of building an effective SOX compliance solution?

It identifies the critical parties who should be involved in determining what and how resources should be secured
It dictates the technical controls necessary to protect data
It documents the types of attacks that could damage the corporation
All of the above

10. What aspect of identity management is critical to SOX compliance?

Proper notification and approval of account creation and change
Appropriate separation of duties for requests, approvals and administration
Support for rich reporting of account maintenance and access control changes
All of the above

11. Who should be responsible for reviewing and auditing logs associated with account creation and use of financial systems?

Business users of the system or application
Administrators of the system or application
An auditor or system administrator with no business or technical interest in the system
Exclusively a non-employee of the corporation

12. Of the tasks listed, what critical aspect of identity management is facilitated most by centralized identity management products?

Analysis of necessary approvals and workflow
Creation and deletion of accounts
Regular review and documentation of privileges
Ensuring appropriate separation of duties

13. Who should be involved in approving access to systems and applications?

The system administrator or custodian
The business owner
The proposed user's supervisor
All of the above

14. Which answer best describes why change control is an important part of SOX compliance?

It provides useful information regarding how in-house developed applications have been modified
It helps to control who makes changes to network device configurations
It provides an accurate picture of the current state of the SOX environment and the actions that were taken to create that state
It allows auditors to review application use

15. What parts of a corporate environment need to be kept under change control?

Identity management
Network device configuration
System and application configuration
All of the above

16. What strategy does SOX Security School recommend in achieving SOX compliance?

Apply general security principles enterprise-wide to ensure compliance
Organize compliance efforts by department to allow maximum parallelism
Establish a clear security policy and require compliance according to an aggressive schedule
Work top down, concentrating on policies and practices affecting financial reporting

17. Of the following, which would be considered a Material Weakness and lead to an audit failure?

An administrator was allowed to both create and approve users for a given application (insufficient separation of duties)
Insufficient documentation that an application audit occurred
Fraud was detected by external auditors and not internal auditors
None of the above

18. What part of SOX compliance do most companies fall short on?

Identity management
Access control
Change control
Documentation

19. Is vulnerability management important to SOX compliance? Why or why not?

No. Internal systems are protected from hackers by perimeter firewalls.
Yes. Understanding the vulnerabilities of all systems helps organizations assess and address risks of compromise of SOX critical systems.
Yes. Vulnerability management, consisting of scans and patch application, is all that is necessary to protect systems from compromise.
No. Vulnerabilities cannot affect the integrity of financial reporting.

20. Of those listed, which tools have proven most useful in SOX compliance projects?

Code review tools
Security policy templates
Vulnerability scanners
Web portals


	Home > Security All-in-One Guides > Compliance > SOX School > Lesson 3: Understanding compliance-related technology > SOX Security School Final Exam