English
Menu

IT Service Management and Systems Audit

Learn IT service management and systems audit with multiple-choice questions, including calculations: the approach of IT service management, SLAs and service level management, incident and problem management (workarounds and known errors), change and release management, configuration management (CMDB), the service desk and escalation, capacity management and availability calculations (MTBF and MTTR), business continuity plans (BCP), facilities such as UPS units and fire suppression, how a systems audit proceeds, audit trails and audit techniques, internal control and IT governance.

Practice 10 questionsRandom questions from this topic · about 5 minutes Practice this topicAll questions in this topic, in random order Weak questionsRetry only the questions you last got wrong

IT Service Management and Systems Audit: key points

A system is not finished once it has been built and switched on. It has to run stably every day at the quality agreed with its users; when a failure occurs, service must be restored quickly, the cause removed so that the same failure does not recur, and changes made only after their impact has been checked. A systems audit then checks, from an independent standpoint, whether these management mechanisms really work.

This topic covers SLAs and service level management, availability calculations that take service hours and planned maintenance into account, the difference between incident management and problem management, change, release and configuration management (CMDB), the service desk and escalation, capacity management and MTBF/MTTR calculations, business continuity plans (BCP), and facilities such as UPS units and fire suppression. The second half deals with the independence of systems auditors, how an audit proceeds from the preliminary survey and main audit to the audit report and follow-up, audit evidence and audit trails, audit techniques such as the test data and ITF methods, Japan's System Management Standards and System Audit Standards, the objectives and basic components of internal control, segregation of duties, and IT governance. It helps with the management sections (service management and systems audit) of IT certification exams such as Japan's Fundamental and Applied Information Technology Engineer Examinations. Project management is covered in "Software Development and Project Management", and backups, RPO and RTO in "System Architecture and Reliability".

All IT Service Management and Systems Audit questions (40)
  1. Which of the following describes the approach of IT service management appropriately?
  2. Which of the following is a document in which an IT service provider collects the list of IT services that users can choose and use, together with the description of each, its conditions of use, its standard service levels and how to request it or make inquiries?
  3. To achieve the service levels promised to users in an SLA, an IT service provider agrees with the network operations department and other departments within the same organization on the content and level of the work each is responsible for. Which of the following is this agreement?
  4. Which of the following is the most appropriate service level item to agree on with users in the SLA for a company's internal expense reimbursement system?
  5. Which of the following is an appropriate activity of service level management?
  6. The SLA for an internal system sets the service hours as 9:00 to 21:00 on weekdays (12 hours a day) and requires availability during service hours (the fraction of service hours during which the system was in operation) of at least 99.5%. Take a month as having 20 weekdays, and do not count outages outside service hours. Which of the following is the upper limit on the total outage time allowed within service hours in a month?
  7. The SLA for a cloud service defines monthly availability = (scheduled service time − outage time due to failures) ÷ scheduled service time, where the scheduled service time is the total time in the month minus the time of planned maintenance announced in advance. If the monthly availability is at least 99.9%, there is no refund; if it is at least 99.0% but below 99.9%, 10% of the monthly fee is refunded; and if it is below 99.0%, 30% is refunded. Take a month as 30 days. In one month there were 120 minutes of planned maintenance and a total of 40 minutes of outages due to failures. Which of the following is the refund rate for this month?
  8. Which of the following is an appropriate way to decide the priority for handling incidents?
  9. The service desk received a call from a user saying, "In the expense reimbursement system, the submit button does not respond when I attach an image of a receipt." The same symptom is registered as a known error, with the recorded workaround "the image can be submitted if it is first registered from a separate registration screen." Which of the following is the most appropriate action in incident management?
  10. Which of the following describes a "known error" in problem management appropriately?
  11. A file server stops responding with the same error several times a week, and each time an operations staff member restarts it to restore service. From the standpoint of problem management, which of the following is an appropriate action?
  12. Which of the following is an appropriate way to carry out change management?
  13. A serious security vulnerability has been found, and a patch must be applied to the production servers immediately. The regular meeting that reviews changes is two weeks away. Which of the following is the most appropriate response in change management?
  14. Several approved changes are bundled into a release and deployed to the production environment. Which of the following is an appropriate way to carry out release management?
  15. Which of the following describes a configuration item (CI) recorded in the CMDB (configuration management database) in configuration management appropriately?
  16. Which of the following is the main benefit of setting up a service desk as a single point of contact (SPOC) that receives all inquiries and failure reports from users?
  17. An incident received by a service desk staff member was about to exceed the resolution target time set in the SLA. The staff member reported the situation to the service desk manager and asked for a decision on adding staff and on contacting users. Which of the following is this action?
  18. Which of the following is an appropriate activity of capacity management?
  19. A storage system with a capacity of 10 TB currently holds 4 TB. Assume that usage grows every month by 5% of the previous month's usage (it grows like compound interest). After how many months will usage first reach 80% of capacity or more? Which of the following is the most appropriate?
  20. During 30 days (720 hours) of operation, a system failed 3 times, and the total outage time due to the failures was 6 hours. Which of the following is the MTBF (mean time between failures) calculated from the results for this period?
  21. A system has an MTBF (mean time between failures) of 500 hours, and the availability target in its SLA is at least 99.5%. Assuming the MTBF does not change and calculating availability = MTBF ÷ (MTBF + MTTR), which of the following is closest to the maximum MTTR (mean time to repair) that meets the target?
  22. Which of the following is an appropriate way to draw up a business continuity plan (BCP)?
  23. Which of the following describes a double-conversion (online) UPS (uninterruptible power supply) appropriately?
  24. Which of the following is an appropriate approach to fire suppression for the server rooms of a data center?
  25. Which of the following describes the purpose of a systems audit appropriately?
  26. From the standpoint of the independence of systems auditors, which of the following is the most appropriate person to audit a sales management system?
  27. Among the steps of a systems audit, which of the following is appropriately done in the preliminary survey?
  28. A systems auditor made improvement recommendations in an audit report. Which of the following is an appropriate follow-up afterward?
  29. A systems auditor is gathering audit evidence on whether the records of payments to business partners are correct. Which of the following is generally considered the audit evidence with the highest probative value?
  30. Which of the following describes an audit trail appropriately?
  31. Among the techniques of systems auditing, which of the following describes the test data method appropriately?
  32. Which audit technique sets up a fictitious customer account for audit purposes in a sales system and processes audit data against that account at the same time as normal business processing, in order to check the results?
  33. A systems auditor used generalized audit software to extract duplicated invoice numbers and transactions over the approval limit from a year's worth of transaction data (several million records) in a sales system. Which of the following is an appropriate advantage of using computer-assisted audit techniques (CAAT) in this way?
  34. In a systems audit, which of the following does the systems auditor mainly use as the yardstick for judging whether an organization's management of its information systems is appropriate?
  35. In the framework of Japan's internal control reporting system under the Financial Instruments and Exchange Act (J-SOX), which of the following is one of the four objectives of internal control?
  36. Among the basic components of internal control, which of the following describes the control environment appropriately?
  37. In internal control over purchasing, which of the following is an appropriate measure in line with segregation of duties?
  38. Which of the following describes IT governance appropriately?
  39. Monitoring, a basic component of internal control, consists of ongoing monitoring and independent evaluations. Which of the following is an independent evaluation?
  40. Within the "response to IT" in internal control, which of the following is an IT general control?

Books on IT Service Management and Systems Audit Ad

As an Amazon Associate I earn from qualifying purchases.

Other topics in Computer systems