Test your basic knowledge |

CISA: Certified Information Systems Auditor

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A quantitative risk analysis is __________________ because: It is difficult to get accurate figures on the frequency of specific threats. It is difficult to determine the probability that a threat will be realized. It is relatively easy to determine






2. The risk that an IS auditor will overlook errors or exceptions during an audit.






3. Concerned with electrical and physical specifications for devices. No frames or packets involved.






4. Who is responsible for imposing an IT governance model encompassing IT strategy - information security - and formal enterprise architectural mandates?






5. A technique that is used to select a portion of a population when it is not feasible to test an entire population.






6. (1.) Develop a BC Policy (2.) Conduct BIA (3.) Perform critical analysis (4.) Establish recovery targets (5.) Develop recovery and continuity strategies and plans (6.) Test recovery and continuity plans and procedures Train personnel Maintain strateg






7. (1.) Objectives (2.) Components (3.) Business Units / Areas






8. A sampling technique where items are chosen based upon the auditor's judgment - usually based on risk or materiality.






9. What three elements allow validation of business practices against acceptable measures of regulatory compliance - performance - and standard operational guidelines.






10. An audit that combines an operational audit and a financial audit.






11. The purpose of an auditor doing interviews - To observe personnel to better understand their discipline - as well as ______________.






12. Individual events may often create combined threats to enterprise operations: A tornado might also spawn ____________________.






13. Defines internal controls and provides guidance for assessing and improving internal control systems.






14. An audit of an IS department's operations and systems.






15. Guide program execution through organization of resources and development of clear project objectives.






16. A condition often identified as a result of multiple incidents that exhibit common symptoms. Problems can also be identified from a single significant incident for which the impact is significant.






17. The IS auditor should conduct a risk assessment first to determine which areas have highest risk. She should devote more testing resources to those high-risk areas.






18. What activity involves the identification of potential risk and the appropriate response for each threat based on impact assessment using qualitative and/or quantitative measures for an enterprise-wide risk management strategy?






19. (1.) Hardware Complement (physical specifications) (2.) Hardware Configuration (firmware settings) (3.) Operating system version and configuration (4.) Software versions and configuration






20. Use of a set of monitoring and review activities that confirm whether IS operations is providing service to its customers.






21. An organization is building a data center in an area frequented by power outages. The organization cannot tolerate power outages. The best _________________solution is an electric generator and an uninterruptible power supply. The UPS responds to the






22. Change Management includes a _____________ of six steps: (1.) Proposal or Request (2.) Review (3.) Approval (4.) Implementation (5.) Verification (6.) Post-change Review






23. An audit to determine the level and degree of compliance to a law - regulation - standard - contract provision - or internal control.






24. PERT: shows the ______________ critical path.






25. 1.) Executive Support (2.) Well-defined roles and responsibilities.






26. What type of testing is performed to determine if control procedures have proper design and are operating properly?






27. Disasters are generally grouped in terms of type: ______________.






28. A sampling technique where at least one exception is sought in a population






29. IT Service Management is defined in ___________________ framework.






30. Lowest layer. Delivers messages (frames) from one station to another vial local network.






31. A condition that is the result of multiple incidents that exhibit common symptoms e.g. A web application is displaying information incorrectly and many users have contacted the IT service desk.






32. Consists of main chassis component that is equipped with slots are fitted with individual cpu modules. Main advantage is lower cost per unit.






33. An auditor is examining a key management process and has found that the IT department is not following its split-custody procedure. As a result - Someone may be in possession of the _________________.






34. The inventory of all in-scope business processes and systems






35. The portion of IT management that tracks the financial value of IT services that support organizational objectives. It includes 4 activities: (1.) Budgeting (2.) Capital Investment (3.) Expense Management (4.) Project accounting and project ROI (Ret






36. To determine effectiveness of a disaster recovery program - an IT auditor should examine _____________.






37. The annual expected loss to an asset. It is calculated as the single loss expectancy (SLE) X the annualized rate of occurrence (ARO.)






38. (1.) Access Control (2.) Change Management (3.) Security Controls (4.) Incident Management (5.) SDLC (6.) Source code and versioning controls (7.) Monitoring and logging (8.) Event Management






39. The IS auditor should act as a SME in the control self-assessment - but should not play a major role in the process.






40. The means by which management establishes and measures processes by which organizational objectives are achieved






41. A critical application is backed up once per day. The recovery point objective (RPO) for an application that is backed up once per day cannot be ________.






42. (1.) Feasibility Study (2.) Definition of Requirements (3.) Design (4.) Development (5.) Testing (6.) Implementation (7.) Post-implementation phase






43. One of a database table's fields - whose value is unique.






44. (1.) Executive Summary (2.) Framework (3.) Reporting to External Parties (4.) Evaluation Tools






45. The primary source for test plans in a software development project is: ________________ that are developed for a project should be the primary source for detailed tests.






46. (1.) Automatic (2.) Manual






47. Used to control connections that are established between systems (1.) TCP (2.) IPC (3.) SIP (Session Initiation Protocol) (4.) RPC (Remote Procedure Call) (5.) NetBIOS






48. An auditor has discovered that several administrators in an application share an administrative account. The auditor should recommend that - Several __________________ should be used. This will enforce accountability for each administrator's actions.






49. When several incidents have occurred that appear to have the same or a similar root cause - a PROBLEM is occurring.






50. An audit of operational efficiency.