Test your basic knowledge |

CISA: Certified Information Systems Auditor

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Describes the effect on the business if a process is incapacitated for any appreciable time






2. An IS auditor needs to perform an audit of a financial system and needs to trace individual transactions through the system. What type of testing should the auditor perform?






3. The IS auditor should act as a SME in the control self-assessment - but should not play a major role in the process.






4. A technique that is used to select a portion of a population when it is not feasible to test an entire population.






5. Consists of main chassis component that is equipped with slots are fitted with individual cpu modules. Main advantage is lower cost per unit.






6. Requires that a password be broken into two or more parts - with each part in the possession of a separate person.






7. Used to translate or transform data from lower layers into formats that the application layer can work with.






8. An audit that is performed in support of an anticipated or active legal proceeding.






9. The highest number of errors that can exist without a result being materially misstated.






10. Critical Path Methodology helps a project manager determine which activities are on a project's critical list - ________________________.






11. The process to ensure that standardized methods and procedures are used for efficient and prompt handling of all changes.






12. Used to schedule and sequence activities in a waterfall-type representation. Planned activities are shown flowing downward to completion. More simplistic than a PERT Diagram.






13. An organization is building a data center in an area frequented by power outages. The organization cannot tolerate power outages. The best _________________solution is an electric generator and an uninterruptible power supply. The UPS responds to the






14. (1.) Reliable delivery (2.) Connection oriented (persistent connection) (3.) Order of Delivery (4.) Flow Control (transfer rate is throttled) (5.) Port Number






15. Information is arranged in frames and transported across the medium. Collision detection. Checksum verification of delivery.






16. Aids in the coordinating of business processes using a sequence of three events -(1.) Business process creation (2.) Implementation (3.) Maintenance 3a. Benchmarking: Facilitates continuous improvement within the BPLC






17. The portion of IT management that tracks the financial value of IT services that support organizational objectives. It includes 4 activities: (1.) Budgeting (2.) Capital Investment (3.) Expense Management (4.) Project accounting and project ROI (Ret






18. IT Service Management is defined in ___________________ framework.






19. An audit to determine the level and degree of compliance to a law - regulation - standard - contract provision - or internal control.






20. The probability that a sample selected actually represents the entire population. This is usually expressed as a percentage.






21. Focuses on: maintaining service availability with the least disruption to standard operating parameters during an event






22. A database term - which means that the database will not permit a program (or user) to deleted rows from a table if there are records in other tables whose foreign keys reference the row to be deleted.






23. Handle application processing






24. The risk that there are material weaknesses in existing business processes and no compensating controls to detect or prevent them






25. The party that performs strategic planning - addresses near-term and long-term requirements aligning business objectives - and technology strategies.






26. (1.) IP (2.) ICMP (3.) RRC (Radio Resource Control) (4.) AppleTalk






27. A facility that is used to store and manage access to an organization's application source and object code. It consists of 5 parts: (1.) Access and authorization controls (2.) Program checkout (3.) Program Check-in (4.) Version Control (5.) Code Ana






28. A critical application is backed up once per day. The recovery point objective (RPO) for an application that is backed up once per day cannot be ________.






29. An external IS auditor has discovered a _______________________ - The external auditor can only document the finding in the audit report. An external auditor is not in a position to implement controls.






30. Used to measure the relative maturity of an organization and its processes.






31. (1.) Objectives (2.) Components (3.) Business Units / Areas






32. (1.) Executive Summary (2.) Governance and control framework (3.) Control Objectives (4.) Management Guidelines (5.) Implementation Guide (6.) IT Assurance Guide






33. The main hardware component of a computer system - which executes instructions in computer programs.






34. 0. No process at all (1.) Process are ad hoc and disorganized (2.) Consistent processes (3.) Documented processes (4.) Measured and managed processes (5.) Processes are continuously improved






35. An auditor has reviewed access privileges of some employees and has discovered that employees with longer terms of service have excessive privileges. This means User privileges are not being removed from their old position when they transfer to a new






36. Governed by: (1.) Effective Change Management (2.) Effective Application Testing (3.) Resilient Architecture (4.) Serviceable Components






37. A sampling technique used to permit sampling to stop at the earliest possible time. This technique is used when the auditor feels that there is a low risk or low rate of exceptions in the population.






38. (1.) Develop a BC Policy (2.) Conduct BIA (3.) Perform critical analysis (4.) Establish recovery targets (5.) Develop recovery and continuity strategies and plans (6.) Test recovery and continuity plans and procedures Train personnel Maintain strateg






39. A sampling technique where items are chosen at random; each item has a statistically equal probability of being chosen.






40. (1.) Monitoring (2.) Control Environment (3.) Risk Assessment and Control (4.) Information and Communication






41. Deliver messages from one station to another on the same network or on different networks. Messaging at this layer is not guaranteed.






42. An auditor is examining a key management process and has found that the IT department is not following its split-custody procedure. As a result - Someone may be in possession of the _________________.






43. Collections of Controls that work together to achieve an entire range of an organization's objectives.






44. PERT: shows the ______________ critical path.






45. (1.) Avoidance (2.) Transfer (3.) Mitigation (4.) Acceptance






46. A quantitative risk analysis is __________________ because: It is difficult to get accurate figures on the frequency of specific threats. It is difficult to determine the probability that a threat will be realized. It is relatively easy to determine






47. An IS auditor has discovered a high-risk exception during control testing. The best course of action for the IS auditor to take - The IS auditor should immediately ________________ when any high-risk situation is discovered.






48. External auditors are needed under these conditions: (1.) When the organization ________________________. (2.) Some regulations and standards require external - independent auditors






49. (1.) Access Control (2.) Change Management (3.) Security Controls (4.) Incident Management (5.) SDLC (6.) Source code and versioning controls (7.) Monitoring and logging (8.) Event Management






50. (1.) Access controls (2.) Encryption (3.) Audit logging