Test your basic knowledge |

CISA: Certified Information Systems Auditor

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. (1.) Avoidance (2.) Transfer (3.) Mitigation (4.) Acceptance






2. Concerned with electrical and physical specifications for devices. No frames or packets involved.






3. Governed by: (1.) Effective Change Management (2.) Effective Application Testing (3.) Resilient Architecture (4.) Serviceable Components






4. (1.) Observations (2.) Written Notes (3.) Correspondence (4.) Process and Procedure documentation (5.) Business records






5. What three elements allow validation of business practices against acceptable measures of regulatory compliance - performance - and standard operational guidelines.






6. A sampling technique used to permit sampling to stop at the earliest possible time. This technique is used when the auditor feels that there is a low risk or low rate of exceptions in the population.






7. The main hardware component of a computer system - which executes instructions in computer programs.






8. Used to determine which business processes are the most critical - by ranking them in order of criticality






9. Outsourcing is an opportunity for the organization to focus on core competencies. When an organization oursources a business function - it no longer needs to be concerned about training employees in that function. Outsources does not always reduce co






10. Subjective sampling is used when the auditor wants to _________________________.






11. An audit of a third-party organization that provides services to other organizations.






12. A sampling technique where items are chosen at random; each item has a statistically equal probability of being chosen.






13. Used to illustrate the relationship between planned activities. PERT diagrams show multiple routes through the project activities - as necessary for accomplishing a goal.






14. (1.) Utility (DNS - SNMP - DHCP (2.) Messaging protocols (SMTP) (3.) Data Transfer protocols (NFS - FTP) (4.) Interactive protocols (Telnet)






15. A maturity model that represents the aggregations of other maturity models.






16. An auditor has reviewed access privileges of some employees and has discovered that employees with longer terms of service have excessive privileges. This means User privileges are not being removed from their old position when they transfer to a new






17. (1.) Requirements (2.) Design (3.) Development (4.) Testing (5.) Release preparation (packaging) (6.) Release Deployment






18. The delivery of messages from one station to another via one or more networks.. Routes packets between networks.






19. A CMM helps an organization to _______________ - which is an important first step to any large-scale process improvement effort.






20. A field in a record in one table that can reference a primary key in another table that can reference a primary key in another table.






21. A technique that is used to select a portion of a population when it is not feasible to test an entire population.






22. ____________________ of the hot site is most important consideration for site selection. IF they are too close together then a single event may involve both locations






23. An estimate that expresses the percent of errors or exceptions that may exist in an entire population






24. PERT: shows the ______________ critical path.






25. An audit to determine the level and degree of compliance to a law - regulation - standard - contract provision - or internal control.






26. A computer uses RAM for several purposes: (1.) Operating System - to store info regarding running processes (2.) ____________ - that are used to temporarily store information retrieved from hard disks (3.) Storage of program code (4.) Storage of prog






27. A sampling technique where items are chosen based upon the auditor's judgment - usually based on risk or materiality.






28. An audit of operational efficiency.






29. A representation of how closely a sample represents an entire population.






30. To review and approve proposed changes to systems and infrastructure. This helps to reduce the risk of unintended events and unplanned downtime.






31. Contains programs that communicate directly with the end user.






32. (1.) Hardware Complement (physical specifications) (2.) Hardware Configuration (firmware settings) (3.) Operating system version and configuration (4.) Software versions and configuration






33. A computation of the variance of sample values from the sample mean. This is a measurement of the spread of values in a sample






34. An audit of an IS department's operations and systems.






35. Application controls limit ___________ in three ways: (1.) Point of Entry (Input Controls) (2.) During consumption (process controls) (3.) At the point of expression (Output Controls)






36. Support the functioning of the application controls






37. The probability that a sample selected does not represent the entire population. This is usually expressed as a percentage - as the numeric inverse of the confidence coefficient.






38. (1.) Developers (2.) Architects (3.) Analysts (4.) Users






39. n audit strategy and plans that include: (1.) Scope (2.) Objectives (3.) Resources (4.) Procedures used to evaluation controls and processes






40. An audit report usually includes the following 10 elements: (1.) Cover letter (2.) Introduction (3.) Summary (4.) Audit description (5.) _______________ (6.) Interviewees (7.) Evidence (8.) Explanation of sampling techniques (9.) Findings (10.) Recom






41. The party that performs strategic planning - addresses near-term and long-term requirements aligning business objectives - and technology strategies.






42. The sum of all samples divided by the number of samples.






43. (1.) Financial (2.) Customer (3.) Internal processes (4.) Innovation / Learning






44. Gantt: used to display ______________.






45. Focuses on: post-event recovery and restoration of services






46. The means by which management establishes and measures processes by which organizational objectives are achieved






47. Individual events may often create combined threats to enterprise operations: A tornado might also spawn ____________________.






48. The IS auditor should act as a SME in the control self-assessment - but should not play a major role in the process.






49. To determine effectiveness of a disaster recovery program - an IT auditor should examine _____________.






50. Should include 4 steps: (1.) Emergency Approval (2.) Implementation (3.) Verification (4.) Review