Test your basic knowledge |

CISA: Certified Information Systems Auditor

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. The maximum period of downtime for a process or application






2. A technique that is used to identify the most critical path in a project to understand which tasks are most likely to affect the project schedule.






3. The highest number of errors that can exist without a result being materially misstated.






4. The process to ensure that standardized methods and procedures are used for efficient and prompt handling of all changes.






5. In Release Management - _________________ means that each step of the release process undergoes formal review and approval before the next step is allowed to begin.






6. The 5 types of risks that are related to audits include: (1.) Control Risk (2.) Detection Risk (3.) Inherent risk (4.) _____________ (5.) Sampling risk






7. An organization is building a data center in an area frequented by power outages. The organization cannot tolerate power outages. The best _________________solution is an electric generator and an uninterruptible power supply. The UPS responds to the






8. Must be tested to validate effectiveness through: (1.) Document Review (2.) Walkthrough (3.) Simulation (4.) Parallel testing (5.) Cutover testing practices






9. A four-step quality control process known as PDSA - or PDCA. Steps: (1.) Plan (2.) Do (3.) Study (4.) Act






10. Risk Mitigation Risk Avoidance Risk Transfer Risk Acceptance






11. One of a database table's fields - whose value is unique.






12. The process of recording the configuration of IT systems. Each configuration setting is known in ITSM parlance as a Configuration Item.






13. IT Service Management is defined in ___________________ framework.






14. (1.) Feasibility (2.) Requirements (3.) Design (4.) Development (5.) Testing (6.) Implementation (7.) Post-implementation






15. Used to estimate the effort required to develop a software program.






16. Deliver messages from one station to another on the same network or on different networks. Messaging at this layer is not guaranteed.






17. A software developer has informed the project manager that a portion of the application development is going to take five additional days to complete. The project manager make a __________________ to document the reason for the change.






18. A field in a record in one table that can reference a primary key in another table that can reference a primary key in another table.






19. (1.) Developers (2.) Architects (3.) Analysts (4.) Users






20. The main hardware component of a computer system - which executes instructions in computer programs.






21. Guide program execution through organization of resources and development of clear project objectives.






22. An external IS auditor has discovered a _______________________ - The external auditor can only document the finding in the audit report. An external auditor is not in a position to implement controls.






23. Disasters are generally grouped in terms of type: ______________.






24. (1.) Link (2.) Internet (3.) Transport (4.) Application






25. An auditor has detected potential fraud while testing a control objective - He should ___________________. Because Audit committee members are generally not involved in business operations - they will be sufficiently remove from the matter - and they






26. A facility that is used to store and manage access to an organization's application source and object code. It consists of 5 parts: (1.) Access and authorization controls (2.) Program checkout (3.) Program Check-in (4.) Version Control (5.) Code Ana






27. Used for several types of system changes: (1.) Incidents and problem resolution (bug fixes.) (2.) Enhancements (new functionality.) (3.) Subsystem patches and changes (require testing similar to when changes are made to the application itself.)






28. ITIL term used to describe the SDLC.






29. (1.) Automatic (2.) Manual






30. A CMM helps an organization to _______________ - which is an important first step to any large-scale process improvement effort.






31. An IS auditor has discovered a high-risk exception during control testing. The best course of action for the IS auditor to take - The IS auditor should immediately ________________ when any high-risk situation is discovered.






32. A sampling technique where items are chosen at random; each item has a statistically equal probability of being chosen.






33. The CPU has: (1.) Arithmetic Logic Unit (2.) ______________ (3.) a small amount of memory (usually in to form of registers)






34. The probability that a sample selected does not represent the entire population. This is usually expressed as a percentage - the numeric inverse of the confidence coefficient






35. An auditor is examining a key management process and has found that the IT department is not following its split-custody procedure. As a result - Someone may be in possession of the _________________.






36. A programmer is updating an application that saves passwords in plaintext. In this case - Passwords should be stored in a _____. This makes it impossible for any person to retrieve a password - which could lead to account compromise.






37. The sum of all samples divided by the number of samples.






38. Focuses on: maintaining service availability with the least disruption to standard operating parameters during an event






39. Any event which is not part of the standard operation of service and which causes or may cause an interruption to or reduction in quality of that service. Includes THREE incident types: (1.) Service Outage (2.) Service Slowdown (3.) Software Bug






40. When several incidents have occurred that appear to have the same or a similar root cause - a PROBLEM is occurring.






41. An audit of an IS department's operations and systems.






42. An audit that combines an operational audit and a financial audit.






43. Gantt: used to display ______________.






44. An alternate processing center that contains no information processing equipment.






45. Used to translate or transform data from lower layers into formats that the application layer can work with.






46. Contains programs that communicate directly with the end user.






47. (1.) Requirements (2.) Design (3.) Development (4.) Testing (5.) Release preparation (packaging) (6.) Release Deployment






48. The first major task in a disaster recovery or business continuity planning project.






49. Outsourcing is an opportunity for the organization to focus on core competencies. When an organization oursources a business function - it no longer needs to be concerned about training employees in that function. Outsources does not always reduce co






50. A technique that is used to select a portion of a population when it is not feasible to test an entire population.