Test your basic knowledge |

CISA: Certified Information Systems Auditor

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. What activity involves the identification of potential risk and the appropriate response for each threat based on impact assessment using qualitative and/or quantitative measures for an enterprise-wide risk management strategy?






2. (1.) Feasibility Study (2.) Definition of Requirements (3.) Design (4.) Development (5.) Testing (6.) Implementation (7.) Post-implementation phase






3. (1.) Avoidance (2.) Transfer (3.) Mitigation (4.) Acceptance






4. The probability that a sample selected does not represent the entire population. This is usually expressed as a percentage - the numeric inverse of the confidence coefficient






5. During the development phase - Developers should only be performing Unit Testing - to verify that the individual sections of code they have written are performing properly.






6. Must be tested to validate effectiveness through: (1.) Document Review (2.) Walkthrough (3.) Simulation (4.) Parallel testing (5.) Cutover testing practices






7. Used to schedule and sequence activities in a waterfall-type representation. Planned activities are shown flowing downward to completion. More simplistic than a PERT Diagram.






8. (1.) Operational (2.) Financial (3.) Integrated (4.) IS (5.) Administrative (6.) Compliance (7.) Forensic (8.) Service Provider






9. A collection of two or more servers that is designed to appear as a single server.






10. 0. No process at all (1.) Process are ad hoc and disorganized (2.) Consistent processes (3.) Documented processes (4.) Measured and managed processes (5.) Processes are continuously improved






11. (1.) General (2.) Application






12. (1.) Access controls (2.) Encryption (3.) Audit logging






13. IS auditors can _____________________ through the following means: (1.) training courses (2.) webinars (3.) ISACA chapter training events (4.) Industry conferences






14. An organization wants to reduce the number of user IDs and passwords that its employees need to remember. The best available solution to this - _______________. This provides a single authentication service (such as LDAP or AD) that many applications






15. (1.) Executive Summary (2.) Governance and control framework (3.) Control Objectives (4.) Management Guidelines (5.) Implementation Guide (6.) IT Assurance Guide






16. A field in a record in one table that can reference a primary key in another table that can reference a primary key in another table.






17. A technique that is used to select a portion of a population when it is not feasible to test an entire population.






18. An auditor has discovered that several administrators in an application share an administrative account. The auditor should recommend that - Several __________________ should be used. This will enforce accountability for each administrator's actions.






19. To measure organizational performance and effectiveness against strategic goals.






20. What three elements allow validation of business practices against acceptable measures of regulatory compliance - performance - and standard operational guidelines.






21. An organization has discovered that some of its employees have criminal records. The best course of action for the organization to take - The organization should have ___________________ on all of its existing employees and also begin instituting bac






22. A tightly coupled collection of computers that are used to solve a common task. One or more actively perform tasks - while zero or more may be in a standby state.






23. A condition that is the result of multiple incidents that exhibit common symptoms e.g. A web application is displaying information incorrectly and many users have contacted the IT service desk.






24. Aids in the coordinating of business processes using a sequence of three events -(1.) Business process creation (2.) Implementation (3.) Maintenance 3a. Benchmarking: Facilitates continuous improvement within the BPLC






25. An active - instance of a server operating system running on a machine that is designed to house two or more such virtual servers.






26. An external IS auditor has discovered a _______________________ - The external auditor can only document the finding in the audit report. An external auditor is not in a position to implement controls.






27. (1.) LAN protocols (2.) 80 (2.) 11 MAC/LLC (WiFi) (3.) Common Carrier packet networks (4.) ARP (5.) PPP and SLIP (6.) Tunneling - PPTP - L2TP






28. Individual events may often create combined threats to enterprise operations: A tornado might also spawn ____________________.






29. Contains programs that communicate directly with the end user.






30. An audit that is performed in support of an anticipated or active legal proceeding.






31. The main hardware component of a computer system - which executes instructions in computer programs.






32. A large number of loosely coupled computers that are used to solve a common task may be in close proximity to each other or scattered over a large geographical area.






33. Requires that a password be broken into two or more parts - with each part in the possession of a separate person.






34. The party that performs strategic planning - addresses near-term and long-term requirements aligning business objectives - and technology strategies.






35. A software developer has informed the project manager that a portion of the application development is going to take five additional days to complete. The project manager make a __________________ to document the reason for the change.






36. Support the functioning of the application controls






37. An IS auditor needs to perform an audit of a financial system and needs to trace individual transactions through the system. What type of testing should the auditor perform?






38. ____________________ of the hot site is most important consideration for site selection. IF they are too close together then a single event may involve both locations






39. Used to determine which business processes are the most critical - by ranking them in order of criticality






40. (1.) Hardware Complement (physical specifications) (2.) Hardware Configuration (firmware settings) (3.) Operating system version and configuration (4.) Software versions and configuration






41. A sampling technique used to study the characteristics of a population to determine the numeric total of a specific attribute from the entire population.






42. (1.) Authentication (2.) Authorization (3.) Change Management (4.) Completeness checks (5.) Validation checks (6.) Input controls (7.) Output controls (8.) Problem management (9.) Identification/access controls






43. A sampling technique where items are chosen at random; each item has a statistically equal probability of being chosen.






44. ITIL term used to describe the SDLC.






45. Who is responsible for imposing an IT governance model encompassing IT strategy - information security - and formal enterprise architectural mandates?






46. A sampling technique where a population is divided into classes or strata - based upon the value of one of the attributes. Samples are then selected from each class.






47. A maturity model that represents the aggregations of other maturity models.






48. (1.) Objectives (2.) Components (3.) Business Units / Areas






49. Used to translate or transform data from lower layers into formats that the application layer can work with.






50. The process of recording the configuration of IT systems. Each configuration setting is known in ITSM parlance as a Configuration Item.