Test your basic knowledge |

CISA: Certified Information Systems Auditor

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. The risk that an IS auditor will overlook errors or exceptions during an audit.






2. The CPU has: (1.) Arithmetic Logic Unit (2.) ______________ (3.) a small amount of memory (usually in to form of registers)






3. An alternate processing center that contains no information processing equipment.






4. Used to measure the relative maturity of an organization and its processes.






5. The risk that there are material weaknesses in existing business processes and no compensating controls to detect or prevent them






6. A representation of how closely a sample represents an entire population.






7. (1.) LAN protocols (2.) 80 (2.) 11 MAC/LLC (WiFi) (3.) Common Carrier packet networks (4.) ARP (5.) PPP and SLIP (6.) Tunneling - PPTP - L2TP






8. To review and approve proposed changes to systems and infrastructure. This helps to reduce the risk of unintended events and unplanned downtime.






9. Consists of main chassis component that is equipped with slots are fitted with individual cpu modules. Main advantage is lower cost per unit.






10. (1.) Physical (2.) Technical (4.) Administrative






11. When several incidents have occurred that appear to have the same or a similar root cause - a PROBLEM is occurring.






12. Outsourcing is an opportunity for the organization to focus on core competencies. When an organization oursources a business function - it no longer needs to be concerned about training employees in that function. Outsources does not always reduce co






13. Focuses on: post-event recovery and restoration of services






14. The delivery of messages from one station to another via one or more networks.. Routes packets between networks.






15. (1.) Executive Summary (2.) Framework (3.) Reporting to External Parties (4.) Evaluation Tools






16. An estimate that expresses the percent of errors or exceptions that may exist in an entire population






17. (1.) Link (2.) Internet (3.) Transport (4.) Application






18. An auditor has detected potential fraud while testing a control objective - He should ___________________. Because Audit committee members are generally not involved in business operations - they will be sufficiently remove from the matter - and they






19. PERT: shows the ______________ critical path.






20. An IS auditor needs to perform an audit of a financial system and needs to trace individual transactions through the system. What type of testing should the auditor perform?






21. (1.) MPLS (2.) SONET (3.) T-Carrier (4.) Frame Relay (5.) ISDN (6.) X.25






22. The main hardware component of a computer system - which executes instructions in computer programs.






23. Disasters are generally grouped in terms of type: ______________.






24. An audit of IS controls - security controls - or business controls to determine control existence and effectiveness.






25. An audit report usually includes the following 10 elements: (1.) Cover letter (2.) Introduction (3.) Summary (4.) Audit description (5.) _______________ (6.) Interviewees (7.) Evidence (8.) Explanation of sampling techniques (9.) Findings (10.) Recom






26. Used for several types of system changes: (1.) Incidents and problem resolution (bug fixes.) (2.) Enhancements (new functionality.) (3.) Subsystem patches and changes (require testing similar to when changes are made to the application itself.)






27. Guide program execution through organization of resources and development of clear project objectives.






28. (1.) Operational (2.) Financial (3.) Integrated (4.) IS (5.) Administrative (6.) Compliance (7.) Forensic (8.) Service Provider






29. A technique that is used to identify the most critical path in a project to understand which tasks are most likely to affect the project schedule.






30. The portion of IT management that tracks the financial value of IT services that support organizational objectives. It includes 4 activities: (1.) Budgeting (2.) Capital Investment (3.) Expense Management (4.) Project accounting and project ROI (Ret






31. Lowest layer. Delivers messages (frames) from one station to another vial local network.






32. Who is responsible for imposing an IT governance model encompassing IT strategy - information security - and formal enterprise architectural mandates?






33. The probability that a sample selected does not represent the entire population. This is usually expressed as a percentage - the numeric inverse of the confidence coefficient






34. (1.) General (2.) Application






35. Change Management includes a _____________ of six steps: (1.) Proposal or Request (2.) Review (3.) Approval (4.) Implementation (5.) Verification (6.) Post-change Review






36. (1.) Feasibility (2.) Requirements (3.) Design (4.) Development (5.) Testing (6.) Implementation (7.) Post-implementation






37. Risk Mitigation Risk Avoidance Risk Transfer Risk Acceptance






38. Support the functioning of the application controls






39. Application controls limit ___________ in three ways: (1.) Point of Entry (Input Controls) (2.) During consumption (process controls) (3.) At the point of expression (Output Controls)






40. A condition that is the result of multiple incidents that exhibit common symptoms e.g. A web application is displaying information incorrectly and many users have contacted the IT service desk.






41. An organization has discovered that some of its employees have criminal records. The best course of action for the organization to take - The organization should have ___________________ on all of its existing employees and also begin instituting bac






42. Requires that a password be broken into two or more parts - with each part in the possession of a separate person.






43. A critical application is backed up once per day. The recovery point objective (RPO) for an application that is backed up once per day cannot be ________.






44. A collection of two or more servers that is designed to appear as a single server.






45. An audit that combines an operational audit and a financial audit.






46. An audit of a third-party organization that provides services to other organizations.






47. An audit to determine the level and degree of compliance to a law - regulation - standard - contract provision - or internal control.






48. (1.) Financial (2.) Customer (3.) Internal processes (4.) Innovation / Learning






49. The set of activities that is concerned with the ability of the organization to continue to provide services - primarily in the event that a natural or man made disaster has occurred.






50. To measure organizational performance and effectiveness against strategic goals.