Test your basic knowledge |

CISA: Certified Information Systems Auditor

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. (1.) Operational (2.) Financial (3.) Integrated (4.) IS (5.) Administrative (6.) Compliance (7.) Forensic (8.) Service Provider






2. Focuses on: maintaining service availability with the least disruption to standard operating parameters during an event






3. (1.) Observations (2.) Written Notes (3.) Correspondence (4.) Process and Procedure documentation (5.) Business records






4. A sampling technique used to study the characteristics of a population to determine the numeric total of a specific attribute from the entire population.






5. ____________________ of the hot site is most important consideration for site selection. IF they are too close together then a single event may involve both locations






6. (1.) Utility (DNS - SNMP - DHCP (2.) Messaging protocols (SMTP) (3.) Data Transfer protocols (NFS - FTP) (4.) Interactive protocols (Telnet)






7. (1.) General (2.) Application






8. A sampling technique where items are chosen based upon the auditor's judgment - usually based on risk or materiality.






9. To review and approve proposed changes to systems and infrastructure. This helps to reduce the risk of unintended events and unplanned downtime.






10. The highest number of errors that can exist without a result being materially misstated.






11. A quantitative risk analysis is __________________ because: It is difficult to get accurate figures on the frequency of specific threats. It is difficult to determine the probability that a threat will be realized. It is relatively easy to determine






12. What type of testing is performed to determine if control procedures have proper design and are operating properly?






13. An external IS auditor has discovered a _______________________ - The external auditor can only document the finding in the audit report. An external auditor is not in a position to implement controls.






14. (1.) Feasibility Study (2.) Definition of Requirements (3.) Design (4.) Development (5.) Testing (6.) Implementation (7.) Post-implementation phase






15. An organization has discovered that some of its employees have criminal records. The best course of action for the organization to take - The organization should have ___________________ on all of its existing employees and also begin instituting bac






16. A sampling technique where a population is divided into classes or strata - based upon the value of one of the attributes. Samples are then selected from each class.






17. (1.) Access controls (2.) Encryption (3.) Audit logging






18. A maturity model that represents the aggregations of other maturity models.






19. (1.) Requirements (2.) Design (3.) Development (4.) Testing (5.) Release preparation (packaging) (6.) Release Deployment






20. An auditor has discovered that several administrators in an application share an administrative account. The auditor should recommend that - Several __________________ should be used. This will enforce accountability for each administrator's actions.






21. (1.) Objectives (2.) Components (3.) Business Units / Areas






22. A critical application is backed up once per day. The recovery point objective (RPO) for an application that is backed up once per day cannot be ________.






23. (1.) Avoidance (2.) Transfer (3.) Mitigation (4.) Acceptance






24. An active - instance of a server operating system running on a machine that is designed to house two or more such virtual servers.






25. The main hardware component of a computer system - which executes instructions in computer programs.






26. (1.) Physical (2.) Technical (4.) Administrative






27. Critical Path Methodology helps a project manager determine which activities are on a project's critical list - ________________________.






28. What activity involves the identification of potential risk and the appropriate response for each threat based on impact assessment using qualitative and/or quantitative measures for an enterprise-wide risk management strategy?






29. n audit strategy and plans that include: (1.) Scope (2.) Objectives (3.) Resources (4.) Procedures used to evaluation controls and processes






30. A representation of how closely a sample represents an entire population.






31. Consists of 11 distinct activities: (1.) Service Desk (2.) Incident Management (3.) Problem Management (4.) Change Management (5.) Configuration Management (6.) Release Management (7.) Service-level Management (8.) Financial Management (9.) Capacity






32. An audit that combines an operational audit and a financial audit.






33. Information is arranged in frames and transported across the medium. Collision detection. Checksum verification of delivery.






34. Used to control connections that are established between systems (1.) TCP (2.) IPC (3.) SIP (Session Initiation Protocol) (4.) RPC (Remote Procedure Call) (5.) NetBIOS






35. Should include 4 steps: (1.) Emergency Approval (2.) Implementation (3.) Verification (4.) Review






36. 1.) Executive Support (2.) Well-defined roles and responsibilities.






37. Contains programs that communicate directly with the end user.






38. Gantt: used to display ______________.






39. (1.) Monitoring (2.) Control Environment (3.) Risk Assessment and Control (4.) Information and Communication






40. An alternate processing center that contains no information processing equipment.






41. Change Management includes a _____________ of six steps: (1.) Proposal or Request (2.) Review (3.) Approval (4.) Implementation (5.) Verification (6.) Post-change Review






42. What three elements allow validation of business practices against acceptable measures of regulatory compliance - performance - and standard operational guidelines.






43. A sampling technique where at least one exception is sought in a population






44. The delivery of messages from one station to another via one or more networks.. Routes packets between networks.






45. The process of recording the configuration of IT systems. Each configuration setting is known in ITSM parlance as a Configuration Item.






46. What type of testing is performed to verify the accuracy and integrity of transactions as they flow through a system?






47. Individual events may often create combined threats to enterprise operations: A tornado might also spawn ____________________.






48. A computation of the variance of sample values from the sample mean. This is a measurement of the spread of values in a sample






49. To measure organizational performance and effectiveness against strategic goals.






50. The risk that an IS auditor will overlook errors or exceptions during an audit.