Test your basic knowledge |

CISA Certified Information Systems Auditor Vocab

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Those controls that seek to maintain confidentiality; integrity and availability of information






2. The possibility of an act or event occurring that would have an adverse effect on the organization and its information systems






3. A public end-to-end digital telecommunications network with signaling; switching and transport capabilities supporting a wide range of service accessed by standardized interfaces with integrated customer control. The standard allows transmission of d






4. Impartial point of view which allows the IS auditor to act objectively and with fairness






5. A policy whereby access is denied unless it is specifically allowed. The inverse of default allow.






6. Any yearly accounting period without regard to its relationship to a calendar year.






7. The information systems auditor (IS auditor) gathers information in the course of performing an IS audit. The information used by the IS auditor to meet audit objectives is referred to as audit evidence (evidence). Also used to describe the level of






8. A flag set in a packet to indicate to the sender that the previous packet sent was accepted correctly by the receiver without errors; or that the receiver is now ready to accept a transmission






9. A communication protocol used to connect to servers on the World Wide Web. Its primary function is to establish a connection with a web server and transmit HTML pages to the client browser.






10. Members of the operations area that are responsible for the collection; logging and submission of input for the various user groups






11. A complex set of software programs that control the organization; storage and retrieval of data in a database. It also controls the security and integrity of the database.






12. In intrusion detection; an error that occurs when a normal activity is misdiagnosed as an attack






13. The property that data meet with a priority expectation of quality and that the data can be relied upon






14. The communication lines that provide connectivity between the telecommunications carrier's central office and the subscriber's facilities






15. A protocol for packet-switching networks






16. A statement of the position within the organization; including lines of reporting and the rights of access






17. A packet (encapsulated with a frame containing information); which is transmitted in a packet-switching network from source to destination






18. Another term for an application programmer interface (API). It refers to the interfaces that allow programmers to access lower- or higher-level services by providing an intermediary layer that includes function calls to the services.






19. A mathematical key (kept secret by the holder) used to create digital signatures and; depending upon the algorithm; to decrypt messages or files encrypted (for confidentiality) with the corresponding public key






20. An independent audit of the control structure of a service organization; such as a service bureau; with the objective of providing assurances to the users of the service organization that the internal control structure is adequate; effective and soun






21. An exception report is generated by a program that identifies transactions or data that appear to be incorrect. These items may be outside a predetermined range or may not conform to specified criteria.






22. A testing technique used to retest earlier program abends or logical errors that occurred during the initial testing phase






23. A platform-independent XML-based formatted protocol enabling applications to communicate with each other over the Internet. Use of this protocol may provide a significant security risk to web application operations; since use of SOAP piggybacks onto






24. An approach to system development where the basic unit of attention is an object; which represents an encapsulation of both data (an object's attributes) and functionality (an object's methods). Objects usually are created using a general template ca






25. The outward impression of being self-governing and free from conflict of interest and undue influence






26. An assault on a service from a single source that floods it with so many requests that it becomes overwhelmed and is either stopped completely or operates at a significantly reduced rate






27. A recurring journal entry used to allocate revenues or costs. For example; an allocation entry could be defined to allocate costs to each department based on headcount.






28. Faking the sending address of a transmission in order to gain illegal entry into a secure system






29. Generally; the assumption that an entity will behave substantially as expected. Trust may apply only for a specific function. The key role of this term in an authentication framework is to describe the relationship between an authenticating entity an






30. A proxy service that connects programs running on internal networks to services on exterior networks by creating two connections; one from the requesting client and another to the destination service






31. Controls; other than application controls; which relate to the environment within which computer-based application systems are developed; maintained and operated; and which are therefore applicable to all applications. The objectives of general contr






32. A device that is used to authenticate a user; typically in addition to a username and password. It is usually a credit card-sized device that displays a pseudo random number that changes every few minutes.






33. To configure a computer or other network device to resist attacks






34. A set of metrics designed to measure the extent to which performance objectives are being achieved on an on-going basis. They can include service level agreements; critical success factors; customer satisfaction ratings; internal or external benchmar






35. The organization providing the outsourced service






36. In intrusion detection; an error that occurs when an attack is misdiagnosed as a normal activity






37. An organization composed of engineers; scientists and students. The IEEE is best known for developing standards for the computer and electronics industry.






38. The use of alphabetic characters or an alphabetic character string






39. Formal document which defines the IS auditor's responsibility; authority and accountability for a specific assignment






40. Disturbances; such as static; in data transmissions that cause messages to be misinterpreted by the receiver






41. A weakness in system security procedures; system design; implementation or internal controls that could be exploited to violate system security.






42. An electronic form functionally equivalent to cash in order to make and receive payments in cyberbanking






43. The transmission of more than one signal across a physical channel






44. Diligence which a person would exercise under a given set of circumstances






45. The primary language used by both application programmers and end users in accessing relational databases






46. A data communication network that adds processing services such as error correction; data translation and/or storage to the basic function of transporting data






47. A fail-over process in which the primary node owns the resource group. The backup node runs idle; only supervising the primary node. In case of a primary node outage; the backup node takes over. The nodes are prioritized; which means the surviving no






48. A storage facility located away from the building housing the primary information processing facility (IPF); used for storage of computer media such as offline backup data and storage files






49. The use of software packages that aid in the development of all phases of an information system. System analysis; design programming and documentation are provided. Changes introduced in one CASE chart will update all other related charts automatical






50. This approach allows IS auditors to monitor system reliability on a continuous basis and to gather selective audit evidence through the computer.