Test your basic knowledge |

CISA Certified Information Systems Auditor Vocab

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A policy whereby access is denied unless it is specifically allowed. The inverse of default allow.






2. A device that connects two similar networks together






3. The use of software packages that aid in the development of all phases of an information system. System analysis; design programming and documentation are provided. Changes introduced in one CASE chart will update all other related charts automatical






4. A testing approach that uses knowledge of a program/module's underlying implementation and code intervals to verify its expected behavior.






5. A set of protocols for accessing information directories. It is based on the X.500 standard; but is significantly simpler.






6. A consortium with more than 700 affiliates from the software industry. Its purpose is to provide a common framework for developing applications using object-oriented programming techniques. For example; OMG is known principally for promulgating the C






7. An attack strategy in which the attacker successively hacks into a series of connected systems; obscuring his/her identify from the victim of the attack






8. An attack using packets with the spoofed source Internet packet (IP) addresses. This technique exploits applications that use authentication based on IP addresses. This technique also may enable an unauthorized user to gain root access on the target






9. A testing technique used to retest earlier program abends or logical errors that occurred during the initial testing phase






10. Controls over the acquisition; implementation; delivery and support of IS systems and services. They are made up of application controls plus those general controls not included in pervasive controls.






11. A piece of information; a digitized form of signature; that provides sender authenticity; message integrity and nonrepudiation. A digital signature is generated using the sender's private key or applying a one-way hash function.






12. A computer program or series of programs designed to perform certain automated functions. These functions include reading computer files; selecting data; manipulating data; sorting data; summarizing data; performing calculations; selecting samples an






13. Specifies the length of the file's record and the sequence and size of its fields. A file layout also will specify the type of data contained within each field. For example; alphanumeric; zoned decimal; packed and binary are types of data.






14. The risk that the IS auditor's substantive procedures will not detect an error which could be material; individually or in combination with other errors






15. The amount of time allowed for the recovery of a business function or resource after a disaster occurs






16. The risk of giving an incorrect audit opinion






17. Audit evidence is useful if it assists the IS auditors in meeting their audit objectives.






18. An individual data element in a computer record. Examples include employee name; customer address; account number; product unit price and product quantity in stock.






19. Analysis that is performed in real time or in continuous form






20. The Committee on the Financial Aspects of Corporate Governance; set up in May 1991 by the UK Financial Reporting Council; the London Stock Exchange and the UK accountancy profession; was chaired by Sir Adrian Cadbury and produced a report on the subj






21. A fail-over process in which the primary node owns the resource group. The backup node runs idle; only supervising the primary node. In case of a primary node outage; the backup node takes over. The nodes are prioritized; which means the surviving no






22. Detection on the basis of whether the system activity matches that defined as bad






23. A process used to identify and evaluate risks and their potential effects






24. The use of alphabetic characters or an alphabetic character string






25. The processing of a group of transactions at the same time. Transactions are collected and processed against the master files at a specified time.






26. Files created specifically to record various actions occurring on the system to be monitored; such as failed login attempts; full disk drives and e-mail delivery failures






27. In vulnerability analysis; passive monitoring approaches in which passwords or other access credentials are required. This sort of check usually involves accessing a system data object.






28. A complex set of software programs that control the organization; storage and retrieval of data in a database. It also controls the security and integrity of the database.






29. Electronic communications by special devices over distances or around devices that preclude direct interpersonal exchange






30. Intentional violations of established management policy or regulatory requirements. Deliberate misstatements or omissions of information concerning the area under audit or the organization as a whole; gross negligence or unintentional illegal acts.






31. Proven level of ability; often linked to qualifications issued by relevant professional bodies and compliance with their codes of practice and standards






32. A data communication network that adds processing services such as error correction; data translation and/or storage to the basic function of transporting data






33. A technique used to determine the size of a development task; based on the number of function points. Function points are factors such as inputs; outputs; inquiries and logical internal sites.






34. A stored collection of related data needed by organizations and individuals to meet their information processing and retrieval requirements






35. The policies; procedures; organizational structure and electronic access controls designed to restrict access to computer software and data files






36. Program narratives provide a detailed explanation of program flowcharts; including control points and any external input.






37. A terminal with built-in processing capability. It has no disk or tape storage but has memory. The terminal interacts with the user by editing and validating data as they are entered prior to final processing.






38. A type of LAN architecture that utilizes a central controller to which all nodes are directly connected. All transmissions from one station to another pass through the central controller; which is responsible for managing and controlling all communic






39. These controls exist to detect and report when errors; omissions and unauthorized uses or entries occur.






40. An approach to system development where the basic unit of attention is an object; which represents an encapsulation of both data (an object's attributes) and functionality (an object's methods). Objects usually are created using a general template ca






41. An internal computerized table of access rules regarding the levels of computer access permitted to logon IDs and computer terminals






42. A system's level of resilience to seamlessly react from hardware and/or software failure






43. A platform-independent XML-based formatted protocol enabling applications to communicate with each other over the Internet. Use of this protocol may provide a significant security risk to web application operations; since use of SOAP piggybacks onto






44. A communication line permanently assigned to connect two points; as opposed to a dial-up line that is only available and open when a connection is made by dialing the target machine or network. Also known as a dedicated line.






45. The process of actually entering transactions into computerized or manual files. Such transactions might immediately update the master files or may result in memo posting; in which the transactions are accumulated over a period of time; then applied






46. A testing approach which focuses on the functionality of the application or product and does not require knowledge of the code intervals.






47. Connects a terminal or computer to a communications network via a telephone line. Modems turn digital pulses from the computer into frequencies within the audio range of the telephone system. When acting in the receiver capacity; a modem decodes inco






48. Audit evidence is relevant if it pertains to the audit objectives and has a logical relationship to the findings and conclusions it is used to support.






49. An extension to PPP to facilitate the creation of VPNs. L2TP merges the best features of PPTP (from Microsoft) and L2F (from Cisco).






50. A sampling technique that estimates the amount of overstatement in an account balance