Test your basic knowledge |

CISA Certified Information Systems Auditor Vocab

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. The process of taking an unencrypted message (plaintext); applying a mathematical function to it (encryption algorithm with a key) and producing an encrypted message (ciphertext)






2. A group of budgets linked together at different levels such that the budgeting authority of a lower-level budget is controlled by an upper-level budget.






3. A protocol originally developed by Netscape Communications to provide a high level of security for its browser software. It has become accepted widely as a means of securing Internet message exchanges. It ensures confidentiality of the data in transm






4. The process that limits and controls access to resources of a computer system; a logical or physical control designed to protect against unauthorized entry or use. Access control can be defined by the system (mandatory access control; or MAC) or defi






5. A form of attribute sampling that is used to determine a specified probability of finding at least one example of an occurrence (attribute) in a population






6. An attack capturing sensitive pieces of information; such as passwords; passing through the network






7. A program for the examination of data; using logical or conditional tests to determine or to identify similarities or differences






8. In intrusion detection; an error that occurs when a normal activity is misdiagnosed as an attack






9. Any information collection mechanism utilized by an intrusion detection system






10. The act of copying raw data from one place to another with little or no formatting for readability. Usually; dump refers to copying data from main memory to a display screen or a printer. Dumps are useful for diagnosing bugs. After a program fails; o






11. A protocol for accessing a secure web server; whereby all data transferred is encrypted






12. A mathematical expression used to calculate budget amounts based on actual results; other budget amounts and statistics. With budget formulas; budgets using complex equations; calculations and allocations can be automatically created.






13. A sub-network of the Internet through which information is exchanged by text; graphics; audio and video.






14. Audit evidence is useful if it assists the IS auditors in meeting their audit objectives.






15. A communication line permanently assigned to connect two points; as opposed to a dial-up line that is only available and open when a connection is made by dialing the target machine or network. Also known as a dedicated line.






16. A protocol and program that allows the remote identification of users logged into a system






17. Estimated cost and revenue amounts for a given range of periods and set of books. There can be multiple budget versions for the same set of books.






18. Way of thinking; behaving; feeling; etc.






19. The Committee on the Financial Aspects of Corporate Governance; set up in May 1991 by the UK Financial Reporting Council; the London Stock Exchange and the UK accountancy profession; was chaired by Sir Adrian Cadbury and produced a report on the subj






20. A protocol used to transfer files over a TCP/IP network (Internet; UNIX; etc.)






21. A utility program that combines several separately compiled modules into one; resolving internal references between them






22. An approach used to plan; design; develop; test and implement an application system or a major modification to an application system. Typical phases include the feasibility study; requirements study; requirements definition; detailed design; programm






23. A fail-over process; in which all nodes run the same resource group (there can be no IP or MAC addresses in a concurrent resource group) and access the external storage concurrently






24. Interface between data terminal equipment and data communications equipment employing serial binary data interchange






25. A formal agreement with a third party to perform an IS function for an organization






26. Permanent reference data used in transaction processing. These data are changed infrequently; such as a product price file or a name and address file.






27. A card reader that reads cards with a magnetizable surface on which data can be stored and retrieved






28. A financial system that establishes the means for transferring money between suppliers and users of funds; ordinarily by exchanging debits or credits between banks or financial institutions.






29. Special system software features and utilities that allow the user to perform complex system maintenance. Use of these exits often permits the user to operate outside of the security access control system.






30. The electronic transmission of transactions (information) between two organizations. EDI promotes a more efficient paperless environment. EDI transmissions can replace the use of standard documents; including invoices or purchase orders.






31. Used in data encryption; it uses a secret key to encrypt the plaintext to the ciphertext. It also uses the same key to decrypt the ciphertext to the corresponding plaintext. In this case; the key is symmetric such that the encryption key is equivalen






32. A router configured to permit or deny traffic based on a set of permission rules installed by the administrator






33. An empowering method/process by which management and staff of all levels collectively identify and evaluate IS related risks and controls under the guidance of a facilitator who could be an IS auditor. The IS auditor can utilise CRSA for gathering re






34. A set of protocols for accessing information directories. It is based on the X.500 standard; but is significantly simpler.






35. A testing technique that is used to test program logic within a particular program or module. The purpose of the test is to ensure that the program meets system development guidelines and does not abnormally end during processing.






36. An individual or department responsible for the security and information classification of the shared data stored on a database system. This responsibility includes the design; definition and maintenance of the database.






37. A set of protocols developed by the IETF to support the secure exchange of packets






38. A method of computer fraud involving a computer code that instructs the computer to slice off small amounts of money from an authorized computer transaction and reroute this amount to the perpetrator's account






39. A stored collection of related data needed by organizations and individuals to meet their information processing and retrieval requirements






40. The application of an edit; using a predefined field definition to a submitted information stream; a test to ensure that data conform to a predefined format






41. A method of selecting a portion of a population; by means of mathematical calculations and probabilities; for the purpose of making scientifically and mathematically sound inferences regarding the characteristics of the entire population






42. A computerized technique of blocking out the display of sensitive information; such as passwords; on a computer terminal or report






43. An internal computerized table of access rules regarding the levels of computer access permitted to logon IDs and computer terminals






44. The susceptibility of an audit area to error which could be material; individually or in combination with other errors; assuming that there are no related internal controls






45. Data that is not encrypted. Also known as plaintext.






46. The entire set of data from which a sample is selected and about which the IS auditor wishes to draw conclusions






47. The risk to earnings or capital arising from an obligor's failure to meet the terms of any contract with the bank or otherwise to perform as agreed. Internet banking provides the opportunity for banks to expand their geographic range. Customers can r






48. A collection of related information treated as a unit. Separate fields within the record are used for processing of the information.






49. Filters out electrical surges and spikes






50. A common connection point for devices in a network; hubs commonly are used to connect segments of a LAN. A hub contains multiple ports. When a packet arrives at one port; it is copied to the other ports so that all segments of the LAN can see all pac