Test your basic knowledge |

CISA Certified Information Systems Auditor Vocab

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A method for downloading public files using the File Transfer Protocol (FTP). Anonymous FTP is called anonymous because users do not need to identify themselves before accessing files from a particular server. In general; users enter the word anonymo






2. An ASP that also provides outsourcing of business processes such as payment processing; sales order processing and application development






3. An extension to PPP to facilitate the creation of VPNs. L2TP merges the best features of PPTP (from Microsoft) and L2F (from Cisco).






4. A device for sending and receiving computerized data over transmission lines






5. The information systems auditor (IS auditor) gathers information in the course of performing an IS audit. The information used by the IS auditor to meet audit objectives is referred to as audit evidence (evidence). Also used to describe the level of






6. A data recovery strategy that takes a set of physically disparate disks and synchronously mirrors them over high performance communication lines. Any write to a disk on one side will result in a write on the other. The local write will not return unt






7. The list of rules and/or guidance that is used to analyze event data






8. A measurement of the point prior to an outage to which data are to be restored






9. In an asymmetric cryptographic scheme; the key that may be widely published to enable the operation of the scheme






10. An interactive system that provides the user with easy access to decision models and data; to support semistructured decision-making tasks






11. Used in data encryption; it uses an encryption key; as a public key; to encrypt the plaintext to the ciphertext. It uses the different decryption key; as a secret key; to decrypt the ciphertext to the corresponding plaintext. In contrast to a private






12. Source code is the language in which a program is written. Source code is translated into object code by assemblers and compilers. In some cases; source code may be converted automatically into another language by a conversion program. Source code is






13. A flag set in a packet to indicate that this packet is the final data packet of the transmission






14. A level of comfort short of a guarantee but considered adequate given the costs of the control and the likely benefits achieved






15. The process of electronically sending computerized information from one computer to another computer. Most often; the transfer is from a smaller computer to a larger one.






16. A specially configured server; designed to attract intruders so that their actions do not affect production systems; also known as a decoy server






17. A group of budgets linked together at different levels such that the budgeting authority of a lower-level budget is controlled by an upper-level budget.






18. Refer to the transactions and data relating to each computer-based application system and are therefore specific to each such application. The objectives of application controls; which may be manual; or programmed; are to ensure the completeness and






19. Attackers that penetrate systems by using user identifiers and passwords taken from legitimate users






20. Detection on the basis of whether the system activity matched that defined as abnormal






21. A system that authentically distributes users' public keys using certificates






22. The current and prospective effect on earnings or capital arising from adverse business decisions; improper implementation of decisions or lack of responsiveness to industry changes.






23. An Internet standard that allows a network to use one set of IP addresses for internal traffic and a second set of addresses for external traffic. The server; providing the NAT service; changes the source address of outgoing packets from the internal






24. A telecommunications carrier's facilities in a local area in which service is provided where local service is switched to long distance






25. A testing approach that uses knowledge of a program/module's underlying implementation and code intervals to verify its expected behavior.






26. A fully operational offsite data processing facility equipped with both hardware and system software to be used in the event of a disaster






27. Is the risk to earnings or capital arising from violations of; or nonconformance with; laws; rules; regulations; prescribed practices or ethical standards. Banks are subject to various forms of legal risk. This can include the risk that assets will t






28. The extent to which a system unit--subroutine; program; module; component; subsystem--performs a single dedicated function. Generally; the more cohesive are units; the easier it is to maintain and enhance a system; since it is easier to determine whe






29. A web-based version of the traditional phone book's yellow and white pages enabling businesses to be publicly listed in promoting greater e-commerce activities.






30. English-like; user friendly; nonprocedural computer languages used to program and/or read and process computer files






31. The probability that the IS auditor has reached an incorrect conclusion because an audit sample; rather than the whole population; was tested. While sampling risk can be reduced to an acceptably low level by using an appropriate sample size and selec






32. Detects errors in the input portion of information that is sent to the computer for processing. The controls may be manual or automated and allow the user to edit data errors before processing.






33. Common path or channel between hardware devices. It can be between components internal to a computer or between external computers in a communications network.






34. Detection on the basis of whether the system activity matches that defined as bad






35. An attack strategy in which the attacker successively hacks into a series of connected systems; obscuring his/her identify from the victim of the attack






36. The property that data meet with a priority expectation of quality and that the data can be relied upon






37. The ability to exercise judgement; express opinions and present recommendations with impartiality






38. Controls over the acquisition; implementation; delivery and support of IS systems and services. They are made up of application controls plus those general controls not included in pervasive controls.






39. Authorized users of a computer system who overstep their legitimate access rights. This category is divided into masqueraders and clandestine users.






40. General controls which are designed to manage and monitor the IS environment and which; therefore; affect all IS-related activities






41. An input device that reads characters and images that are printed or painted on a paper form into the computer.






42. A network monitoring and data acquisition tool that performs filter translation; packet acquisition and packet display






43. The code used to designate the location of a specific piece of data within computer storage






44. Systems that employ sufficient hardware and software assurance measures to allow their use for processing of a range of sensitive or classified information






45. The possibility of an act or event occurring that would have an adverse effect on the organization and its information systems






46. Identified by one central processor and databases that form a distributed processing configuration






47. The act of connecting to the computer. It typically requires entry of a user ID and password into a computer terminal.






48. An approach used to plan; design; develop; test and implement an application system or a major modification to an application system. Typical phases include the feasibility study; requirements study; requirements definition; detailed design; programm






49. Freedom from unauthorized intrusion






50. The name given to a class of algorithms that repeatedly try all possible combinations until a solution is found