Test your basic knowledge |

CISA Certified Information Systems Auditor Vocab

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A process to authenticate (or certify) a party's digital signature; carried out by trusted third parties.






2. A method of computer fraud involving a computer code that instructs the computer to remove small amounts of money from an authorized computer transaction by rounding down to the nearest whole value denomination and rerouting the rounded off amount to






3. Also called permissions or privileges; these are the rights granted to users by the administrator or supervisor. Access rights determine the actions users can perform (e.g.; read; write; execute; create and delete) on files in shared volumes or file






4. A proxy service that connects programs running on internal networks to services on exterior networks by creating two connections; one from the requesting client and another to the destination service






5. Simulated transactions that can be used to test processing logic; computations and controls actually programmed in computer applications. Individual programs or an entire system can be tested. This technique includes Integrated Test Facilities (ITFs)






6. 1) Following an authorized person into a restricted access area; 2) electronically attaching to an authorized telecommunications link to intercept and possibly alter transmissions.






7. Audit evidence is relevant if it pertains to the audit objectives and has a logical relationship to the findings and conclusions it is used to support.






8. A phase of an SDLC methodology where the affected user groups define the requirements of the system for meeting the defined needs






9. Specifies the format of packets and the addressing scheme






10. A fail-over process in which the primary node owns the resource group. The backup node runs idle; only supervising the primary node. In case of a primary node outage; the backup node takes over. The nodes are prioritized; which means the surviving no






11. The transfer of service from an incapacitated primary component to its backup component






12. A measurement of the point prior to an outage to which data are to be restored






13. Detection on the basis of whether the system activity matches that defined as bad






14. Provides short-term backup power from batteries for a computer system when the electrical power fails or drops to an unacceptable voltage level






15. A numeric value; which has been calculated mathematically; is added to data to ensure that original data have not been altered or that an incorrect; but valid match has occurred. This control is effective in detecting transposition and transcription






16. Processes certified as supporting a security goal






17. A warm-site is similar to a hot-site; however; it is not fully equipped with all necessary hardware needed for recovery.






18. The process of electronically sending computerized information from one computer to another computer. Most often; the transfer is from a smaller computer to a larger one.






19. A test to check the system's ability to recover after a software or hardware failure






20. A type of LAN architecture in which the cable forms a loop; with stations attached at intervals around the loop. Signals transmitted around the ring take the form of messages. Each station receives the messages and each station determines; on the bas






21. Interface between data terminal equipment and data communications equipment employing serial binary data interchange






22. The possibility of an act or event occurring that would have an adverse effect on the organization and its information systems






23. Tests of control designed to obtain audit evidence on both the effectiveness of the controls and their operation during the audit period






24. Computer programs provided by a computer hardware manufacturer or software vendor and used in running the system. This technique can be used to examine processing activities; to test programs; system activities and operational procedures; to evaluate






25. A technique used to recover the original plaintext from the ciphertext such that it is intelligible to the reader. The decryption is a reverse process of the encryption.






26. A biometric device that is used to authenticate a user through palm scans






27. Techniques and procedures used to verify; validate and edit data; to ensure that only correct data are entered into the computer






28. A resource whose loss will result in the loss of service or production






29. A connectionless Internet protocol that is designed for network efficiency and speed at the expense of reliability. A data request by the client is served by sending packets without testing to verify if they actually arrive at the destination; not if






30. The range between the highest and lowest transmittable frequencies. It equates to the transmission capacity of an electronic line and is expressed in bytes per second or Hertz (cycles per second).






31. Processing is achieved by entering information into the computer via a video display terminal. The computer immediately accepts or rejects the information; as it is entered.






32. The act of giving the idea or impression of being or doing something






33. Availability relates to information being available when required by the business process now and in the future. It also concerns the safeguarding of necessary resources and associated capabilities.






34. The router at the extreme edge of the network under control; usually connected to an ISP or other service provider; also known as border router






35. Hardware devices; such as asynchronous and synchronous transmissions; that convert between two different types of transmission






36. A master control program that runs the computer and acts as a scheduler and traffic controller. It is the first program copied into the computer's memory after the computer is turned on and must reside in memory at all times. It is the software that






37. An audit designed to determine the accuracy of financial records and information






38. A protocol used to transmit data securely between two end points to create a VPN






39. The denial by one of the parties to a transaction or participation in all or part of that transaction or of the content of communications related to that transaction.






40. The amount of time allowed for the recovery of a business function or resource after a disaster occurs






41. A system development technique that enables users and developers to reach agreement on system requirements. Prototyping uses programmed simulation techniques to represent a model of the final system to the user for advisement and critique. The emphas






42. A port configured on a network switch to receive copies of traffic from one or more other ports on the switch






43. Any situation or event that has the potential to harm a system






44. To the basic border firewall; add a host that resides on an untrusted network where the firewall cannot protect it. That host is minimally configured and carefully managed to be as secure as possible. The firewall is configured to require incoming an






45. These controls are designed to prevent or restrict an error; omission or unauthorized intrusion.






46. A process used to identify and evaluate risks and their potential effects






47. A statement of the position within the organization; including lines of reporting and the rights of access






48. An individual or department responsible for the security and information classification of the shared data stored on a database system. This responsibility includes the design; definition and maintenance of the database.






49. In vulnerability analysis; gaining information by performing checks that affects the normal operation of the system; even crashing the system






50. A level of comfort short of a guarantee but considered adequate given the costs of the control and the likely benefits achieved