CISA EXAM REVISION EXAM PREP
Source code - correct answersuncompiled, archive code
Object code - correct answerscompiled code that is distributed and put into production; not able to be
read by humans
Inherent risk - correct answersthe risk that an error could occur assuming no compensating control exist
Control risk - correct answersthe risk that an error exists that would not be prevented by internal
controls
Detection risk - correct answersthe risk that an error exists, but is not detected. The risk that an IS
auditor may use an inadequate test procedure and conclude that no material error exists when in fact
errors do exist.
Audit risk - correct answersthe overall level of risk; the level of risk the auditor is prepared to accept.
Compliance testing - correct answersdetermines if controls are being applied in a manner that complies
with mgmt's policies and procedures
Substantive testing - correct answersevaluates the integrity of individual transactions, data, and other
information.
Regression testing - correct answersused to retest earlier program abends that occurred during the
initial testing phase.
Sociability testing - correct answersto ensure the application works as expected in the specified
environment where other applications run concurrently. Includes testing of interfaces with other
systems.
Parallel testing - correct answersFeeding test data into two systems and comparing the results.
White box testing - correct answerstest the software's program logic.
Black box testing - correct answersTesting the functional operating effectiveness without regard to
internal program structure.
Redundancy check - correct answersdetects transmission errors by appending calculated bits onto the
end of each segment of data.
Variable sampling - correct answersused to estimate the average or total value of a population.
Discovery sampling - correct answersused to determine the probability of finding an attribute in a
population.
, Attribute sampling - correct answersselecting items from a population based on a common attribute.
Used for compliance testing.
Chapter 2 - correct answers
Steering Committee - correct answersAppointed by senior management. Serves as a general review
board for projects and acquisitions... not involved in routine operations. The committee should include
representatives from senior management, user management, and the IS department. Escalates issues to
senior management.
Request for Proposal (RFP) - correct answersA document distributed to software vendors requesting
their submission of a proposal to develop or provide a software product. RFP should include: Project
Overview, Key Requirements and Constraints, Scope Limitations, Vendor questionnaire, customer
references, demonstrations, etc.
Quality Assurance - correct answersCheck to verify policies are followed.
Quality Control - correct answersCheck to verify free from defects.
Bottom-up approach for policy development - correct answersbegins by defining operational-level
requirements and policies which are derived and implemented as a result of a risk assessment.
Chapter 3 - correct answers
OSI Model - correct answersAll People Seem To Need Dominos Pizza
Layer 7 - Application layer - correct answersThe application layer interfaces directly to and performs
common application services for the application processes.
Layer 6 - Presentation layer - correct answersThe presentation layer relieves the Application layer of
concern regarding syntactical differences in data representation within the end-user systems. MIME
encoding, data compression, encryption, and similar manipulation of the presentation of data is done at
this layer.
Layer 5 - Session layer - correct answersThe session layer provides the mechanism for managing the
dialogue between end-user application processes (By dialog we mean that whose turn is it to transmit).
It provides for either duplex or half-duplex operation. This layer is responsible for setting up and tearing
down TCP/IP sessions.
Layer 4 - Transport layer - correct answersThe transport layer is responsible for reliable data delivery.
The transport layer provides transparent transfer of data between end users, thus relieving the upper
layers from any concern with providing reliable and cost-effective data transfer. The transport layer
controls the reliability of a given link. The transport layer can keep track of packets and retransmit those
that fail. Also addresses packet sequencing. The best known example of a layer 4 protocol is TCP.
Layer 3 - Network layer - correct answersThe network layer provides the functional and procedural
means of transferring variable length data sequences from a source to a destination via one or more
networks while maintaining the quality of service requested by the Transport layer. The Network layer
Source code - correct answersuncompiled, archive code
Object code - correct answerscompiled code that is distributed and put into production; not able to be
read by humans
Inherent risk - correct answersthe risk that an error could occur assuming no compensating control exist
Control risk - correct answersthe risk that an error exists that would not be prevented by internal
controls
Detection risk - correct answersthe risk that an error exists, but is not detected. The risk that an IS
auditor may use an inadequate test procedure and conclude that no material error exists when in fact
errors do exist.
Audit risk - correct answersthe overall level of risk; the level of risk the auditor is prepared to accept.
Compliance testing - correct answersdetermines if controls are being applied in a manner that complies
with mgmt's policies and procedures
Substantive testing - correct answersevaluates the integrity of individual transactions, data, and other
information.
Regression testing - correct answersused to retest earlier program abends that occurred during the
initial testing phase.
Sociability testing - correct answersto ensure the application works as expected in the specified
environment where other applications run concurrently. Includes testing of interfaces with other
systems.
Parallel testing - correct answersFeeding test data into two systems and comparing the results.
White box testing - correct answerstest the software's program logic.
Black box testing - correct answersTesting the functional operating effectiveness without regard to
internal program structure.
Redundancy check - correct answersdetects transmission errors by appending calculated bits onto the
end of each segment of data.
Variable sampling - correct answersused to estimate the average or total value of a population.
Discovery sampling - correct answersused to determine the probability of finding an attribute in a
population.
, Attribute sampling - correct answersselecting items from a population based on a common attribute.
Used for compliance testing.
Chapter 2 - correct answers
Steering Committee - correct answersAppointed by senior management. Serves as a general review
board for projects and acquisitions... not involved in routine operations. The committee should include
representatives from senior management, user management, and the IS department. Escalates issues to
senior management.
Request for Proposal (RFP) - correct answersA document distributed to software vendors requesting
their submission of a proposal to develop or provide a software product. RFP should include: Project
Overview, Key Requirements and Constraints, Scope Limitations, Vendor questionnaire, customer
references, demonstrations, etc.
Quality Assurance - correct answersCheck to verify policies are followed.
Quality Control - correct answersCheck to verify free from defects.
Bottom-up approach for policy development - correct answersbegins by defining operational-level
requirements and policies which are derived and implemented as a result of a risk assessment.
Chapter 3 - correct answers
OSI Model - correct answersAll People Seem To Need Dominos Pizza
Layer 7 - Application layer - correct answersThe application layer interfaces directly to and performs
common application services for the application processes.
Layer 6 - Presentation layer - correct answersThe presentation layer relieves the Application layer of
concern regarding syntactical differences in data representation within the end-user systems. MIME
encoding, data compression, encryption, and similar manipulation of the presentation of data is done at
this layer.
Layer 5 - Session layer - correct answersThe session layer provides the mechanism for managing the
dialogue between end-user application processes (By dialog we mean that whose turn is it to transmit).
It provides for either duplex or half-duplex operation. This layer is responsible for setting up and tearing
down TCP/IP sessions.
Layer 4 - Transport layer - correct answersThe transport layer is responsible for reliable data delivery.
The transport layer provides transparent transfer of data between end users, thus relieving the upper
layers from any concern with providing reliable and cost-effective data transfer. The transport layer
controls the reliability of a given link. The transport layer can keep track of packets and retransmit those
that fail. Also addresses packet sequencing. The best known example of a layer 4 protocol is TCP.
Layer 3 - Network layer - correct answersThe network layer provides the functional and procedural
means of transferring variable length data sequences from a source to a destination via one or more
networks while maintaining the quality of service requested by the Transport layer. The Network layer
