CISA EXAM 2025
Chapter 1
Source code
- answers-uncompiled, archive code
Object code
- answers-compiled code that is distributed and put into production; not able to be read
by humans
Inherent risk
- answers-the risk that an error could occur assuming no compensating control exist
Control risk
- answers-the risk that an error exists that would not be prevented by internal controls
Detection risk
- answers-the risk that an error exists, but is not detected. The risk that an IS auditor
may use an inadequate test procedure and conclude that no material error exists when
in fact errors do exist.
Audit risk
- answers-the overall level of risk; the level of risk the auditor is prepared to accept.
Compliance testing
- answers-determines if controls are being applied in a manner that complies with
mgmt's policies and procedures
Substantive testing
- answers-evaluates the integrity of individual transactions, data, and other information.
Regression testing
- answers-used to retest earlier program abends that occurred during the initial testing
phase.
Sociability testing
- answers-to ensure the application works as expected in the specified environment
where other applications run concurrently. Includes testing of interfaces with other
systems.
,Parallel testing
- answers-Feeding test data into two systems and comparing the results.
White box testing
- answers-test the software's program logic.
Black box testing
- answers-Testing the functional operating effectiveness without regard to internal
program structure.
Redundancy check
- answers-detects transmission errors by appending calculated bits onto the end of each
segment of data.
Variable sampling
- answers-used to estimate the average or total value of a population.
Discovery sampling
- answers-used to determine the probability of finding an attribute in a population.
Attribute sampling
- answers-selecting items from a population based on a common attribute. Used for
compliance testing.
Chapter 2
- answers-
Steering Committee
- answers-Appointed by senior management. Serves as a general review board for
projects and acquisitions... not involved in routine operations. The committee should
include representatives from senior management, user management, and the IS
department. Escalates issues to senior management.
Request for Proposal (RFP)
- answers-A document distributed to software vendors requesting their submission of a
proposal to develop or provide a software product. RFP should include: Project
Overview, Key Requirements and Constraints, Scope Limitations, Vendor
questionnaire, customer references, demonstrations, etc.
Quality Assurance
- answers-Check to verify policies are followed.
Quality Control
- answers-Check to verify free from defects.
, Bottom-up approach for policy development
- answers-begins by defining operational-level requirements and policies which are
derived and implemented as a result of a risk assessment.
Chapter 3
- answers-
OSI Model
- answers-All People Seem To Need Dominos Pizza
Layer 7 - Application layer
- answers-The application layer interfaces directly to and performs common application
services for the application processes.
Layer 6 - Presentation layer
- answers-The presentation layer relieves the Application layer of concern regarding
syntactical differences in data representation within the end-user systems. MIME
encoding, data compression, encryption, and similar manipulation of the presentation of
data is done at this layer.
Layer 5 - Session layer
- answers-The session layer provides the mechanism for managing the dialogue
between end-user application processes (By dialog we mean that whose turn is it to
transmit). It provides for either duplex or half-duplex operation. This layer is responsible
for setting up and tearing down TCP/IP sessions.
Layer 4 - Transport layer
- answers-The transport layer is responsible for reliable data delivery. The transport
layer provides transparent transfer of data between end users, thus relieving the upper
layers from any concern with providing reliable and cost-effective data transfer. The
transport layer controls the reliability of a given link. The transport layer can keep track
of packets and retransmit those that fail. Also addresses packet sequencing. The best
known example of a layer 4 protocol is TCP.
Layer 3 - Network layer
- answers-The network layer provides the functional and procedural means of
transferring variable length data sequences from a source to a destination via one or
more networks while maintaining the quality of service requested by the Transport layer.
The Network layer performs network routing, flow control,
segmentation/desegmentation, and error control functions. Routers operate at this layer
-- sending data throughout the extended network
Layer 2 - Data link layer
- answers-The data link layer provides the functional and procedural means to transfer
data between network entities and to detect and possibly correct errors that may occur
in the Physical layer. The addressing scheme is physical which means that the
Chapter 1
Source code
- answers-uncompiled, archive code
Object code
- answers-compiled code that is distributed and put into production; not able to be read
by humans
Inherent risk
- answers-the risk that an error could occur assuming no compensating control exist
Control risk
- answers-the risk that an error exists that would not be prevented by internal controls
Detection risk
- answers-the risk that an error exists, but is not detected. The risk that an IS auditor
may use an inadequate test procedure and conclude that no material error exists when
in fact errors do exist.
Audit risk
- answers-the overall level of risk; the level of risk the auditor is prepared to accept.
Compliance testing
- answers-determines if controls are being applied in a manner that complies with
mgmt's policies and procedures
Substantive testing
- answers-evaluates the integrity of individual transactions, data, and other information.
Regression testing
- answers-used to retest earlier program abends that occurred during the initial testing
phase.
Sociability testing
- answers-to ensure the application works as expected in the specified environment
where other applications run concurrently. Includes testing of interfaces with other
systems.
,Parallel testing
- answers-Feeding test data into two systems and comparing the results.
White box testing
- answers-test the software's program logic.
Black box testing
- answers-Testing the functional operating effectiveness without regard to internal
program structure.
Redundancy check
- answers-detects transmission errors by appending calculated bits onto the end of each
segment of data.
Variable sampling
- answers-used to estimate the average or total value of a population.
Discovery sampling
- answers-used to determine the probability of finding an attribute in a population.
Attribute sampling
- answers-selecting items from a population based on a common attribute. Used for
compliance testing.
Chapter 2
- answers-
Steering Committee
- answers-Appointed by senior management. Serves as a general review board for
projects and acquisitions... not involved in routine operations. The committee should
include representatives from senior management, user management, and the IS
department. Escalates issues to senior management.
Request for Proposal (RFP)
- answers-A document distributed to software vendors requesting their submission of a
proposal to develop or provide a software product. RFP should include: Project
Overview, Key Requirements and Constraints, Scope Limitations, Vendor
questionnaire, customer references, demonstrations, etc.
Quality Assurance
- answers-Check to verify policies are followed.
Quality Control
- answers-Check to verify free from defects.
, Bottom-up approach for policy development
- answers-begins by defining operational-level requirements and policies which are
derived and implemented as a result of a risk assessment.
Chapter 3
- answers-
OSI Model
- answers-All People Seem To Need Dominos Pizza
Layer 7 - Application layer
- answers-The application layer interfaces directly to and performs common application
services for the application processes.
Layer 6 - Presentation layer
- answers-The presentation layer relieves the Application layer of concern regarding
syntactical differences in data representation within the end-user systems. MIME
encoding, data compression, encryption, and similar manipulation of the presentation of
data is done at this layer.
Layer 5 - Session layer
- answers-The session layer provides the mechanism for managing the dialogue
between end-user application processes (By dialog we mean that whose turn is it to
transmit). It provides for either duplex or half-duplex operation. This layer is responsible
for setting up and tearing down TCP/IP sessions.
Layer 4 - Transport layer
- answers-The transport layer is responsible for reliable data delivery. The transport
layer provides transparent transfer of data between end users, thus relieving the upper
layers from any concern with providing reliable and cost-effective data transfer. The
transport layer controls the reliability of a given link. The transport layer can keep track
of packets and retransmit those that fail. Also addresses packet sequencing. The best
known example of a layer 4 protocol is TCP.
Layer 3 - Network layer
- answers-The network layer provides the functional and procedural means of
transferring variable length data sequences from a source to a destination via one or
more networks while maintaining the quality of service requested by the Transport layer.
The Network layer performs network routing, flow control,
segmentation/desegmentation, and error control functions. Routers operate at this layer
-- sending data throughout the extended network
Layer 2 - Data link layer
- answers-The data link layer provides the functional and procedural means to transfer
data between network entities and to detect and possibly correct errors that may occur
in the Physical layer. The addressing scheme is physical which means that the
