CISA EXAM QUESTIONS WITH CORRECT
ANSWERS
Source code - CORRECT ANSWER✔✔-uncompiled, archive code
| | | | | |
Object code - CORRECT ANSWER✔✔-compiled code that is distributed
| | | | | | | | |
and put into production; not able to be read by humans
| | | | | | | | | |
Inherent risk - CORRECT ANSWER✔✔-the risk that an error could occur
| | | | | | | | | | |
assuming no compensating control exist
| | | |
Control risk - CORRECT ANSWER✔✔-the risk that an error exists that
| | | | | | | | | | |
would not be prevented by internal controls
| | | | | |
Detection risk - CORRECT ANSWER✔✔-the risk that an error exists, but
| | | | | | | | | | |
is not detected. The risk that an IS auditor may use an inadequate test
| | | | | | | | | | | | | |
procedure and conclude that no material error exists when in fact errors
| | | | | | | | | | |
|do exist.
|
Audit risk - CORRECT ANSWER✔✔-the overall level of risk; the level of
| | | | | | | | | | | |
risk the auditor is prepared to accept.
| | | | | |
,Compliance testing - CORRECT ANSWER✔✔-determines if controls are
| | | | | | | |
being applied in a manner that complies with mgmt's policies and
| | | | | | | | | | |
procedures
Substantive testing - CORRECT ANSWER✔✔-evaluates the integrity of
| | | | | | | |
individual transactions, data, and other information.
| | | | |
Regression testing - CORRECT ANSWER✔✔-used to retest earlier
| | | | | | | |
program abends that occurred during the initial testing phase.
| | | | | | | |
Sociability testing - CORRECT ANSWER✔✔-to ensure the application
| | | | | | | |
works as expected in the specified environment where other
| | | | | | | | |
applications run concurrently. Includes testing of interfaces with other
| | | | | | | | |
systems.
Parallel testing - CORRECT ANSWER✔✔-Feeding test data into two
| | | | | | | | |
systems and comparing the results.
| | | |
White box testing - CORRECT ANSWER✔✔-test the software's program
| | | | | | | | |
logic.
Black box testing - CORRECT ANSWER✔✔-Testing the functional
| | | | | | | |
operating effectiveness without regard to internal program structure.
| | | | | | |
,Redundancy check - CORRECT ANSWER✔✔-detects transmission errors
| | | | | | |
by appending calculated bits onto the end of each segment of data.
| | | | | | | | | | |
Variable sampling - CORRECT ANSWER✔✔-used to estimate the average
| | | | | | | |
or total value of a population.
| | | | | |
Discovery sampling - CORRECT ANSWER✔✔-used to determine the
| | | | | | | |
probability of finding an attribute in a population.
| | | | | | |
Attribute sampling - CORRECT ANSWER✔✔-selecting items from a
| | | | | | | |
population based on a common attribute. Used for compliance testing.
| | | | | | | | |
Chapter 2 - CORRECT ANSWER✔✔-
| | | |
Steering Committee - CORRECT ANSWER✔✔-Appointed by senior
| | | | | | |
management. Serves as a general review board for projects and
| | | | | | | | | |
acquisitions... not involved in routine operations. The committee should
| | | | | | | | |
include representatives from senior management, user management,
| | | | | | |
and the IS department. Escalates issues to senior management.
| | | | | | | |
Request for Proposal (RFP) - CORRECT ANSWER✔✔-A document
| | | | | | | |
distributed to software vendors requesting their submission of a
| | | | | | | | |
proposal to develop or provide a software product. RFP should include:
| | | | | | | | | | |
, Project Overview, Key Requirements and Constraints, Scope Limitations,
| | | | | | | |
Vendor questionnaire, customer references, demonstrations, etc.
| | | | |
Quality Assurance - CORRECT ANSWER✔✔-Check to verify policies are
| | | | | | | | |
followed.
Quality Control - CORRECT ANSWER✔✔-Check to verify free from
| | | | | | | | |
defects.
Bottom-up approach for policy development - CORRECT ANSWER✔✔-
| | | | | | |
begins by defining operational-level requirements and policies which
| | | | | | | |
are derived and implemented as a result of a risk assessment.
| | | | | | | | | |
Chapter 3 - CORRECT ANSWER✔✔-
| | | |
OSI Model - CORRECT ANSWER✔✔-All People Seem To Need Dominos
| | | | | | | | | |
Pizza
Layer 7 - Application layer - CORRECT ANSWER✔✔-The application layer
| | | | | | | | |
interfaces directly to and performs common application services for the
| | | | | | | | | |
application processes.
| |
Layer 6 - Presentation layer - CORRECT ANSWER✔✔-The presentation
| | | | | | | | |
layer relieves the Application layer of concern regarding syntactical
| | | | | | | | |
ANSWERS
Source code - CORRECT ANSWER✔✔-uncompiled, archive code
| | | | | |
Object code - CORRECT ANSWER✔✔-compiled code that is distributed
| | | | | | | | |
and put into production; not able to be read by humans
| | | | | | | | | |
Inherent risk - CORRECT ANSWER✔✔-the risk that an error could occur
| | | | | | | | | | |
assuming no compensating control exist
| | | |
Control risk - CORRECT ANSWER✔✔-the risk that an error exists that
| | | | | | | | | | |
would not be prevented by internal controls
| | | | | |
Detection risk - CORRECT ANSWER✔✔-the risk that an error exists, but
| | | | | | | | | | |
is not detected. The risk that an IS auditor may use an inadequate test
| | | | | | | | | | | | | |
procedure and conclude that no material error exists when in fact errors
| | | | | | | | | | |
|do exist.
|
Audit risk - CORRECT ANSWER✔✔-the overall level of risk; the level of
| | | | | | | | | | | |
risk the auditor is prepared to accept.
| | | | | |
,Compliance testing - CORRECT ANSWER✔✔-determines if controls are
| | | | | | | |
being applied in a manner that complies with mgmt's policies and
| | | | | | | | | | |
procedures
Substantive testing - CORRECT ANSWER✔✔-evaluates the integrity of
| | | | | | | |
individual transactions, data, and other information.
| | | | |
Regression testing - CORRECT ANSWER✔✔-used to retest earlier
| | | | | | | |
program abends that occurred during the initial testing phase.
| | | | | | | |
Sociability testing - CORRECT ANSWER✔✔-to ensure the application
| | | | | | | |
works as expected in the specified environment where other
| | | | | | | | |
applications run concurrently. Includes testing of interfaces with other
| | | | | | | | |
systems.
Parallel testing - CORRECT ANSWER✔✔-Feeding test data into two
| | | | | | | | |
systems and comparing the results.
| | | |
White box testing - CORRECT ANSWER✔✔-test the software's program
| | | | | | | | |
logic.
Black box testing - CORRECT ANSWER✔✔-Testing the functional
| | | | | | | |
operating effectiveness without regard to internal program structure.
| | | | | | |
,Redundancy check - CORRECT ANSWER✔✔-detects transmission errors
| | | | | | |
by appending calculated bits onto the end of each segment of data.
| | | | | | | | | | |
Variable sampling - CORRECT ANSWER✔✔-used to estimate the average
| | | | | | | |
or total value of a population.
| | | | | |
Discovery sampling - CORRECT ANSWER✔✔-used to determine the
| | | | | | | |
probability of finding an attribute in a population.
| | | | | | |
Attribute sampling - CORRECT ANSWER✔✔-selecting items from a
| | | | | | | |
population based on a common attribute. Used for compliance testing.
| | | | | | | | |
Chapter 2 - CORRECT ANSWER✔✔-
| | | |
Steering Committee - CORRECT ANSWER✔✔-Appointed by senior
| | | | | | |
management. Serves as a general review board for projects and
| | | | | | | | | |
acquisitions... not involved in routine operations. The committee should
| | | | | | | | |
include representatives from senior management, user management,
| | | | | | |
and the IS department. Escalates issues to senior management.
| | | | | | | |
Request for Proposal (RFP) - CORRECT ANSWER✔✔-A document
| | | | | | | |
distributed to software vendors requesting their submission of a
| | | | | | | | |
proposal to develop or provide a software product. RFP should include:
| | | | | | | | | | |
, Project Overview, Key Requirements and Constraints, Scope Limitations,
| | | | | | | |
Vendor questionnaire, customer references, demonstrations, etc.
| | | | |
Quality Assurance - CORRECT ANSWER✔✔-Check to verify policies are
| | | | | | | | |
followed.
Quality Control - CORRECT ANSWER✔✔-Check to verify free from
| | | | | | | | |
defects.
Bottom-up approach for policy development - CORRECT ANSWER✔✔-
| | | | | | |
begins by defining operational-level requirements and policies which
| | | | | | | |
are derived and implemented as a result of a risk assessment.
| | | | | | | | | |
Chapter 3 - CORRECT ANSWER✔✔-
| | | |
OSI Model - CORRECT ANSWER✔✔-All People Seem To Need Dominos
| | | | | | | | | |
Pizza
Layer 7 - Application layer - CORRECT ANSWER✔✔-The application layer
| | | | | | | | |
interfaces directly to and performs common application services for the
| | | | | | | | | |
application processes.
| |
Layer 6 - Presentation layer - CORRECT ANSWER✔✔-The presentation
| | | | | | | | |
layer relieves the Application layer of concern regarding syntactical
| | | | | | | | |
