| Other CISA Certification Interview Questions |
| |
| Question | Asked @ | Answers |
| |
| Structured programming is BEST described as a technique that:
A. provides knowledge of program functions to other
programmers via peer reviews.
B. reduces the maintenance time of programs by the use of
small-scale program modules.
C. makes the readable coding reflect as closely as possible
the dynamic execution of the program.
D. controls the coding and testing of the high-level
functions of the program in the development process. | | 1 |
| When reviewing a business process reengineering (BPR)
project, which of the following is the MOST important for an
IS auditor to evaluate?
A. The impact of removed controls.
B. The cost of new controls.
C. The BPR project plans.
D. The continuous improvement and monitoring plans. | | 1 |
| An IS auditor is performing an audit of a network operating
system. Which of the following is a user feature the IS
auditor should review?
A. Availability of online network documentation
B. Support of terminal access to remote hosts
C. Handling file transfer between hosts and inter-user
communications
D. Performance management, audit and control | | 1 |
| Disaster recovery planning for a company's computer system
usually focuses on:
A. operations turnover procedures.
B. strategic long-range planning.
C. the probability that a disaster will occur.
D. alternative procedures to process transactions. | | 1 |
| The development of an IS security policy is ultimately the
responsibility of the:
A. IS department.
B. security committee.
C. security administrator.
D. board of directors. | | 1 |
| Which of the following is a function of an IS steering
committee?
A. Monitoring vendor controlled change control and testing
B. Ensuring a separation of duties within the information's
processing environment
C. Approving and monitoring major projects, the status of IS
plans and budgets
D. Responsible for liaison between the IS department and the
end users | | 1 |
| IS auditors are MOST likely to perform compliance tests of
internal controls if, after their initial evaluation of the
controls, they conclude that:
A. a substantive test would be too costly.
B. the control environment is poor.
C. inherent risk is low.
D. control risks are within the acceptable limits. | | 2 |
| During an implementation review of a multiuser distributed
application, the IS auditor finds minor weaknesses in three
areas-the initial setting of parameters is improperly
installed, weak passwords are being used and some vital
reports are not being checked properly. While preparing the
audit report, the IS auditor should:
A. record the observations separately with the impact of
each of them marked against each respective finding.
B. advise the manager of probable risks without recording
the observations, as the control weaknesses are minor ones.
C. record the observations and the risk arising from the
collective weaknesses.
D. apprise the departmental heads concerned with each
observation and properly document it in the report. | | 1 |
| Which of the following data entry controls provides the
GREATEST assurance that the data is entered correctly?
A. Using key verification
B. Segregating the data entry function from data entry
verification
C. Maintaining a log/record detailing the time, date,
employee's initials/user id and progress of various data
preparation and verification tasks
D. Adding check digits | | 1 |
| Which of the following IS functions may be performed by the
same individual, without compromising on control or
violating segregation of duties?
A. Job control analyst and applications programmer
B. Mainframe operator and system programmer
C. Change/problem and quality control administrator
D. Applications and system programmer | | 4 |
| An enterprisewide network security architecture of public
key infrastructure (PKI) would be comprised of:
A. A public key cryptosystem, private key cryptosystem and
digital certificate
B. A public key cryptosystem, symmetric encryption and
certificate authorities
C. A symmetric encryption, digital certificate and kerberos
authentication
D. A public key cryptosystem, digital certificate and
certificate authorities | | 1 |
| The PRIMARY objective of a firewall is to protect:
A. internal systems from exploitation by external threats.
B. external systems from exploitation by internal threats.
C. internal systems from exploitation by internal threats.
D. itself and attached systems against being used to attack
other systems. | | 1 |
| To prevent an organization's computer systems from becoming
part of a distributed denial-of-service attack, IP packets
containing addresses that are listed as unroutable can be
isolated by:
A. establishing outbound traffic filtering.
B. enabling broadcast blocking.
C. limiting allowable services.
D. network performance monitoring. | | 1 |
| A company performs full backup of data and programs on a
regular basis. The primary purpose of this practice is to:
A. maintain data integrity in the applications.
B. restore application processing after a disruption.
C. prevent unauthorized changes to programs and data.
D. ensure recovery of data processing in case of a disaster. | | 1 |
| Before reporting results of an audit to senior management,
an IS auditor should:
A. Confirm the findings with auditees.
B. Prepare an executive summary and send it to auditee
management.
C. Define recommendations and present the findings to the
audit committee.
D. Obtain agreement from the auditee on findings and actions
to be taken. | | 1 |
| The process of using interpersonal communication skills to
get unauthorized access to company assets is called:
A. wire tapping.
B. trap doors.
C. war dialing.
D. social engineering. | | 1 |
| When developing a risk management program, the FIRST
activity to be performed is a/an:
A. threats assessment.
B. classification of data.
C. inventory of assets.
D. criticality analysis. | | 1 |
| An IS auditor evaluating data integrity in a transaction
driven system environment should review atomicity, to
determine whether:
A. the database survives failures (hardware or software).
B. each transaction is separated from other transactions.
C. integrity conditions are maintained.
D. a transaction is completed or not, or a database is
updated or not. | | 1 |
| Once an organization has finished the business process
reengineering (BPR) of all its critical operations, the IS
auditor would MOST likely focus on a review of:
A. pre-BPR process flowcharts.
B. post-BPR process flowcharts.
C. BPR project plans.
D. continuous improvement and monitoring plans. | | 1 |
| A sequence of bits appended to a digital document that is
used to secure an e-mail sent through the Internet is called a:
A. digest signature.
B. electronic signature.
C. digital signature.
D. hash signature. | | 1 |
| |
| For more CISA Certification Interview Questions Click Here |
To Refer this Site to Your Friends 
Site Map
