| Other CISA Certification Interview Questions |
| |
| Question | Asked @ | Answers |
| |
| Involvement of senior management is MOST important in the
development of:
A. strategic plans.
B. IS policies.
C. IS procedures.
D. standards and guidelines. | | 1 |
| The BEST time to perform a control self-assessment involving
line management, line staff and the audit department is at
the time of:
A. compliance testing.
B. the preliminary survey.
C. substantive testing.
D. the preparation of the audit report. | | 1 |
| Which of the following is a feature of an intrusion
detection system (IDS)?
A. Gathering evidence on attack attempts
B. Identifying weakness in the policy definition
C. Blocking access to particular sites on the Internet
D. Preventing certain users from accessing specific servers | | 1 |
| At the end of the testing phase of software development, an
IS auditor observes that an intermittent software error has
not been corrected. No action has been taken to resolve the
error. The IS auditor should:
A. report the error as a finding and leave further
exploration to the auditee's discretion.
B. attempt to resolve the error.
C. recommend that problem resolution be escalated.
D. ignore the error, as it is not possible to get objective
evidence for the software error. | | 1 |
| Connection-oriented protocols in the TCP/IP suite are
implemented in the:
A. transport layer.
B. application layer.
C. physical layer.
D. network layer. | | 1 |
| During an audit of an enterprise that is dedicated to
e-commerce, the IS manager states that digital signatures
are used in the establishment of its commercial relations.
To substantiate this, the IS auditor must prove that which
of the following is used?
A. A biometric, digitalized and encrypted parameter with the
customer's public key
B. A hash of the data that is transmitted and encrypted with
the customer's private key
C. A hash of the data that is transmitted and encrypted with
the customer's public key
D. The customer's scanned signature, encrypted with the
customer's public key | | 1 |
| An audit charter should:
A. be dynamic and change often to coincide with the changing
nature of technology and the audit profession.
B. clearly state audit objectives for the delegation of
authority for the maintenance and review of internal controls.
C. document the audit procedures designed to achieve the
planned audit objectives.
D. outline the overall authority, scope and responsibilities
of the audit function. | | 1 |
| Which of the following controls would be MOST effective in
ensuring that production source code and object code are
synchronized?
A. Release-to-release source and object comparison reports
B. Library control software restricting changes to source code
C. Restricted access to source code and object code
D. Date and time-stamp reviews of source and object code | | 2 |
| A team conducting a risk analysis is having difficulty
projecting the financial losses that could result from a
risk. To evaluate the potential losses the team should:
A. compute the amortization of the related assets.
B. calculate a return on investment (ROI).
C. apply a qualitative approach.
D. spend the time needed to define exactly the loss amount. | | 1 |
| Corrective action has been taken by an auditee immediately
after the identification of a reportable finding. The
auditor should:
A. include the finding in the final report because the IS
auditor is responsible for an accurate report of all findings.
B. not include the finding in the final report because the
audit report should include only unresolved findings.
C. not include the finding in the final report because
corrective action can be verified by the IS auditor during
the audit.
D. include the finding in the closing meeting for discussion
purposes only. | | 2 |
| The purpose for requiring source code escrow in a
contractual agreement is to:
A. ensure the source code is available if the vendor ceases
to exist.
B. permit customization of the software to meet specified
business requirements.
C. review the source code for adequacy of controls.
D. ensure the vendor has complied with legal requirements. | | 1 |
| To identify the value of inventory that has been kept for
more than eight weeks, an IS auditor would MOST likely use:
A. test data.
B. statistical sampling.
C. an integrated test facility.
D. generalized audit software. | | 1 |
| Data flow diagrams are used by IS auditors to:
A. order data hierarchically.
B. highlight high-level data definitions.
C. graphically summarize data paths and storage.
D. portray step-by-step details of data generation. | | 1 |
| Which of the following is a control over component
communication failure/errors?
A. Restricting operator access and maintaining audit trails
B. Monitoring and reviewing system engineering activity
C. Providing network redundancy
D. Establishing physical barriers to the data transmitted
over the network | | 1 |
| IS auditors, in performing detailed network assessments and
access control reviews should FIRST:
A. determine the points of entry.
B. evaluate users access authorization.
C. assess users identification and authorization.
D. evaluate the domain-controlling server configuration. | | 2 |
| Which of the following hardware devices relieves the central
computer from performing network control, format conversion
and message handling tasks?
A. Spool
B. Cluster controller
C. Protocol converter
D. Front end processor | | 1 |
| Which of the following is a disadvantage of image processing?
A. Verifies signatures
B. Improves service
C. Relatively inexpensive to use
D. Reduces deterioration due to handling | | 1 |
| The primary purpose of an audit charter is to:
A. document the audit process used by the enterprise.
B. formally document the audit department's plan of action.
C. document a code of professional conduct for the auditor.
D. describe the authority and responsibilities of the audit
department. | | 1 |
| During an audit of a telecommunications system the IS
auditor finds that the risk of intercepting data transmitted
to and from remote sites is very high. The MOST effective
control for reducing this exposure is:
A. encryption.
B. callback modems.
C. message authentication.
D. dedicated leased lines. | | 2 |
| Which of the following database administrator (DBA)
activities is unlikely to be recorded on detective control logs?
A. Deletion of a record
B. Change of a password
C. Disclosure of a password
D. Changes to access rights | | 1 |
| |
| For more CISA Certification Interview Questions Click Here |
along with your userid / name. ThanQ
Site Map
