| Other CISA Certification Interview Questions |
| |
| Question | Asked @ | Answers |
| |
| In a small organization, an employee performs computer
operations and, when the situation demands, program
modifications. Which of the following should the IS auditor
recommend?
A. Automated logging of changes to development libraries
B. Additional staff to provide separation of duties
C. Procedures that verify that only approved program changes
are implemented
D. Access controls to prevent the operator from making
program modifications | | 1 |
| An IS auditor performing an application maintenance audit
would review the log of program changes for the:
A. authorization for program changes.
B. creation date of a current object module.
C. number of program changes actually made.
D. creation date of a current source program. | | 1 |
| An IS auditor discovers that an organization?s business
continuity plan provides for an alternate processing site
that will accommodate fifty percent of the primary
processing capability. Based on this, which of the following
actions should the IS auditor take?
A. Do nothing, because generally, less than twenty-five
percent of all processing is critical to an organization?s
survival and the backup capacity, therefore is adequate.
B. Identify applications that could be processed at the
alternate site and develop manual procedures to backup other
processing.
C. Ensure that critical applications have been identified
and that the alternate site could process all such applications.
D. Recommend that the information processing facility
arrange for an alternate processing site with the capacity
to handle at least seventy-five percent of normal processing. | | 1 |
| Which of the following tests is an IS auditor performing
when a sample of programs is selected to determine if the
source and object versions are the same?
A. A substantive test of program library controls
B. A compliance test of program library controls
C. A compliance test of the program compiler controls
D. A substantive test of the program compiler controls | | 1 |
| The use of a GANTT chart can:
A. aid in scheduling project tasks.
B. determine project checkpoints.
C. ensure documentation standards.
D. direct the post-implementation review. | | 1 |
| Which of the following tests performed by an IS auditor
would be the MOST effective in determining compliance with
an organization's change control procedures?
A. Review software migration records and verify approvals.
B. Identify changes that have occurred and verify approvals.
C. Review change control documentation and verify approvals.
D. Ensure that only appropriate staff can migrate changes
into production. | | 1 |
| Which of the following forms of evidence for the auditor
would be considered the MOST reliable?
A. An oral statement from the auditee
B. The results of a test performed by an IS auditor
C. An internally generated computer accounting report
D. A confirmation letter received from an outside source | | 1 |
| In a risk-based audit approach, an IS auditor, in addition
to risk, would be influenced by:
A. the availability of CAATs.
B. management's representation.
C. organizational structure and job responsibilities.
D. the existence of internal and operational controls | | 1 |
| Which of the following programs would a sound information
security policy MOST likely include to handle suspected
intrusions?
A. Response
B. Correction
C. Detection
D. Monitoring | | 1 |
| Disaster recovery planning for a company's computer system
usually focuses on:
A. operations turnover procedures.
B. strategic long-range planning.
C. the probability that a disaster will occur.
D. alternative procedures to process transactions. | | 1 |
| Which of the following is a function of an IS steering
committee?
A. Monitoring vendor controlled change control and testing
B. Ensuring a separation of duties within the information's
processing environment
C. Approving and monitoring major projects, the status of IS
plans and budgets
D. Responsible for liaison between the IS department and the
end users | | 1 |
| Which of the following would provide a mechanism whereby IS
management can determine if the activities of the
organization have deviated from the planned or expected levels?
A. Quality management
B. IS assessment methods
C. Management principles
D. Industry standards/benchmarking | | 1 |
| Controls designed to ensure that unauthorized changes are
not made to information residing in a computer file are
known as:
A. data security controls.
B. implementation controls.
C. program security controls.
D. computer operations controls. | | 1 |
| Which of the following is the MOST likely reason why e-mail
systems have become a useful source of evidence for litigation?
A. Multiple cycles of backup files remain available.
B. Access controls establish accountability for e-mail activity.
C. Data classification regulates what information should be
communicated via e-mail.
D. Within the enterprise, a clear policy for using e-mail
ensures that evidence is available. | | 1 |
| Which of the following is the initial step in creating a
firewall policy?
A. A cost-benefits analysis of methods for securing the
applications
B. Identification of network applications to be externally
accessed
C. Identification of vulnerabilities associated with network
applications to be externally accessed
D. Creation of an applications traffic matrix showing
protection methods | | 1 |
| A validation which ensures that input data are matched to
predetermined reasonable limits or occurrence rates, is
known as:
A. Reasonableness check.
B. Validity check.
C. Existence check.
D. Limit check. | | 2 |
| An organization acquiring other businesses continues using
its legacy EDI systems, and uses three separate value added
network (VAN) providers. No written VAN agreements exist.
The IS auditor should recommend that management:
A. obtain independent assurance of the third party service
providers.
B. set up a process for monitoring the service delivery of
the third party.
C. ensure that formal contracts are in place.
D. consider agreements with third party service providers in
the development of continuity plans. | | 1 |
| Which of the following is an advantage of an integrated test
facility (ITF)?
A. It uses actual master files or dummies and the IS auditor
does not have to review the source of the transaction.
B. Periodic testing does not require separate test processes.
C. It validates application systems and tests the ongoing
operation of the system.
D. It eliminates the need to prepare test data. | | 1 |
| Which of the following is MOST effective in controlling
application maintenance?
A. Informing users of the status of changes
B. Establishing priorities on program changes
C. Obtaining user approval of program changes
D. Requiring documented user specifications for changes | | 1 |
| A data administrator is responsible for:
A. maintaining database system software.
B. defining data elements, data names and their relationship.
C. developing physical database structures.
D. developing data dictionary system software. | | 1 |
| |
| For more CISA Certification Interview Questions Click Here |
along with your userid / name. ThanQ
Site Map