| Other CISA Certification Interview Questions |
| |
| Question | Asked @ | Answers |
| |
| An IS auditor reviewing an organization's IS disaster
recovery plan should verify that it is:
A. tested every 6 months.
B. regularly reviewed and updated.
C. approved by the chief executive officer (CEO).
D. communicated to every departmental head in the organization. | | 2 |
| For an online transaction processing system, transactions
per second is a measure of:
A. throughput.
B. response time.
C. turnaround time.
D. uptime. | | 1 |
| The secure socket layer (SSL) protocol addresses the
confidentiality of a message through:
A. symmetric encryption.
B. message authentication code.
C. hash function.
D. digital signature certificates. | | 1 |
| An IS auditor conducting a review of disaster recovery
planning at a financial processing organization has
discovered the following:
* The existing disaster recovery plan was compiled two years
ago by a systems analyst in the organization's IT department
using transaction flow projections from the operations
department.
* The plan was presented to the deputy CEO for approval and
formal issue, but it is still awaiting his attention.
* The plan has never been updated, tested or circulated to
key management and staff, though interviews show that each
would know what action to take for their area in the event
of a disruptive incident.
The basis of an organization's disaster recovery plan is to
reestablish live processing at an alternative site where a
similar, but not identical hardware configuration is already
established. The IS auditor should:
A. take no action as the lack of a current plan is the only
significant finding.
B. recommend that the hardware configuration at each site
should be identical.
C. perform a review to verify that the second configuration
can support live processing.
D. report that the financial expenditure on the alternative
site is wasted without an effective plan. | | 1 |
| In a risk-based audit approach, an IS auditor should FIRST
complete : | | 3 |
| When performing a review of the structure of an electronic
funds transfer (EFT) system, an IS auditor observes that the
technological infrastructure is based on a centralized
processing scheme that has been outsourced to a provider in
another country. Based on this information, which of the
following conclusions should be the main concern of the IS
auditor?
A. There could be a question with regards to the legal
jurisdiction.
B. Having a provider abroad will cause excesive costs in
future audits.
C. The auditing process will be difficult because of the
distances.
D. There could be different auditing norms. | | 2 |
| The responsibility for designing, implementing and
maintaining a system of internal control lies with:
A. the IS auditor.
B. management.
C. the external auditor.
D. the programming staff. | | 1 |
| When an organization's network is connected to an external
network in an Internet client-server model not under that
organization's control, security becomes a concern. In
providing adequate security in this environment, which of
the following assurance levels is LEAST important?
A. Server and client authentication
B. Data integrity
C. Data recovery
D. Data confidentiality | | 1 |
| Which of the following findings would an IS auditor be MOST
concerned about when performing an audit of backup and
recovery and the offsite storage vault?
A. There are three individuals with a key to enter the area.
B. Paper documents also are stored in the offsite vault.
C. Data files, which are stored in the vault, are synchronized.
D. The offsite vault is located in a separate facility. | | 1 |
| Which audit technique provides the BEST evidence of the
segregation of duties in an IS department?
A. Discussion with management
B. Review of the organization chart
C. Observation and interviews
D. Testing of user access rights | | 1 |
| An organization is proposing to install a single sign-on
facility giving access to all systems. The organization
should be aware that:
A. Maximum unauthorized access would be possible if a
password is disclosed.
B. User access rights would be restricted by the additional
security parameters.
C. The security administrator?s workload would increase.
D. User access rights would be increased. | | 1 |
| During an audit, an IS auditor learns that lengthy and
complex passwords are required to reach the network via
modem. These passwords were established by an outside
provider. The communications software allows users to select
a ?remember password? option. What should the IS auditor's
PRIMARY recommendation be?
A. Disable the save password option and have users record
them elsewhere.
B. Request that the provider change the dial-in password to
a group password.
C. Establish and enforce a process to have users change
their passwords.
D. Allow users to change their passwords to something less
complex. | | 1 |
| Classification of information systems is essential in
business continuity planning. Which of the following system
types can not be replaced by manual methods?
A. Critical system
B. Vital system
C. Sensitive system
D. Non-critical system | | 1 |
| A validation which ensures that input data are matched to
predetermined reasonable limits or occurrence rates, is
known as:
A. Reasonableness check.
B. Validity check.
C. Existence check.
D. Limit check. | | 2 |
| Which of the following would be of MOST concern to an IS
auditor reviewing a VPN implementation? Computers on the
network that are located:
A. on the enterprise's facilities.
B. at the backup site.
C. in employees' homes.
D. at the enterprise's remote offices. | | 1 |
| One of the purposes of library control software is to allow:
A. programmers access to production source and object libraries.
B. batch program updating.
C. operators to update the control library with the
production version before testing is completed.
D. read-only access to source code. | | 1 |
| The PRIMARY purpose of undertaking a parallel run of a new
system is to:
A. verify that the system provides required business
functionality.
B. validate the operation of the new system against its
predecessor.
C. resolve any errors in the program and file interfaces.
D. verify that the system can process the production load. | | 2 |
| A key element in a risk analysis is/are:
A. audit planning.
B. controls.
C. vulnerabilities.
D. liabilities. | | 1 |
| A control that detects transmission errors by appending
calculated bits onto the end of each segment of data is
known as a:
A. reasonableness check.
B. parity check.
C. redundancy check.
D. check digits. | | 2 |
| Which of the following types of risks assumes an absence of
compensating controls in the area being reviewed?
A. Control risk
B. Detection risk
C. Inherent risk
D. Sampling risk | | 1 |
| |
| For more CISA Certification Interview Questions Click Here |
Site Map