| Other CISA Certification Interview Questions |
| |
| Question | Asked @ | Answers |
| |
| Connection-oriented protocols in the TCP/IP suite are
implemented in the:
A. transport layer.
B. application layer.
C. physical layer.
D. network layer. | | 1 |
| When reviewing a business process reengineering (BPR)
project, which of the following is the MOST important for an
IS auditor to evaluate?
A. The impact of removed controls.
B. The cost of new controls.
C. The BPR project plans.
D. The continuous improvement and monitoring plans. | | 1 |
| Which of the following would an IS auditor place LEAST
reliance on when determining management's effectiveness in
communicating information systems policies to appropriate
personnel?
A. Interviews with user and IS personnel
B. Minutes of IS steering committee meetings
C. User department systems and procedures manuals
D.Information processing facilities operations and
procedures manuals | | 1 |
| An IS auditor recommends that an initial validation control
be programmed into a credit card transaction capture
application. The initial validation process would MOST likely:
A. check to ensure the type of transaction is valid for that
card type.
B. verify the format of the number entered then locate it on
the database.
C. ensure that the transaction entered is within the
cardholder's credit limit.
D. confirm that the card is not shown as lost or stolen on
the master file. | | 1 |
| Which of the following is the MOST reasonable option for
recovering a noncritical system?
A. Warm site
B. Mobile site
C. Hot site
D. Cold site | | 2 |
| Which of the following BEST determines that complete
encryption and authentication protocols exist for protecting
information while transmitted?
A. A digital signature with RSA has been implemented.
B. Work is being done in tunnel mode with the nested
services of AH and ESP
C. Digital certificates with RSA are being used.
D. Work is being done in transport mode, with the nested
services of AH and ESP | | 1 |
| Which of the following business recovery strategies would
require the least expenditure of funds?
A. Warm site facility
B. Empty shell facility
C. Hot site subscription
D. Reciprocal agreement | | 1 |
| Which of the following is the FIRST thing an IS auditor
should do after the discovery of a trojan horse program in a
computer system?
A. Investigate the author.
B. Remove any underlying threats.
C. Establish compensating controls.
D. Have the offending code removed. | | 1 |
| Which of the following audit procedures would MOST likely be
used in an audit of a systems development project?
A. Develop test transactions
B. Use code comparison utilities
C. Develop audit software programs
D. Review functional requirements documentation | | 1 |
| Which of the following procedures should be implemented to
help ensure the completeness of inbound transactions via
electronic data interchange (EDI)?
A. Segment counts built into the transaction set trailer
B. A log of the number of messages received, periodically
verified with the transaction originator
C. An electronic audit trail for accountability and tracking
D. Matching acknowledgement transactions received to the log
of EDI messages sent | | 2 |
| A TCP/IP-based environment is exposed to the Internet. Which
of the following BEST ensures that complete encryption and
authentication protocols exist for protecting information
while transmitted?
A. Work is completed in tunnel mode with IP security using
the nested services of authentication header (AH) and
encapsulating security payload (ESP).
B. A digital signature with RSA has been implemented.
C. Digital certificates with RSA are being used.
D. Work is being completed in.TCP services. | | 1 |
| Disaster recovery planning addresses the:
A. technological aspect of business continuity planning.
B. operational piece of business continuity planning.
C. functional aspect of business continuity planning.
D. overall coordination of business continuity planning. | | 1 |
| Using test data as part of a comprehensive test of program
controls in a continuous online manner is called a/an:
A. test data/deck.
B. base case system evaluation.
C. integrated test facility (ITF).
D. parallel simulation. | | 1 |
| If an application program is modified and proper system
maintenance procedures are in place, which of the following
should be tested? The:
A. integrity of the database
B. access controls for the applications programmer
C. complete program, including any interface systems
D. segment of the program containing the revised code | | 1 |
| An IS auditor performing a telecommunication access control
review should be concerned PRIMARILY with the:
A. maintenance of access logs of usage of various system
resources.
B. authorization and authentication of the user prior to
granting access to system resources.
C. adequate protection of stored data on servers by
encryption or other means.
D. accountability system and the ability to identify any
terminal accessing system resources. | | 2 |
| Which of the following access control functions is LEAST
likely to be performed by a database management system
(DBMS) software package?
A. User access to field data
B. User sign-on at the network level
C. User authentication at the program level
D. User authentication at the transaction level | | 1 |
| Which of the following would an IS auditor consider a
weakness when performing an audit of an organization that
uses a public key infrastructure with digital certificates
for its business-to-consumer transactions via the Internet?
A. Customers are widely dispersed geographically, but not
the certificate authorities.
B. Customers can make their transactions from any computer
or mobile device.
C. The certificate authority has several data processing
subcenters to administrate certificates.
D. The organization is the owner of the certificate authority. | | 1 |
| An organization's disaster recovery plan should address
early recovery of:
A. all information systems processes.
B. all financial processing applications.
C. only those applications designated by the IS manager.
D. processing in priority order, as defined by business
management. | | 1 |
| Which of the following provides nonrepudiation services for
e-commerce transactions?
A. Public key infrastructure (PKI)
B. Data encryption standard (DES)
C. Message authentication code (MAC)
D. Personal identification number (PIN) | | 1 |
| A B-to-C e-commerce web site as part of its information
security program wants to monitor, detect and prevent
hacking activities and alert the system administrator when
suspicious activities occur. Which of the following
infrastructure components could be used for this purpose?
A. Intrusion detection systems
B. Firewalls
C. Routers
D. Asymmetric encryption | | 1 |
| |
| For more CISA Certification Interview Questions Click Here |
To Refer this Site to Your Friends 
Site Map