| Other CISA Certification Interview Questions |
| |
| Question | Asked @ | Answers |
| |
| IS auditors reviewing access control should review data
classification to ensure that encryption parameters are
classified as:
A. sensitive.
B. confidential.
C. critical.
D. private. | | 1 |
| Which of the following would enable an enterprise to provide
access to its intranet (i.e., extranet) across the Internet
to its business partners?
A. Virtual private network
B. Client-server
C. Dial-in access
D. Network service provider | | 1 |
| Which of the following provides the GREATEST assurance of
message authenticity?
A. The pre-hash code is derived mathematically from the
message being sent.
B. The pre-hash code is encrypted using the sender's private
key.
C. Encryption of the pre-hash code and the message using the
secret key.
D. Sender attains the recipient's public key and verifies
the authenticity of its digital certificate with a
certificate authority. | | 1 |
| Which of the following can be used to verify output results
and control totals by matching them against the input data
and control totals?
A. Batch header forms
B. Batch balancing
C. Data conversion error corrections
D. Access controls over print spools | | 1 |
| The database administrator has recently informed you of the
decision to disable certain normalization controls in the
database management system (DBMS) software to provide users
with increased query performance. This will MOST likely
increase the risk of:
A. loss of audit trails.
B. redundancy of data.
C. loss of data integrity.
D. unauthorized access to data. | | 1 |
| An IS auditor finds that not all employees are aware of the
enterprise's information security policy. The IS auditor
should conclude that:
A. this lack of knowledge may lead to unintentional
disclosure of sensitive information.
B. information security is not critical to all functions.
C. IS audit should provide security training to the employees.
D. the audit finding will cause management to provide
continuous training to staff. | | 1 |
| Which of the following imaging technologies captures
handwriting from a preprinted form and converts it into an
electronic format?
A. Magnetic ink character recognition (MICR)
B. Intelligent voice recognition (IVR)
C. Bar code recognition (BCR)
D. Optical character recognition (OCR) | | 1 |
| The extent to which data will be collected during an IS
audit should be determined, based on the:
A. availability of critical and required information.
B. auditor's familiarity with the circumstances.
C. auditee's ability to find relevant evidence.
D. purpose and scope of the audit being done. | | 1 |
| Which of the following should concern an IS auditor when
reviewing security in a client-server environment?
A. Data is protected by an encryption technique.
B. Diskless workstations prevent unauthorized access.
C. Ability of users to access and modify the database directly.
D. Disabling floppy drives on the users machines. | | 1 |
| The PRIMARY reason for separating the test and development
environments is to:
A. restrict access to systems under test.
B. segregate user and development staff.
C. control the stability of the test environment.
D. secure access to systems under development. | | 1 |
| Which of the following BEST describes the early stages of an
IS audit?
A. Observing key organizational facilities.
B. Assessing the IS environment.
C. Understanding business process and environment applicable
to the review.
D. Reviewing prior IS audit reports. | | 1 |
| The phases and deliverables of a systems development life
cycle (SDLC) project should be determined:
A. during the initial planning stages of the project.
B. after early planning has been completed, but before work
has begun.
C. through out the work stages based on risks and exposures.
D. only after all risks and exposures have been identified
and the IS auditor has recommended appropriate controls. | | 1 |
| Applying a retention date on a file will ensure that:
A. data cannot be read until the date is set.
B. data will not be deleted before that date.
C. backup copies are not retained after that date.
D. datasets having the same name are differentiated. | | 1 |
| An IS auditor who has discovered unauthorized transactions
during a review of EDI transactions is likely to recommend
improving the:
A. EDI trading partner agreements.
B. physical controls for terminals.
C. authentication techniques for sending and receiving messages.
D. program change control procedures. | | 1 |
| To prevent unauthorized entry to the data maintained in a
dial-up fast response system, an IS auditor should recommend:
A. online terminals be placed in restricted areas.
B. online terminals be equipped with key locks.
C. ID cards be required to gain access to online terminals.
D. online access be terminated after three unsuccessful
attempts. | | 1 |
| Failure to adequately define or manage the requirements for
a system can result in a number of risks. The GREATEST risk is:
A. inadequate user involvement.
B. inadequate allocation of resources.
C. scope creep.
D. an incorrect estimation of the critical path. | | 1 |
| A critical function of a firewall is to act as a:
A. special router that connects the Internet to a LAN.
B. device for preventing authorized users from accessing the
LAN.
C. server used to connect authorized users to private
trusted network resources.
D. proxy server to increase the speed of access to
authorized users. | | 1 |
| Where adequate segregation of duties between operations and
programming are not achievable, the IS auditor should look for:
A. compensating controls.
B. administrative controls.
C. corrective controls.
D. access controls. | | 1 |
| Which of the following is a strength of a client-server
security system?
A. Change control and change management procedures are
inherently strong.
B. Users can manipulate data without controlling resources
on the mainframe.
C. Network components seldom become obsolete.
D. Access to confidential data or data manipulation is
controlled tightly. | | 1 |
| When performing an audit of access rights, an IS auditor
should be suspicious of which of the following if allocated
to a computer operator?
A. READ access to data
B. DELETE access to transaction data files
C. Logged READ/EXECUTE access to programs
D. UPDATE access to job control language/script files | | 1 |
| |
| For more CISA Certification Interview Questions Click Here |
along with your userid / name. ThanQ
Site Map