Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISA 2022 > Ch 2 > Flashcards

Ch 2 Flashcards

1
Q

Name some soft skills

A 
Honest 
Ethical
Attention to detail
Professionalism
Listening 
Leadership
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Name some hard skills

A 
Technical competence
Knowledge needed to accomplish work
writing
Thinking
Project Mgmt
Critical Thinking
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Honest

A

soft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Ethical

A

soft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Attention to detail

A

soft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Verbal and written skill

A

Hard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Analytic skill

A

Hard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Interpersonal skill

A

Soft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Professional and willingness to take lead

A

Soft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Project management and Organizational skill

A

Hard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Critical Thinking

A

Hard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Professional Ethics describe

A

principles and values that govern acceptable behaivor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does client mean

A

Leadership of the area you are auditing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

CISA auditors must be

A

Honest and Transparent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define Standards

A

Mandatory actions, Explicit Rules or Controls designed to support and conform to policy through hardware, software or behaivor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What makes policy more meaningful and effective

A

Standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Standards should always point to

A

Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Procedures are

A

Written steps to execute policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which one is more detailed Policy or Procedures?

A

Procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is an outline for a statement of conduct

A

Guideline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Are guidelines mandatory to follow

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Do guidelines provide general guidance

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Are guidelines Requirements that need to met or are they recommended

A

Recommended

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Whats a baseline

A

specific rules that are accepted across the industry as providing the most effective approach to a specific implementation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Name some regulatory standards

A 
HIPPA
SOX
Base III
PCI
FISMA
COSO
SCADA
FACTA
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

HIPPA

A

Healthcare

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

SOX

A

Financial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Base III

A

Risk Mgmt Bankin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

PCI

A

Credit Cards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

FISMA

A

US Govt Security Standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

COSO

A

Financial Fraud Reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

SCADA

A

Security for Automated Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

FACTA

A

Reduce Fraud and ID Theft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Is regulatory guidance early, on time, or late

A

Late

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Most cyber laws are written before or after a major breach

A

After

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Name some industry guidance organizations

A

COBIT
ISO
NIST
FIPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Name the types of audits

A

Financial
Integrated
Operational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is a financial audit

A

Audit of financial statements and processes. Usually doesn’t include the IT auditor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Integrated Audit

A

Includes a financial and technical audit

40
Q

What are the key risk types

A

Inherent
Control
Detection

41
Q

Define Detection Risk

A

Misstatements or material errors have occurred and were not detected

42
Q

What is an inherent risk

A

Naturally occurring risk because of the nature of business before controls are applied

43
Q

Describe a control risk

A

Risk that internal controls will not prevent a material error

44
Q

How does ISACA define material

A

Item of significance that has a real impact on the organization

45
Q

Given the nature of driving, would no speed limits be an inherent risk

A

Yes

46
Q

What type of risk is it if your dirver airbag does not deploy

A

It is a control risk

47
Q

What type of risk is an audit

A

Detection risk

48
Q

Is an audit a type of detection risk?

A

Yes

49
Q

What is a risk that is (Inherent Risk - Controls)

A

Residual risk

50
Q

What is left up to the professional opinion of the auditor

A

Quantitative analysis and qualitative judgement

51
Q

What is quantative analysis

A

Conclusion based on a series of measurements

52
Q

What is a qualitative judgement

A

Judgment based on a broad understanding of business and asks the question what might go wrong

53
Q

What is risk mangaement

A

Identifying, assessing, mitigating and montioring risks

54
Q

What is the risk management process

A 
Implement a risk mgmt program
ID Assests
ID threats
Perform risk analysis
Disposition risk
Montior
55
Q

Is Risk mgmt a part of corporate governance

A

Yes

56
Q

Who supports and funds risk mgmt

A

Senior Leadership

57
Q

The risk mgmt leader should have good Project mgmt skills

A

Yes

58
Q

What are the risk courses of action

A

Avoid
Reduce
Accept
Transfer

59
Q

Is monitoring risk important

A

Yes

60
Q

Why are controls used

A

To comply with internal policies, regulatory expectations and reduce risk

61
Q

What is risk tolerance

A

Right controls to reduce risk to an acceptable level

62
Q

Audited systems must meet which requirement

A

Regalatory and legal requirements

63
Q

Do controls typically start with hihg-level policy and applies to all areas of the company

A

Yes

64
Q

Name the two categories of procedures

A

General Control Procedures

IS Control Procedures

65
Q

Controls are what

A

Preventative, Detective, Corrective

66
Q

Name a preventative control

A

Access Control List

67
Q

Name a detective control

A

IDS

Security Log

68
Q

Name a corrective control

A

IPS

Backup Power Supply

69
Q

What type of control stops a threat immediately

A

Preventative

70
Q

What tyoe of control identifies a threat after the fact

A

Detective

71
Q

What type of control tries to remediate the risk of a threat after the fact?

A

Corrective

72
Q

Who has a fiduciary responsibility of special trust and confidence with the client

A

The auditor

73
Q

What is the purpose of an IS audit

A

To evaluate controls against a predetermined control objectives

74
Q

Audit Methodology

A

Documented approach for performing an audit in a consistent and repeatable manner

75
Q

How does an audit methodology meet the audit objectives

A

By defingin the following:
Statement of Work
Statement of Scope
Statement of Audit Objectives

76
Q

Name the steps of the audit process

A 
Audit Subjects
Audit Objective
Audit Scope
Pre Audit Planning 
Data Gathering
Evaluation of test results
Communication with management
Preparation of audit report
77
Q

In chain of custody, an auditor must be able to…

A

Account for who had access to the data
Ensure that access to the data is controlled
Show that the information was protected from tampering

78
Q

What is evidence handling

A

Handling of any information obtained during the audit

79
Q

Audit evidence should be

A 
Sufficient 
Usable
Reliable
Relevant
Effective
80
Q

Give examples of work papers

A

Findings
Activities
Tests

81
Q

Work Papers should be properly dated, labled, detailed, clear alnd self contained

A

Yes

82
Q

What provides confidentiality for Work Papers

A

Encryption

83
Q

What provides availability for work papers

A

Backups

84
Q

What provides authorized access for work papers

A

Access control lists

85
Q

What should be considered for electronic work papers

A

Encryption
Access lists
Backups
Audit trails and controls

86
Q

Software audit tools used for statistical sampling and data analysis

A

Computer assisted audit tools

87
Q

Sampling produces…

A

Generalized results for the population as a whole

88
Q

What are some sampling methods

A

Statistical
Non Statistical
Variable
Attribute

89
Q

What are teh parts of attribute sampling

A

Frequency estimating
Stop and Go
Discovery

90
Q

What are a few ways to ensure compliance

A

Sampling or Monitoring

91
Q

Continuous monitoring is good for which types of processes

A

Processes that capture, manipulate, store and disseminate data

92
Q

What are the six preconditions that should be present before an org can adopt continuous auditing

A

System must have acceptable characteristics

System must be reliable, have existing controls and collect data on the systems

System must have a highly automated secondary control system

Auditor must be proficient in the technology

Audit Process must offer a reliable method for obtaining the audit procedure results

Verifiable controls of the audit reporting process must exist

93
Q

QA strives to improve two key attributes

A

Quality and adherence

94
Q

Best way to avoid surprises

A

Communicate Communicate Communicate

95
Q

Name the four opinions that an auditor can have

A

Unqualified

Qualified

Adverse

Disclaimer

96
Q

Opinions can be applied to what

A

Entire report or single finding

97
Q

What are the three types of audit ratings

A

Unrated
Satisfactory
Unsatisfactory

CISA 2022 (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions