CISA Type Question 08-2811 on Diverse routing an Alternative routing

An IS Auditor while auditing a network finds a network routing scheme with following characteristics:

1. Routing involves two exchanges.

2. Routing involves split cables.

This routing scheme is most likely to be:


1. diverse Routing


2. alternative Routing


3. a combination of both of the above.


4. none of the above.

republished/modified & republished - Answer already published

Read More......

CISA Type Question 08-1111 on Audit Trail

An IS Auditor while auditing a software Firewall will look which source for audit trails?

1. Firewall Log

2. Operating System Log

3. Both 1 & 2

4. None of the above.

republished/modified & republished - Answer already published

Read More......

CISA Type Question 08-3110 on Audit Charter

Which of the following is LEAST important characteristics of Audit Charter?


1. Audit Charter delegates authority from one person/organization to another person/organization

2. Audit Charter should document Purpose, Accountabilities & Responsibilities related to Audit function

3. Audit charter should describe independence, objectivity and Standards of Audit to be conducted

4. Audit Charter is only related to scope of the Audit.

republished/modified & republished - Answer already published

Read More......

CISA Type Question 08-2210 on Audit Trails

Which of the following an IS Auditor should FIRST see, before analyzing the Audit Trails of a Local Area Network (LAN) ?

1. Quantity of Audit Trails
2. Periodicity of audit trails
3. Synchronization of timing between server and clients
4. Interaction between different applications




Answer to CISA type question 08-2010 on Audit Charter & Engagement Letter

Responsibility, Authority and accountability should be the part of both Audit Charter & Engagement letter. So, the correct answer is 3. Both.

Then, what is the difference between Audit Charter & Engagement letter ?

I leave this question for my readers to answer.

Read More......

CISA type question 08-2010 on Audit Charter & Engagement Letter

Responsibility, Authority and accountability should be the part of

1. Audit Charter
2. Engagement letter
3. Both
4. None


Answer to CISA Type Question 08-1010 on Business Continuity & Disaster Recovery

An IS auditor while auditing of an Information System finds that system does not force for backup before and after major events/major updates in the system. The IS Auditor should suggest Information System should force for backup before and after major events, All the major events and backup should be properly documented and The existing procedure are complete and sufficient. So, the correct answer is 4.More than one of the above

Read More......

CISA Type Question 08-1010 on Business Continuity & Disaster Recovery

An IS auditor while auditing of an Information System finds that system does not force for backup before and after major events/major updates in the system. Although backups are being taken without proper documentation.

The IS Auditor should ideally suggest

1.Information System should force for backup before and after major events
2.All the major events and backup should be properly documented
3.The existing procedure are complete and sufficient
4.More than one of the above
5.None of the above



Answer to CISA Type Question 08-0610 on Business Continuity Plan (BCP) Auditing


Incident Management Report,Previous reports & Followup audit report, Test reports of various stages & internal inspection and external audit reports all are important for BCP.

So, the correct answer is 4. i,ii,iii & iv

Read More......

CISA Type Question 08-0610 on Business Continuity Plan (BCP) Auditing

An IS Auditor is in the process of auditing Business Continuity Plan (BCP) for an organization.He comes across following :

i. Incident Management Report

ii.Previous reports & Followup audit report

iii. Test reports of various stages

iv. internal inspection and external audit reports

Which of the above are important for BCP ?
1. i, ii &iii only

2. ii & iii only

3. i & iii only

4. i,ii,iii & iv

Answer to CISA Type Question 08-3009 on advantages of kerberos
As we know that Kerberos helps in easy administration & control and other benefits include Less log on time in diverse platform and diverse environments. But with Single point of failure like sharing/stealing of session key , the whole system will be compromised.
So, the correct answer is 2. iii

Read More......

CISA Type Question 08-3009 on advantages of kerberos

Refer to following statements about kerberos

i. It helps in easy administration & control
ii. Less log on time in diverse platform and diverse environments
iii. Single point of failure like sharing/stealing of session key will not have nay impact on the system


Which of the bove statement(s) is/are false

1. i & ii
2. iii
3. ii & iii
4. i. & iii



Answer to CISA Type Question 08-2909 on Secure Software Development

Use of best security practices, Appropriate software audit during each phase of software development life cycle, appropriate software audit after software implementation & Defined software security policy and management support are required in ensuring security in Software life cycle. So, the correct answer is 5.None of these.

Read More......

CISA Type Question 08-2909 on Secure Software Development

Which of the following is not required in ensuring security in Software life cycle?

1. Use of best security practices
2. Appropriate software audit during each phase of software development life cycle
3. Appropriate software audit after software implementation
4. Defined software security policy and management support
5.None of these.




Answer to CISA Type Question 08-2209 on Kerberos / Single Sign-on

Kerberos can protect from Spoofing attacks but can not protect Denial of Service attack & Password cracking and guessing.

So, the correct answer is 4.More than one of the above

Read More......

CISA Type Question 08-2209 on Kerberos / Single Sign-on

The Kerberos generally does not take care of

1. Denial of Service attack
2. Password cracking and guessing
3. Spoofing attacks
4. More than one of the above
5. None of the above


Answer to CISA Type Question 08-1609 on Fourth Generation Programming languages (4GL)

SPSS, SAS and SQL Plus are Fourth generation Programming languages (4GL).Data Manipulation and Data management are the key features of Fourth generation Programming languages ( 4GL ). Advancement in hardware and software technologies led to development of Fourth generation Programming languages ( 4GL ). and Fourth Generation Programming Languages are more nearer to Human beings as compared to other High Level Third generation Programming languages (3GL).

So, the correct answer is 1. Fourth Generation Programming Languages are less nearer to Human beings as compared to other High Level Third generation Programming languages (3GL).

Read More......

CISA Type Question 08-1609 on Fourth Generation Programming languages (4GL)

Which of the following statements about Fourth generation Programming Language (4GL) is LEAST appropriate ?


1. Fourth Generation Programming Languages are less nearer to Human beings as compared to other High Level Third generation Programming languages (3GL).

2. SPSS, SAS and SQL Plus are Fourth generation Programming languages (4GL)..

3. Data Manipulation and Data management are the key features of Fourth generation Programming languages ( 4GL ).

4. Advancement in hardware and software technologies led to development of Fourth generation Programming languages ( 4GL ).

Answer to CISA Type Question 08-1209 on Kerberos

Correct answer is 2. Ticket Granting Server (TGS)

Read More......

CISA Type Question 08-1209 on Kerberos

Tickets are important part of Kerberos system which help in authentication. First Ticket is issued by Kerberos Authentication Server(KAS).

Remaining tickets are issued by:

1. Kerberos Authentication Server(KAS)

2. Ticket Granting Server (TGS)

3. Either of the 1 or 2

4. Both of the 1 and 2



Answer to CISA Type Question 08-1009 on Kerberos

It is obvious from the above question that in Kerberos initial ticket is issued by KAS so, the correct answer is 1. Kerberos Authentication Server(KAS)

Read More......

CISA Type Question 08-1009 on Kerberos

In Kerberos initial ticket is issued by :

1. Kerberos Authentication Server(KAS)

2. Ticket Granting Server (TGS)

3. Authenticator

4. User or Client



Answer to CISA Type Question 08-0809 on Change Management

Change management and Patch management are not same but Patch Management is subset of Change Management which controls and manages risks and avoid major disaster if properly done.Testing, Backup Strategy, Sign off & documentation are the key components of Change Management.

So the correct answer is 3.i & ii

Read More......

CISA Type Question 08-0809 on Change Management

As an IS Auditor you have been given following information about Change Management:

i. Change Management & Patch Management is same.

ii. Patch Management is superset of Change Management

iii. Patch Management is subset of Change Management

iv. Aim of Change management is to control and manage risks

v. Improper Change Management can cause major disaster

vi. Testing, Backup Strategy, Sign off & documentation are the key components of Change Management .

Which of the following are false:

1. i & iii

2.ii &iii

3.i & ii

4.i & v

5. iii & v

Answer toCISA Type question 08-0309 on Decision Support System (DSS)

Correct answer is 1. Decision Support System (DSS) aims at solving highly structured problems. For details refer to 10 important Benefits of Decision Support System (DSS)

Read More......

CISA Type question 08-0309 on Decision Support System (DSS)

Which of the following is false about a Decision Support System (DSS) ?

1. Decision Support System (DSS) aims at solving highly structured problems.

2. Decision Support System (DSS) involves high interaction.

3. Decision Support System (DSS) takes help of Business Intelligence (BI).

4. Decision Support System (DSS) takes less care of speed but more care of accuracy.

Answer to CISA Type Question 08-2608 on Firewall and OSI Model

An IS Auditor while auditing an IS setup suggested implementation ofApplication Gateway instead of existing Packet FilterFirewall. As the Application gateway works on almost all layers of OSI Model where as packet filtering firewall works only on network layer of OSI model . So the correct answer is 1. Application gateway works on almost all seven layers of OSI Model where as packet filtering router/firewall works on layer-3 of OSI model only.

Read More......

CISA Type Question 08-2008 on Good Password Policy

An IS Auditor while reviewing password policy of an organization finds the following :


1. Password Complexity and length

2. Allowed default username and password

3. Password Rotation policy

4. Password Periodicity

5. Password file protection

6. Password Field encryption



Which of the above should be the part of a good password policy?

1. All except 5 & 6

2. All except 2

3. All except 2 & 5

4. All of the above

Answer to CISA Type question 08-1608 on Network Audit

Absence of a single client on network topology will not be of major impact most of the times. Different type of cables may be used as per the need of the network and topology. Dynamic Host Configuration Protocol(DHCP) can be used wherever required. The network downtime records and resolution should essentially be part of the incident management.So, the correct answer is 2. There are no records maintained of network downtime, nature of fault and resolution thereafter.

Read More......

CISA Type question 08-1608 on Network Audit

An IS auditor while auditing a network makes following observations. Which of the following could be most CRITICAL ?

1. Network topology chart does not include a client machine

2. There are no records maintained of network downtime, nature of fault and resolution thereafter

3. Network uses a certain type of cable only

4. Network uses Dynamic Host Configuration Protocol


Answer to CISA Type question 08-1308 on Anti-virus



False positive condition means anti-virus reports a virus when actually no virus is there and False negative is actually reverse of the false positive. In false negative is a situation where anti-virus fails to find a virus when virus actually exists in the system.

Updated Anti-Virus software will reduce the chances of failure to find a virus when virus actually exists in the system. So, the correct answer is 1. reduce the chances of false negative.

For details refer to 10 things you must remember about Antivirus.

Read More......

CISA Type question 08-1308 on Anti-virus

An IS auditor while auditing has suggested a control measure suggesting keeping virus definition file up to date. The IS auditor has suggested the same PRIMARILY to



1. reduce the chances of false negative

2. reduce the chances of false positive

3. For increasing profit of the firm

4. None of the above.





Answer to CISA Type Question 08-0708 on audit of firewall


This is the type of ports and related services which are important for firewall
implementation. Number of ports and services are not very important parameter in
most of the cases in firewall implementation. Where as Firewall rule sets &
Firewall Log generation and log auditing are very important in firewall
implementation and management. so the correct answer is 3. Number of ports and
services permitted and allowed.



For further details refer to 10 Things to consider when auditing a firewall

Read More......

CISA Type Question 08-0708 on audit of firewall

Which of the following is the LEAST important for an IS auditor auditing a Firewall implementation?

1. Types of services permitted and disallowed
2. Firewall rule sets
3. Number of ports and services permitted and allowed
4. Firewall Log generation and log auditing

Answer to CISA Type Question 08-0608

Correct answer is 3. The auditor should discuss summary of critical findings and other highlights.

For discussion IS Auditor should make a summary of critical report an other important highlight. All other findings should be documented and presented.

Read More......

CISA Type Question 08- 0608 - Question on IS Audit report presentation for CISA Exam

Which of the following is the most appropriate way for an IS Auditor to present the audit findings to the auditee management after completion of IS Audit ?

1. The auditor should discuss the entire finding in detail

2. The auditor should discuss summary of critical findings

3. The auditor should discuss summary of critical findings and other highlights.

4. The auditor should not discuss the findings.

Answer to CISA type Question 08-0508

The correct answer is 1. Degaussing.

Refer to Degaussing - An ideal way for media destruction and data security.

Read More......