ISACA CISA Certified Information Systems Auditor Exam Questions and Answers - 26

The latest ISACA CISA (Certified Information Systems Auditor) certification actual real practice exam question and answer (Q&A) dumps are available free, which are helpful for you to pass the ISACA CISA exam and earn ISACA CISA certification.

ISACA Certified Information Systems Auditor (CISA) Exam Questions and Answers

CISA Question 2701

Question

Which of the following is the process of repeating a portion of a test scenario or test plan to ensure that changes in information system have not introduced any errors?

A. Parallel Test
B. Black box testing
C. Regression Testing
D. Pilot Testing

Answer

C. Regression Testing

Explanation

Regression testing is the process of rerunning a portion of a test scenario or test plan to ensure that changes or corrections have not introduced new errors. The data used in regression testing should be same as original data.

For CISA exam you should know below mentioned types of testing:
Alpha and Beta Testing – An alpha version is early version is an early version of the application system submitted to the internal user for testing. The alpha version may not contain all the features planned for the final version. Typically, software goes to two stages testing before it consider finished. The first stage is called alpha testing is often performed only by the user within the organization developing the software.
The second stage is called beta testing, a form of user acceptance testing, generally involves a limited number of external users. Beta testing is the last stage of testing, and normally involves real world exposure, sending the beta version of the product to independent beta test sites or offering it free to interested user.
Pilot Testing – A preliminary test that focuses on specific and predefined aspect of a system. It is not meant to replace other testing methods, but rather to provide a limited evaluation of the system. Proof of concept are early pilot tests – usually over interim platform and with only basic functionalities.
White box testing – Assess the effectiveness of a software program logic. Specifically, test data are used in determining procedural accuracy or conditions of a program’s specific logic path. However, testing all possible logical path in large information system is not feasible and would be cost prohibitive, and therefore is used on selective basis only.
Black Box Testing – An integrity based form of testing associated with testing components of an information system’s -functional- operating effectiveness without regards to any specific internal program structure. Applicable to integration and user acceptance testing.
Function/validation testing – It is similar to system testing but it is often used to test the functionality of the system against the detailed requirements to ensure that the software that has been built is traceable to customer requirements.
Regression Testing – The process of rerunning a portion of a test scenario or test plan to ensure that changes or corrections have not introduced new errors. The data used in regression testing should be same as original data.
Parallel Testing – This is the process of feeding test data into two systems – the modified system and an alternative system and comparing the result.
Sociability Testing – The purpose of these tests is to confirm that new or modified system can operate in its target environment without adversely impacting existing system. This should cover not only platform that will perform primary application processing and interface with other system but, in a client server and web development, changes to the desktop environment. Multiple application may run on the user’s desktop, potentially simultaneously, so it is important to test the impact of installing new dynamic link libraries (DLLs) , making operating system registry or configuration file modification, and possibly extra memory utilization.

The following were incorrect answers:
Parallel Testing – This is the process of feeding test data into two systems – the modified system and an alternative system and comparing the result.
Black Box Testing – An integrity based form of testing associated with testing components of an information system’s -functional- operating effectiveness without regards to any specific internal program structure. Applicable to integration and user acceptance testing.
Pilot Testing – A preliminary test that focuses on specific and predefined aspect of a system. It is not meant to replace other testing methods, but rather to provide a limited evaluation of the system. Proof of concept are early pilot tests – usually over interim platform and with only basic functionalities

CISA Question 2702

Question

Identify the INCORRECT statement from below mentioned testing types

A. Recovery Testing – Making sure the modified/new system includes provisions for appropriate access control and does not introduce any security holes that might compromise other systems
B. Load Testing – Testing an application with large quantities of data to evaluate its performance during peak hour
C. Volume testing – Studying the impact on the application by testing with an incremental volume of records to determine the maximum volume of records that application can process
D. Stress Testing – Studying the impact on the application by testing with an incremental umber of concurrent users/services on the application to determine maximum number of concurrent user/service the application can process

Answer

A. Recovery Testing – Making sure the modified/new system includes provisions for appropriate access control and does not introduce any security holes that might compromise other systems

Explanation

The word INCORRECT is the keyword used in this question. You need to find out the incorrect option specified above. The term recovery testing is incorrectly defined in the above options. The correct description of recovery testing is: Recovery Testing – Checking the system’s ability to recover after a software or hardware failure

For CISA exam you should know below types of testing:
Unit Testing – The testing of an individual program or module. Unit testing uses set of test cases that focus on control structure of procedural design. These tests ensure internal operation of the programs according to the specification.
Interface or integration testing – A hardware or software test that evaluates the connection of two or more components that pass information from one area to another. The objective it to take unit tested module and build an integrated structure dictated by design. The term integration testing is also referred to tests that verify and validate functioning of the application under test with other systems, where a set of data is transferred from one system to another.
System Testing – A series of tests designed to ensure that modified programs, objects, database schema, etc , which collectively constitute a new or modified system, function properly. These test procedures are often performed in a non-production test/development environment by software developers designated as a test team. The following specific analysis may be carried out during system testing.
Recovery Testing – Checking the system’s ability to recover after a software or hardware failure.
Security Testing – Making sure the modified/new system includes provisions for appropriate access control and does not introduce any security holes that might compromise other systems.
Load Testing – Testing an application with large quantities of data to evaluate its performance during peak hour.
Volume testing – Studying the impact on the application by testing with an incremental volume of records to determine the maximum volume of records that application can process.
Stress Testing – Studying the impact on the application by testing with an incremental umber of concurrent users/services on the application to determine maximum number of concurrent user/service the application can process.
Performance Testing – Comparing the system performance to other equivalent systems using well defined benchmarks.
Final Acceptance Testing – It has two major parts: Quality Assurance Testing(QAT) focusing on the technical aspect of the application and User acceptance testing focusing on functional aspect of the application.
QAT focuses on documented specifications and the technology employed. It verifies that application works as documented by testing the logical design and the technology itself. It also ensures that the application meet the documented technical specifications and deliverables.
QAT is performed primarily by IS department.
The participation of end user is minimal and on request. QAT does not focus on functionality testing.

UAT supports the process of ensuring that the system is production ready and satisfies all documented requirements. The methods include:
Definition of test strategies and procedure.
Design of test cases and scenarios
Execution of the tests.
Utilization of the result to verify system readiness.

Acceptance criteria are defined criteria that a deliverable must meet to satisfy the predefined needs of the user. A UAT plan must be documented for the final test of the completed system. The tests are written from a user’s perspective and should test the system in a manner as close to production possible.

The following were incorrect answers:
The other options presented contains valid definitions.

CISA Question 2703

Question

Which of the following type of testing validate functioning of the application under test with other system, where a set of data is transferred from one system to another?

A. Interface testing
B. Unit Testing
C. System Testing
D. Final acceptance testing

Answer

A. Interface testing

Explanation

Interface or integration testing is a hardware or software test that evaluates the connection of two or more components that pass information from one area to another. The objective it to take unit tested module and build an integrated structure dictated by design. The term integration testing is also referred to tests that verify and validate functioning of the application under test with other systems, where a set of data is transferred from one system to another.

The following were incorrect answers:
Unit Testing – The testing of an individual program or module. Unit testing uses set of test cases that focus on control structure of procedural design. These tests ensures internal operation of the programs according to the specification.
System Testing – A series of tests designed to ensure that modified programs, objects, database schema, etc , which collectively constitute a new or modified system, function properly. These test procedures are often performed in a non-production test/development environment by software developers designated as a test team.
Final Acceptance Testing – During this testing phase the defined methods of testing to apply should be incorporated into the organization’s QA methodology.

CISA Question 2704

Question

Which of the following type of testing has two major categories: QAT and UAT?

A. Interface testing
B. Unit Testing
C. System Testing
D. Final acceptance testing

Answer

C. System Testing

CISA Question 2705

Question

Which of the following type of testing uses a set of test cases that focus on control structure of the procedural design?

A. Interface testing
B. Unit Testing
C. System Testing
D. Final acceptance testing

Answer

B. Unit Testing

Explanation

Unit testing is the testing of an individual program or module. Unit testing uses set of test cases that focus on control structure of procedural design. These tests ensure internal operation of the programs according to the specification.

The following were incorrect answers:
Interface or integration testing – A hardware or software test that evaluates the connection of two or more components that pass information from one area to another. The objective it to take unit tested module and build an integrated structure dictated by design. The term integration testing is also referred to tests that verify and validate functioning of the application under test with other systems, where a set of data is transferred from one system to another.
System Testing – A series of tests designed to ensure that modified programs, objects, database schema, etc , which collectively constitute a new or modified system, function properly. These test procedures are often performed in a non-production test/development environment by software developers designated as a test team.
Final Acceptance Testing – During this testing phase the defined methods of testing to apply should be incorporated into the organization’s QA methodology.

CISA Question 2706

Question

Which of the following statement correctly describes the difference between QAT and UAT?

A. QAT focuses on technical aspect of the application and UAT focuses on functional aspect of the application
B. UAT focuses on technical aspect of the application and QAT focuses on functional aspect of the application
C. UAT and QAT both focuses on functional aspect of the application
D. UAT and QAT both focuses on technical aspect of the application

Answer

A. QAT focuses on technical aspect of the application and UAT focuses on functional aspect of the application

Explanation

Final Acceptance Testing -It has two major parts: Quality Assurance Testing(QAT) focusing on the technical aspect of the application and User acceptance testing focusing on functional aspect of the application.

The following were incorrect answers:
The other presented options incorrectly describe the difference between QAT and UAT

CISA Question 2707

Question

Which of the following factor is LEAST important in the measurement of critical success factors of productivity in the SDLC phases?

A. Dollar Spent per use
B. Number of transactions per month
C. Number of transactions per user
D. Number of occurrences of fraud/misuse detection

Answer

D. Number of occurrences of fraud/misuse detection

Explanation

The LEAST is the keyword used in this question, You need to find out a LEAST important factor in the measurement of the productivity.

For the CISA exam you should know the table below which contains information about measurement of a critical success factor.
Measurement of Critical Success Factors
Productivity –
Dollars spent per use –
Number of transactions per month
Number of transactions per user –
Quality –
Number of discrepancies –
Number of disputes –
Number of occurrences of fraud/misuse detection
Economic value –
Total processing time reduction –
Momentary value of administration costs
Customer service –
Turnaround time for customer question handling
Frequency of useful communication to user.

The following were incorrect answers:
The other options presented are more important in the measurement of critical success factor of the productivity.

CISA Question 2708

Question

Who is responsible for providing technical support for the hardware and software environment by developing, installing and operating the requested system?

A. System Development Management
B. Quality Assurance
C. User Management
D. Senior Management

Answer

A. System Development Management

Explanation

System Development Management provides technical support for hardware and software environment by developing, installing and operating the requested system.

For the CISA exam you should know the information below about roles and responsibilities of groups/individuals that may be involved in the development process are summarized below:
Senior Management – Demonstrate commitment to the project and approves the necessary resources to complete the project. This commitment from senior management helps ensure involvement by those needed to complete the project.
User Management – Assumes ownership of the project and resulting system, allocates qualified representatives to the team, and actively participates in business process redesign, system requirement definitions, test case development, acceptance testing and user training. User management is concerned primarily with the following questions:
Are the required functions available in the software?
How reliable is the software?
How effective is the software?
Is the software easy to use?
How easy is to transfer or adapt old data from preexisting software to this environment?
Is it possible to add new functions?
Does it meet regulatory requirement?
Project Steering Committee – Provides overall directions and ensures appropriate representation of the major stakeholders in the project’s outcome. The project steering committee is ultimately responsible for all deliverables, project costs and schedules. This committee should be compromised of senior representative from each business area that will be significantly impacted by the proposed new system or system modifications.
System Development Management – Provides technical support for hardware and software environment by developing, installing and operating the requested system.
Project Manager – Provides day-to-day management and leadership of the project, ensures that project activities remain in line with the overall directions, ensures appropriate representation of the affected departments, ensures that the project adheres local standards, ensures that deliverable meet the quality expectation of key stakeholder, resolve interdepartmental conflict, and monitors and controls cost of the project timetables.
Project Sponsor – Project sponsor provides funding for the project and works closely with the project manager to define critical success factor(CSFs) and metrics for measuring the success of the project. It is crucial that success is translated to measurable and quantifiable terms.
Data and application ownership are assigned to a project sponsor. A project sponsor is typically the senior manager in charge of the primary business unit that the application will support.
System Development Project Team – Completes assigned tasks, communicates effectively with user by actively involving them in the development process, works according to local standards, and advise the project manager of necessary plan deviations.
User Project Team – Completes assigned tasks, communicate effectively with the system developers by actively involving themselves in the development process as Subject Matter Expert (SME) and works according to local standards, and advise the project manager of expected and actual project deviations.
Security Officer – Ensures that system controls and supporting processes provides an effective level of protection, based on the data classification set in accordance with corporate security policies and procedures: consult throughout the life cycle on appropriate security measures that should be incorporated into the system.
Quality Assurance – Personnel who review result and deliverables within each phase and at the end of each phase, and confirm compliance with requirements.
Their objective is to ensure that the quality of the project by measuring adherence of the project staff to the organization’s software development life cycle (SDLC), advise on the deviation and propose recommendation for process improvement or greater control points when deviation occur.

The following were incorrect answers:
Quality Assurance – Personnel who review result and deliverables within each phase and at the end of each phase, and confirm compliance with requirements.
Their objective is to ensure that the quality of the project by measuring adherence of the project staff to the organization’s software development life cycle (SDLC), advise on the deviation and propose recommendation for process improvement or greater control points when deviation occur.
User Management – Assumes ownership of the project and resulting system, allocates qualified representatives to the team, and actively participates in business process redesign, system requirement definitions, test case development, acceptance testing and user training.
Senior Management – Demonstrate commitment to the project and approves the necessary resources to complete the project. This commitment from senior management helps ensure involvement by those needed to complete the project.

CISA Question 2709

Question

Who is responsible for reviewing the result and deliverables within and at the end of each phase, as well as confirming compliance with requirements?

A. Project Sponsor
B. Quality Assurance
C. User Management
D. Senior Management

Answer

B. Quality Assurance

Explanation

Quality Assurance personnel review result and deliverables within each phase and at the end of each phase, and confirm compliance with requirements. Their objective is to ensure that the quality of the project by measuring adherence of the project staff to the organization’s software development life cycle (SDLC), advise on the deviation and propose recommendation for process improvement or greater control points when deviation occur.

The following were incorrect answers:
Project Sponsor – Project sponsor provides funding for the project and works closely with the project manager to define critical success factor(CSFs) and metrics for measuring the success of the project. It is crucial that success is translated to measurable and quantifiable terms.
Data and application ownership are assigned to a project sponsor. A project sponsor is typically the senior manager in charge of the primary business unit that the application will support.
User Management – Assumes ownership of the project and resulting system, allocates qualified representatives to the team, and actively participates in business process redesign, system requirement definitions, test case development, acceptance testing and user training.
Senior Management – Demonstrate commitment to the project and approves the necessary resources to complete the project. This commitment from senior management helps ensure involvement by those needed to complete the project.

CISA Question 2710

Question

Who is responsible for ensuring that system controls and supporting processes provides an effective level of protection, based on the data classification set in accordance with corporate security policies and procedures?

A. Project Sponsor
B. Security Officer
C. User Management
D. Senior Management

Answer

B. Security Officer

Explanation

Security Officer ensures that system controls and supporting processes provides an effective level of protection, based on the data classification set in accordance with corporate security policies and procedures: consult throughout the life cycle on appropriate security measures that should be incorporated into the system.