ISACA CISA — Acquisition, Operations and Protection of Assets flashcards
10 of 76 cards free to study here · 3 topics · the whole deck is built into Willys
CISA domains 3 to 5: project management, business case, development, testing and cutover; IT operations, incident, problem and change, backup, BCP and DRP; then logical access, network security, PKI and incident response, plus classification and privacy, which the exam tests in domain 2.
Learn deck · part of ISACA CISA · written against: CISA exam content outline (2024 job practice). Updated 2026-10-10.
Study the free sample
10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.
Tap the card or press Space to flip
The 10 sample cards as a list
-
What is the critical path in a project schedule, and why does the IS auditor care about it?The longest sequence of dependent tasks, which sets the shortest possible project duration; its tasks have zero slack, so any delay on them delays go-live.Acquisition and Development › Project Management
-
A project shows earned value of 400,000, planned value of 500,000 and actual cost of 450,000. What do SPI and CPI say?SPI = 400/500 = 0.80, so the project is behind schedule; CPI = 400/450 ≈ 0.89, so it is over budget for the work done.Acquisition and Development › Project Management
-
How does the project sponsor's role differ from the project manager's?The sponsor provides funding, owns the business case and is accountable for the benefits; the project manager runs the day-to-day delivery of scope, time and cost.Acquisition and Development › Project Management
-
Requirements keep growing during a development project. Which control should the IS auditor expect?Formal scope change control — each change request gets an impact analysis on cost, schedule and risk and is approved by the steering committee or sponsor before work starts.Acquisition and Development › Project Management
-
What is the purpose of capacity management?Monitoring utilization trends so resources are added before performance degrades, and planning capacity for new business demand.Operations and Resilience › IT Operations
-
What does a configuration management database record, and why does change management rely on it?Configuration items and their relationships (servers, applications, interfaces), so the impact of a proposed change on dependent systems can be assessed.Operations and Resilience › IT Operations
-
How does an operational level agreement relate to a service level agreement?An OLA is an internal agreement between IT teams that defines what each must deliver so the IT department can meet its SLA with the business.Operations and Resilience › IT Operations
-
Who should decide whether the marketing team gets read access to the customer database?The data owner — the business manager accountable for that data. IT, as custodian, implements and maintains the access the owner approves.Protection of Assets › Frameworks and Classification
-
What must exist before data can be classified?An inventory of information assets with assigned owners, so each asset can be given a classification and handling rules.Protection of Assets › Frameworks and Classification
-
What is the purpose of a data classification scheme?To apply protection proportional to sensitivity and criticality, avoiding both under-protection of sensitive data and costly over-protection of public data.Protection of Assets › Frameworks and Classification
Unlock the whole deck
You are studying a free 10-card sample. All 76 cards of ISACA CISA — Acquisition, Operations and Protection of Assets, the other 2 ISACA CISA decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.
In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
More ISACA CISA decks
← All ISACA CISA decks, with the study guide and topic outline.
About these cards
Review status: Second-reader reviewed, with corrections applied.
Checked against:
- ISACA CISA exam content outline (2024) — topic outline only; no text copied
These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.
CISA® is a registered trademark of ISACA. This product is not affiliated with or endorsed by ISACA.
Use of these pages is covered by our Terms of Use.