Practice Test 10 - CPA Isc
20 questions. Answer them in any order, then submit to see your score and every explanation.
- An employee unknowingly installs software that appears to be a legitimate productivity tool but secretly creates a backdoor for attackers to access the corporate network. This malware type is called:
- An auditor reviewing logical access controls finds that several system administrator accounts share generic usernames (e.g., 'admin1', 'admin2') used by multiple staff members. Which control principle is most significantly violated?
- Which of the following represents a key characteristic of a well-functioning IT steering committee?
- How does data analytics enhance the traditional risk assessment process?
- A critical financial application calculates loan interest payments. An auditor wants to verify that the interest calculation logic is correct. Which audit procedure is most appropriate?
- A project's cost-benefit case is approved before requirements are documented. Which SDLC phase is this?
- Which of the following output controls ensures that system-generated reports reach only intended, authorized recipients?
- Which of the following is the primary risk of poor data quality in an organization's financial reporting systems?
- Which of the following is a key control that helps ensure incidents are escalated appropriately when they cannot be resolved within defined timeframes?
- IT budgets 80% to legacy systems despite a growth strategy. What best restores alignment?
- Which of the following is the most significant risk associated with 'access creep' in an organization's IT environment?
- A retail bank is at the final go-live decision point for a branch teller system replacement using a phased rollout methodology with parallel run in selected branches. UAT in a pilot branch passed most scenarios, but cash drawer balancing reports do not match transaction totals when a transaction is reversed after end-of-day processing. Operations proposes going live and manually adjusting the report for rare reversals. Based on the user acceptance testing results, what is the most appropriate action?
- The COSO ERM 2017 framework introduced which significant enhancement compared to the 2004 version?
- Which of the following is a limitation of using data analytics to identify anomalies in financial data?
- An organization's IT policy states that all sensitive data must be encrypted. An employee argues that encrypting data on an internal server is unnecessary because the server is behind a firewall. The most appropriate response to this argument is:
- An auditor discovers that three different employees in the accounts payable department can independently add, modify, and delete vendor records without any secondary approval. This represents:
- Which of the following policy documents would most directly govern how an organization responds when an employee is terminated?
- Which of the following scenarios illustrates the concept of 'data downgrading' in a classification program?
- Which of the following best describes the primary purpose of controls over system acquisition and implementation?
- A company's payroll system requires that any salary entry exceeding $500,000 annually be flagged for secondary review before processing. This is an example of which input control?