Practice Test 11 - CPA Isc
20 questions. Answer them in any order, then submit to see your score and every explanation.
- When reviewing a company's offsite backup storage arrangements, which of the following would be the most significant finding?
- Which of the following best describes 'pseudonymization' as a data protection technique under GDPR?
- An organization detects a breach and finds evidence that attackers had access for 45 days before detection. This period between initial compromise and detection is called:
- A nonprofit is in the final SDLC stage for a donor management system implemented with a vendor using a waterfall approach and formal acceptance sign-off. UAT scripts were executed, but only by the fundraising team; finance and data privacy stakeholders did not participate. The system includes automated tax receipt generation and donor communication preferences. Which criteria should be prioritized to determine go-live readiness?
- Which of the following output controls helps ensure that sensitive financial reports are not accessed by unauthorized individuals after they are generated?
- When auditing EUC tools used in financial reporting, an auditor should consider which of the following factors to assess the risk level?
- Which of the following change management controls would most effectively prevent unauthorized program changes from being migrated to the production environment?
- An auditor uses text analytics to analyze the notes in management's discussion and analysis (MD&A) section across multiple reporting periods. The analytics flags significant changes in language around revenue recognition disclosures. How does this support risk assessment?
- Which of the following best describes 'change freeze' periods in IT operations?
- The chief financial officer and the procurement manager of a company conspire to create a fictitious vendor and approve payments for non-existent services, thereby misappropriating company funds. This situation is an example of which inherent limitation of internal control recognized by the COSO framework?
- Post-implementation review (PIR) occurs in which SDLC phase and serves what purpose?
- Which of the following data analytics outputs would be most useful for assessing the risk of management override of controls?
- An analytics report includes a control gap analysis showing that 15 identified risks have no mitigating controls mapped to them. How should management interpret this output?
- Which of the following represents a key challenge in implementing a data classification program?
- A company's cloud storage provider offers 'client-side encryption.' What does this mean for data security?
- An organization allows all employees to access the company's financial reporting system with full read/write privileges, regardless of their job function. The most significant risk of this access configuration is:
- The control operates as designed, yet errors persist. Evaluate first:
- Which of the following best describes the access control principle applied when a user is granted only the permissions required to perform their specific job duties?
- Which of the following correctly describes the primary difference between encryption and hashing?
- A company's fixed asset system requires that the useful life entered for a new asset falls between 1 and 50 years. Entry of 0 years or 51+ years is rejected. This is an example of: