Practice Test 12 - CPA Isc
20 questions. Answer them in any order, then submit to see your score and every explanation.
- A control requiring manager approval of all journal entries above $10,000 before posting is designed to address which control objective?
- A bank keeps IP logs after account closure solely to detect fraud. Under GDPR, which basis supports this?
- An analytics tool outputs a z-score analysis of employee expense claims. Three employees have z-scores above 3.5. How should an auditor interpret z-scores in this context?
- A media company is in the final SDLC phase for a digital subscription platform built using Agile with a release train. UAT passed purchase and cancellation flows, but testers reported inconsistent tax calculations for customers in one jurisdiction when a promotional discount is applied. The business suggests launching anyway because the issue affects less than 2% of transactions. Based on the UAT results, what is the most appropriate action?
- During a backup controls review, an auditor discovers that the organization performs nightly backup jobs but never monitors the job completion logs. Which control is missing?
- A new system runs in parallel with the old system for one month before cutover. Which SDLC phase is this?
- A company is in the 'Analysis' phase of an SDLC project for a new revenue recognition system. Which of the following stakeholders should be most actively involved at this stage?
- Which of the following best describes a 'control analytics' capability in a continuous auditing framework?
- Which of the following correctly describes the difference between a warm site and a cold site disaster recovery option?
- A U.S.-based company receives a verifiable consumer request under CCPA to delete all personal information it has collected about the requestor. The company must respond within:
- Which of the following best describes a 'rollback plan' in the context of change management?
- An EU company hires an unrelated cloud provider in a country with no adequacy decision. Which GDPR mechanism applies?
- Which of the following is the most effective control for detecting unauthorized changes to the vendor master file?
- Which audit procedure would most directly detect whether any changes were made to the production environment outside the formal change management process?
- Which of the following best describes IT governance?
- Which of the following represents an effective governance structure for a continuous auditing and monitoring program?
- An organization's IT department regularly submits project proposals that are not approved because business leaders do not understand their value. Which of the following would most directly address this problem?
- An auditor tests change management controls and finds that one sampled change was deployed without testing documentation. The developer explains the change was 'only a one-line code fix.' The auditor should:
- An auditor evaluating whether IT change management controls mitigate unauthorized program change risk would identify which finding as indicating controls are NOT effective?
- A data analytics report shows a time series chart of daily transaction volumes with a sudden spike on a specific date. The volume on that day is 8 times the daily average. How should an auditor interpret this?