Skip to main content
Sign in Create a free account
Varsity Tutors
Sign in Sign up

Practice Test 2 - CPA Isc

20 questions. Answer them in any order, then submit to see your score and every explanation.

  1. In the SDLC, 'integration testing' is performed to:
  2. Which of the following IT governance documents is most useful for clarifying how IT decisions are made and who has authority for different types of IT decisions?
  3. A government agency is performing an IT efficiency evaluation and finds that many internal applications are hosted on underutilized physical servers. Management wants to improve hardware utilization and simplify provisioning while maintaining appropriate controls over workloads. How does the key infrastructure component contribute to overall IT efficiency in this scenario?
  4. Which of the following most accurately describes the scope of ITGCs relevant to a financial statement audit?
  5. An auditor reviews a sample of emergency changes and finds that 8 of 10 have no post-implementation review documentation. This finding is best characterized as:
  6. Under GDPR, when must organizations notify the relevant supervisory authority following a personal data breach?
  7. A review of a company's internal controls reveals that individual transaction-level controls are well-designed and operating. However, the board of directors is not actively involved in oversight, and there is no formal process for identifying emerging business risks. According to the COSO framework, the system of internal control is likely ineffective because of significant weaknesses in which components?
  8. A public retail company has an established revenue process, but internal audit has not performed follow-up testing on key controls for two years due to staffing shortages. Management relies on these controls for financial reporting, yet there is limited evidence that control deficiencies are identified and remediated on a timely basis. Professional judgment is needed to evaluate whether controls remain effective without ongoing review. Which component of the COSO framework best addresses this issue?
  9. Which of the following is an example of a control that simultaneously supports all three CIA triad principles?
  10. A financial institution discovers that a change to its interest calculation module was deployed to production without any testing. The change contained a logic error that resulted in incorrect interest charges to customers. Which control failure is most directly responsible?
  11. When evaluating the design of change management controls, which of the following questions is most important?
  12. Which of the following best describes symmetric encryption?
  13. An organization's IT governance framework assigns accountability for IT risk to the CIO. Which of the following best describes how this accountability should operate in practice?
  14. An organization implements continuous monitoring of user access logs to detect instances where employees access systems outside their normal working hours and locations. This monitoring rule is designed to detect:
  15. A utilities company is preparing to deploy a customer outage notification system and is at the UAT completion gate in a phased rollout SDLC. UAT uncovered that customers who opt out of SMS still receive messages if they previously opted in and then changed preferences within 24 hours of an outage event. The team considers this a low impact defect because it affects a narrow timing window. What potential risk identified during testing requires immediate attention?
  16. A company's logical access controls are tested and found to have several significant deficiencies: terminated employees with active accounts, excessive privileged access, and no periodic access reviews. The external auditor is evaluating whether these collectively represent a material weakness. The key question is:
  17. An organization's IT strategic plan should primarily be driven by which of the following?
  18. Which of the following is the most significant risk of allowing developers direct access to make changes in the production environment?
  19. Which of the following is the most effective control for detecting unauthorized access attempts to a critical financial system?
  20. An auditor reviews the user access listing for a financial reporting system and finds 23 accounts with no login activity in the past 180 days. The most appropriate audit finding is:

Practice tests