Skip to main content
Sign in Create a free account
Varsity Tutors
Sign in Sign up

Practice Test 3 - CPA Isc

20 questions. Answer them in any order, then submit to see your score and every explanation.

  1. A company uses identity and access management (IAM) software to automate user provisioning and deprovisioning. The primary benefit of this automation is:
  2. A company's board of directors has established an audit committee. However, the committee is primarily composed of senior executives from the company's operations and finance departments. According to the COSO Internal Control Framework, this composition most directly undermines which principle within the Control Environment component?
  3. An auditor is asked to assess whether the organization's backup and recovery controls adequately protect financial reporting data. Which of the following procedures is most relevant to this objective?
  4. A financial services company implements a quarterly user access review requiring managers to certify that their team members' system access rights remain appropriate. This is an example of which ITGC category?
  5. A company requires all privileged accounts (system admins, database admins) to use separate named accounts rather than sharing a single 'admin' account. The primary control objective of this requirement is:
  6. An organization's acceptable use policy (AUP) for IT resources primarily serves to:
  7. A SaaS provider is in the final release phase for a customer support ticketing system update using a DevOps SDLC with continuous integration and a scheduled production release window. UAT showed that email notifications are sent correctly, but attachments larger than 10 MB fail silently for external customers, while internal users can upload them. The product owner suggests go-live and adding a note in the help center. How should the IT team address this issue before going live?
  8. In a system upgrade proposal for a nonprofit, the IT team reviews aging on-premises servers that host the donor database and internal file shares. The servers are approaching end-of-support, increasing operational risk and limiting the ability to apply security patches in line with governance expectations. Based on the scenario, which IT infrastructure component needs upgrading?
  9. Which of the following most effectively evaluates the operating effectiveness of change management controls over a period?
  10. An organization implements an automated tool that analyzes all accounts payable transactions nightly and flags any payments to vendors not in the approved vendor master file. This is an example of:
  11. An auditor uses analytics to stratify accounts receivable by aging bucket and customer concentration. The results show that 3 customers represent 68% of total AR, with all three in the 90+ day bucket. How does this inform the risk assessment?
  12. A batch processing system processes 10,000 payroll transactions. As a data integrity control, which of the following should be verified after processing?
  13. Which of the following represents a key control during the post-implementation phase of a system deployment?
  14. A company is implementing a new ERP system using a waterfall SDLC approach. The project is in the Design phase. The business sponsor requests adding significant new functionality that was not in the original requirements. The most appropriate action is:
  15. A company's automated accounts payable system generates a daily exception report of all attempted payments that were blocked due to a purchase order mismatch. The accounts payable manager reviews this report each morning to identify and resolve any issues. This manager's review is an example of which type of activity under the COSO framework?
  16. Which of the following best describes 'data sovereignty' as a consideration in a data governance framework?
  17. An organization's financial reporting process generates a management report containing prior period comparisons. Which output control would help ensure the comparative figures are accurate?
  18. Which of the following is the most critical element for ensuring IT policies remain effective over time?
  19. An e-commerce company stores hashed credit card numbers in its database instead of actual card numbers. A security assessor determines that the hashes were generated without salting using MD5. Which of the following is the most significant security concern?
  20. A word cloud generated from customer complaint records shows that the words 'overcharged,' 'billing error,' and 'refund' appear most prominently. What does this output most likely indicate?

Practice tests