Practice Test 4 - CPA Isc
20 questions. Answer them in any order, then submit to see your score and every explanation.
- An auditor determines that an organization's program change controls are ineffective - developers can directly modify production code without authorization. What is the most significant implication for the financial statement audit?
- An analytics output shows that a sample of 500 transactions was tested and 8 exceptions were found. The auditor needs to determine whether this exception rate is indicative of a control deficiency. Which of the following is the most relevant consideration?
- During an audit, an organization claims its incident management process is effective because 'issues get fixed.' The auditor should evaluate this claim by reviewing:
- During an IT audit, an auditor identifies 45 production changes made during the year without any corresponding approved change requests. The auditor should classify this as:
- An auditor wants to test all journal entries for unusual characteristics such as round-dollar amounts, entries posted on holidays, or entries made by IT administrators. Which audit analytics approach is most appropriate?
- Which of the following best describes the purpose of data ownership in a master data governance framework?
- An IT auditor reviews a company's data classification policy and finds it has four classification levels but provides no guidance on how to handle data at each level. Which of the following is the most significant risk?
- Which of the following scenarios requires 'encryption in transit' as the primary data protection control?
- Under U.S. state breach notification laws, notification to affected individuals is generally required when:
- A company is concerned about its ability to continue operations after a major natural disaster. Management develops a comprehensive business continuity plan and a disaster recovery plan for its IT systems. These plans are primarily designed to help the company achieve which category of objectives under the COSO framework?
- Which of the following represents the most significant data control weakness in an accounts payable master data environment?
- An organization's board reviews and approves the risk appetite statement annually. Under COSO ERM, this falls within which component?
- Which of the following best describes the purpose of a 'network access control' (NAC) system?
- During a system implementation, the project team discovers that a key interface between the new financial system and the bank reconciliation module cannot be completed before the planned go-live date. Which of the following is the most appropriate action?
- An organization's IT operations team follows a formal problem escalation matrix for job processing failures. The primary purpose of this escalation matrix is to:
- A company's RTO is 4 hours and its RPO is 1 hour. Which of the following backup and recovery configurations would meet both objectives?
- A company reconciles the total number of records and sum of amounts in its daily sales interface file against the corresponding entries in the general ledger. This procedure primarily addresses which data quality concern?
- The recovery point objective (RPO) determines:
- The COBIT framework is primarily used to:
- A logistics company is completing a transportation management system and is in the UAT and go-live readiness checkpoint under a DevOps-oriented SDLC with automated deployments and manual approval gates. UAT results show all functional scenarios passed, but users report that the new route-planning screen is confusing and increases time-to-complete by about 20% compared with the legacy system. Leadership wants to proceed to meet a contract start date. Which criteria should be prioritized to determine go-live readiness?