Practice Test 7 - CPA Isc

20 questions. Answer them in any order, then submit to see your score and every explanation.

Start practice test

1. An organization retains backup data for 90 days as per policy. An auditor verifies that backups older than 90 days are automatically deleted. What additional verification should the auditor perform?
2. Which of the following scenarios would trigger a SEC cybersecurity incident disclosure requirement for a publicly traded company under the SEC's 2023 cybersecurity disclosure rules?
3. An auditor evaluating backup controls requests the backup job history for the past 90 days and finds that backup jobs failed on 15 of those days. The IT team has no documentation of these failures being investigated or remediated. This finding indicates:
4. Under a data classification framework, 'public' data is best described as:
5. An organization discovers that an attacker had persistent access to its network for eight months before being detected. This type of attack is known as:
6. An auditor testing a key EUC spreadsheet used to calculate depreciation expense requests evidence of testing and validation of the spreadsheet's formulas. The business user responds that 'it has worked correctly for years.' The auditor should:
7. Which of the following best describes a 'watering hole' attack?
8. Which of the following data controls would most effectively detect duplicate vendor records that could be used for fraudulent double-payment schemes?
9. The California Consumer Privacy Act (CCPA) grants California residents which of the following rights?
10. A company's board of directors has established an audit committee. However, the committee is primarily composed of senior executives from the company's operations and finance departments. According to the COSO Internal Control Framework, this composition most directly undermines which principle within the Control Environment component?
11. Which of the following best describes the role of internal audit in IT governance?
12. Which of the following best describes the Agile SDLC approach compared to the traditional Waterfall approach?
13. A continuous monitoring dashboard shows that the number of failed login attempts on the financial system spiked significantly over the past 24 hours. The most appropriate immediate response is:
14. When evaluating the adequacy of an organization's backup controls, which of the following is the most important consideration?
15. According to the COSO framework, a significant deficiency in the Control Environment would most likely have a pervasive negative effect on which other component?
16. Which of the following represents the most effective use of analytics in assessing the risk of revenue recognition errors?
17. Which of the following is an example of a 'master data management' (MDM) control?
18. A company's master data management policy requires that all master data changes be logged in an immutable audit trail. The primary purpose of this requirement is to:
19. An IT audit identifies that a critical financial system has no user acceptance testing (UAT) before changes are deployed to production. This is a gap in which stage?
20. Which of the following SDLC controls helps ensure that software changes do not introduce security vulnerabilities into production systems?

Practice tests