Practice Test 8 - CPA Isc

20 questions. Answer them in any order, then submit to see your score and every explanation.

Start practice test

1. A company's IT policy framework is assessed against the NIST Cybersecurity Framework (CSF). The assessor finds gaps in the 'Protect' function. Which of the following policy documents would most directly address these gaps?
2. A regression analysis output in an analytics report shows an R-squared value of 0.95 between advertising spend and sales revenue. How should a business analyst interpret this result?
3. An organization's policy requires 'encryption at rest' for all databases containing personally identifiable information (PII). Which of the following best describes 'encryption at rest'?
4. A financial institution runs nightly general ledger reconciliation jobs that compare subsidiary ledger balances to the GL. Which of the following represents the most significant risk if these jobs fail undetected?
5. Regression testing is performed when:
6. An organization's change management policy requires that all changes go through a formal request, approval, testing, and deployment process. A developer argues that a 'minor' configuration change does not need to follow this process. The most appropriate response is:
7. Which of the following represents a key difference between the 'Waterfall' and 'Agile' SDLC methodologies from a risk management perspective?
8. A distributed denial-of-service (DDoS) attack floods a company's website with traffic, causing it to become unavailable to customers. Which CIA triad principle is primarily targeted by this attack?
9. An auditor evaluating incident management controls for a financial services company finds that the company has no documented incident response procedures. The primary risk is:
10. A professional services firm is completing a time and expense system rollout and is in UAT under a phased deployment approach. UAT scripts were executed for standard timesheets, but consultants did not test offline entry and later synchronization, which is common during travel. The go-live plan assumes immediate retirement of the legacy mobile app. Based on the user acceptance testing results, what is the most appropriate action?
11. When evaluating whether change management controls adequately protect financial reporting, an auditor should focus primarily on changes to:
12. In IT service management (ITSM), what is the primary distinction between 'incident management' and 'problem management'?
13. Portfolio management in the context of IT governance refers to:
14. Which of the following metrics best measures the effectiveness of a continuous auditing program?
15. When auditing program change controls, which of the following procedures would provide the most direct evidence that unauthorized changes are not being made to production?
16. When evaluating whether IT investments are aligned with business objectives, which of the following metrics is most appropriate?
17. A Benford's Law analysis of expense reimbursements produces a chi-square statistic of 45.2 (critical value at 95% confidence = 15.5). How should an auditor interpret this result?
18. Which of the following authentication attack types is most effectively mitigated by implementing account lockout policies?
19. Which principle helps ensure controls remain relevant as the organization and its risks evolve?
20. Which of the following is the most appropriate use of continuous auditing in support of IT general controls assessment?

Practice tests