Practice Test 9 - CPA Isc
20 questions. Answer them in any order, then submit to see your score and every explanation.
- A city government is preparing to go live with a payroll system in the final SDLC phase and is using a controlled waterfall methodology with formal acceptance. UAT included parallel payroll runs for two pay periods; totals matched overall, but testers found that overtime premiums are calculated incorrectly for a specific union contract when employees work split shifts. The project sponsor wants to proceed because only one department uses that contract. How should the IT team address this issue before going live?
- Which of the following best describes an effective EUC governance framework?
- A company implements a data catalog as part of its data governance program. The primary purpose of a data catalog is to:
- A company's interface between its CRM and billing systems incorrectly maps the 'discount percentage' field, resulting in customers being overcharged. This type of error is best detected by which control?
- Which of the following best describes the 'recovery' phase of incident response?
- Which of the following best describes a 'zero-day vulnerability'?
- An auditor uses network analysis to map relationships between employees, vendors, and customers in a financial institution. The analytics reveal several clusters where employees have personal connections to vendors they also approve payments for. In a risk assessment context, this most directly addresses:
- When assessing whether a control is appropriately designed for a high-risk process, which factor is most important?
- A company collects biometric data from employees for building access control. Under GDPR, processing this data requires:
- Under audit standards, when data analytics identifies a high volume of exceptions requiring follow-up, the auditor should:
- Which of the following represents the primary risk of maintaining outdated or inaccurate customer master data?
- Which of the following best describes the role of a 'data steward' in a data governance framework?
- A major financial institution experiences a cybersecurity incident that disrupts trading systems for 4 hours. Under applicable financial sector regulations, which of the following reporting obligations most likely apply?
- A company's automated accounts payable system generates a daily exception report of all attempted payments that were blocked due to a purchase order mismatch. The accounts payable manager reviews this report each morning to identify and resolve any issues. This manager's review is an example of which type of activity under the COSO framework?
- An organization's EUC policy requires that all high-risk spreadsheets undergo an annual independent review. During an audit, the auditor finds that the last review of the critical payroll accrual spreadsheet was performed three years ago and a new, more complex formula was added two years ago without review. The auditor should:
- In public key infrastructure (PKI), a digital certificate primarily serves to:
- An auditor analyzes the correlation between inventory count discrepancies and specific warehouse locations. The analysis shows that one location consistently has the largest discrepancies. How does this analytics finding inform the risk assessment?
- An organization implements a zero-trust network architecture. From a logical access control perspective, the key principle of zero trust is:
- In an IT infrastructure audit of a public company, the auditor reviews how employee laptops receive IP addresses and network settings when connecting to the corporate network. Management wants a centralized component that automatically assigns IP addresses and reduces configuration errors to align with IT operations standards. What is the primary role of the component that provides this service?
- An accounts payable system automatically matches vendor invoices to purchase orders and goods receipts before allowing payment processing. This three-way match is best classified as: