CPA Isc Quiz: Assess Interface And Data Transfer Controls

What this quiz covers

This quiz focuses on Assess Interface And Data Transfer Controls, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. Selecting a sample of employee change records in the HR system and verifying each was reflected in the payroll system. (correct answer)
2. Reviewing the encryption algorithm used to protect payroll data in transit.
3. Confirming that the HR system's database is backed up nightly.
4. Reviewing access controls over the HR system to ensure only HR staff can make changes.

Explanation: Tracing HR change records to corresponding payroll updates directly tests whether all changes were completely and accurately transferred. Answer A is correct. Encryption testing (B) addresses confidentiality. Backup review (C) addresses availability. Access control testing (D) addresses authorization, not interface completeness.

Question 2

1. A process that encrypts data before it is sent to another system.
2. A process that restricts which systems are authorized to send data to each other.
3. A process that converts data formats between systems with different schemas.
4. A process that compares data totals, record counts, or hash values between source and target systems to verify the transfer was complete and accurate. (correct answer)

Explanation: Data reconciliation verifies transfer integrity by comparing key metrics (counts, totals, checksums) between sender and receiver, detecting any discrepancies. Answer D is correct. Encryption (A) addresses confidentiality. Authorization controls (B) address access. Data conversion (C) is mapping/transformation, not reconciliation.

Question 3

1. Requiring a supervisor to review all sales transactions before transfer.
2. Comparing record counts and total amounts in the source file to the records loaded into the general ledger after each transfer. (correct answer)
3. Encrypting the sales data file during transmission.
4. Restricting access to the general ledger to accounting staff only.

Explanation: Record count and control total reconciliation between source and target systems directly detects data loss during transfer. Answer B is correct. Supervisor review (A) is a manual authorization control. Encryption (C) protects confidentiality. Access restrictions (D) address authorization, not completeness.

Question 4

1. Encryption of the ACH file during transmission.
2. Role-based access controls on the payroll system.
3. Error handling and exception notification controls that alert operations staff when interface failures occur. (correct answer)
4. Digital signature verification of ACH payment files.

Explanation: Silent failures indicate the absence of error handling and notification controls - the interface should detect failures and alert responsible staff immediately so corrective action can be taken. Answer C is correct. Encryption (A), access controls (B), and digital signatures (D) do not address the silent failure detection gap.

Question 5

1. Compressing the API data before transmission to improve performance.
2. Storing all received API data in a separate staging table before processing.
3. Reconciling order counts between the e-commerce platform and the ERP weekly.
4. Implementing API authentication (e.g., API keys, OAuth tokens) to ensure data is only accepted from the authorized e-commerce platform. (correct answer)

Explanation: API authentication controls verify that data is received from a legitimate, authorized source, preventing malicious or unauthorized parties from injecting data into the ERP system. Answer D is correct. Compression (A) is a performance measure. Staging tables (B) aid processing but don't verify authenticity. Weekly reconciliation (C) is detective, not preventive.

Question 6

1. The names of the IT staff members who developed the interface program.
2. The hardware specifications of the servers running the interface.
3. Records of each interface execution including start/end times, record counts, error conditions, and any exceptions or failures. (correct answer)
4. The source code of the interface program.

Explanation: Interface run logs document execution history - when the interface ran, how many records were processed, and any errors or failures. This information is essential for assessing completeness, reliability, and incident response. Answer C is correct. Developer names (A) and server specs (B) are not relevant to interface control testing. Source code review (D) is a separate IT audit procedure.

Question 7

1. Existence - confirming that the accounts payable amounts are real obligations.
2. Completeness - verifying that all subsidiary accounts payable data was fully and accurately transferred to the consolidation system. (correct answer)
3. Valuation - confirming that accounts payable amounts are recorded at the correct amounts.
4. Rights and obligations - confirming the company has a legal obligation to pay the recorded amounts.

Explanation: Comparing source to target totals tests completeness of the data transfer - ensuring all data moved across the interface without loss. Answer B is correct. Existence (A) tests whether recorded items are real. Valuation (C) tests measurement. Rights and obligations (D) tests legal standing.

Question 8

1. The risk of processing unauthorized or inaccurate payments by ensuring invoice data matches authorized purchase orders and confirmed receipts. (correct answer)
2. The risk of data encryption failures during invoice transmission.
3. The risk of excessive network latency in the procure-to-pay workflow.
4. The risk of unauthorized access to vendor master data.

Explanation: Three-way match ensures that payments are only authorized when the invoice matches an approved purchase order and a confirmed receipt - preventing payment of unauthorized, duplicate, or inflated invoices. Answer A is correct. Encryption (B), latency (C), and vendor master access (D) are separate control concerns.

Question 9

1. End-to-end testing of the interface with test data that includes discount scenarios, verifying that output amounts match expected results. (correct answer)
2. Encrypting the discount percentage field during transmission.
3. Restricting access to the billing system to senior finance staff.
4. Logging all changes made to the interface mapping configuration.

Explanation: End-to-end testing with scenarios covering discounts would reveal mapping errors before go-live by comparing expected to actual output - detecting logic errors in the interface. Answer A is correct. Encryption (B) does not detect logical mapping errors. Access restriction (C) limits who can make changes but does not detect errors. Change logging (D) tracks changes but does not verify correctness.

Question 10

1. Firewall rules blocking unauthorized IP addresses from sending files.
2. Digital signatures verifying the file came from the correct source.
3. Validation edits at the source system ensuring all records contain valid account codes before the file is generated. (correct answer)
4. Encryption of the batch file during transmission.

Explanation: Source-side validation controls should ensure records conform to required formats and valid values before the file is generated, preventing invalid data from being transmitted downstream. Answer C is correct. Firewalls (A) and digital signatures (B) address authentication and access. Encryption (D) protects confidentiality, not data validity.

Question 11

1. The risk of data loss if the EDI connection is interrupted.
2. The risk that supplier invoice data is encrypted using an unsupported algorithm.
3. The risk of paying fictitious or unauthorized invoices that do not correspond to legitimate purchase orders. (correct answer)
4. The risk that invoice data is transmitted in an uncompressed format.

Explanation: Without PO validation, the system may process and pay invoices for goods or services never ordered, creating a fraud and overpayment risk. Answer C is correct. Data loss from connection interruption (A) is a different risk. Encryption algorithms (B) and compression (D) are technical concerns unrelated to authorization validation.

Question 12

1. The target system's database is full; the appropriate control is to monitor disk space.
2. The encryption algorithm failed on 15 records; the appropriate control is to use a stronger algorithm.
3. The network dropped 15 records; the appropriate control is to upgrade network hardware.
4. A transmission or processing error caused record loss; the appropriate control is record count reconciliation between source and target after each run. (correct answer)

Explanation: Record count discrepancies are most commonly caused by transmission or processing failures. Record count reconciliation is the standard detective control that identifies the discrepancy. Answer D is correct. The cause could be any failure - disk space (A), encryption (B), or network (C) - but the applicable detective control is reconciliation, not technology-specific monitoring.

Question 13

1. An access control failure - unauthorized users modified inventory records after the interface ran.
2. An encryption failure - data was corrupted during transmission.
3. A logging failure - the interface did not generate a record of processed transactions.
4. A mapping or transformation error in the interface logic that incorrectly updates inventory quantities. (correct answer)

Explanation: If the interface runs successfully (no errors, counts match) but data values are wrong, the most likely cause is a logic error in how the interface maps or transforms data - applying the wrong calculation or mapping to the wrong field. Answer D is correct. Access modification (A) would show after the fact. Encryption corruption (B) would cause interface errors. Logging failure (C) affects traceability, not accuracy.

Question 14

1. Requiring manual approval of each batch before it runs.
2. Encrypting all batch files during transmission.
3. Limiting interface execution to a specific service account.
4. Automated reconciliation reports that compare source and target record counts and financial totals, with exception alerts sent to responsible staff. (correct answer)

Explanation: Automated reconciliation reports run after each batch provide timely detection of discrepancies, with alerts prompting immediate investigation. Answer D is correct. Manual pre-approval (A) is preventive but impractical for nightly automated batches. Encryption (B) addresses confidentiality. Service account restrictions (C) address authorization.

Question 15

1. Encrypt the payroll file during transmission to protect employee salary data.
2. Detect any unauthorized modification or corruption of the payroll file during transmission. (correct answer)
3. Authenticate that the payroll file was sent by an authorized source system.
4. Compress the payroll file to reduce transmission bandwidth.

Explanation: Hash verification detects changes to file content - if the hash upon receipt differs from the hash at transmission, the file was altered or corrupted during transit. Answer B is correct. Encryption (A) protects confidentiality. Hash verification detects changes but does not authenticate the sender (C). Compression (D) is unrelated to hashing.

Question 16

1. A secure vault where encryption keys used by the interface are stored.
2. A temporary holding area where incoming data is validated and cleansed before being loaded into the target production system. (correct answer)
3. A backup copy of the target system maintained for disaster recovery purposes.
4. A monitoring console where IT staff review interface logs in real time.

Explanation: A staging area holds incoming data for validation, transformation, and cleansing before it enters the production target system, serving as a quality gate between source and destination. Answer B is correct. Key storage (A) is a key management function. Backup systems (C) serve disaster recovery. Monitoring consoles (D) are operational tools.

Question 17

1. Ensuring only fully authorized purchase orders (meeting all approval requirements) are transmitted to the supplier portal. (correct answer)
2. Encrypting the supplier portal's web interface with TLS.
3. Requiring suppliers to confirm receipt of each purchase order within 24 hours.
4. Restricting suppliers from viewing purchase orders older than 90 days.

Explanation: The most critical interface control ensures that only properly authorized transactions are transmitted - preventing unapproved orders from reaching suppliers and avoiding unauthorized commitments. Answer A is correct. TLS (B) addresses transit security. Supplier confirmation (C) is a business process control. Historical view restrictions (D) address access, not authorization.

Question 18

1. Flat file interfaces are incompatible with modern ERP systems.
2. Flat files cannot contain more than a few thousand records.
3. Flat files can be manually edited before processing, introducing errors or fraud if adequate controls are not in place. (correct answer)
4. Flat files are not supported by standard encryption algorithms.

Explanation: Unlike direct system-to-system APIs, flat files are discrete files that can be intercepted and manually altered before processing, creating a risk of unauthorized modification. Answer C is correct. Flat files are widely compatible (A) and can contain millions of records (B). Flat files can be encrypted (D).

Question 19

1. Real-time interfaces process individual transactions immediately, requiring controls that validate each transaction at the time of processing; batch interfaces process groups of transactions periodically, enabling control total verification across the batch. (correct answer)
2. Real-time interfaces are less secure than batch interfaces because they operate continuously.
3. Batch interfaces do not require reconciliation because they process complete datasets.
4. Real-time interfaces eliminate the need for error handling because failures are immediately visible to users.

Explanation: Real-time interfaces require per-transaction validation since there is no batch aggregation. Batch interfaces enable pre/post run control total comparisons across the group. Both have distinct control requirements. Answer A is correct. Real-time interfaces can be highly secure (B). Batch interfaces require reconciliation (C). Real-time interfaces absolutely require error handling (D).

Question 20

1. Reviewing interface error logs on a daily basis.
2. Comparing system record counts before and after each interface run.
3. Implementing input validation rules in the interface program that reject records failing format, range, or referential integrity checks. (correct answer)
4. Generating exception reports of transactions rejected by the interface.

Explanation: Input validation rules in the interface layer are preventive - they stop invalid records from entering the target system before any processing occurs. Answer C is correct. Error log review (A), record count comparisons (B), and exception reports (D) are all detective controls that identify problems after they have occurred.