Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
499 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 1
The four IT General Control (ITGC) domains are:
Select an option first.
Correct answer: B — Logical access; change management; IT operations; systems development and acquisition
Explanation: The four ITGC domains: LOGICAL ACCESS (authentication, authorisation, segregation of duties); CHANGE MANAGEMENT (request, approve, test, deploy); IT OPERATIONS (job scheduling, backups, incident management); and SYSTEMS DEVELOPMENT/ACQUISITION (SDLC, vendor management). ITGCs are the foundation on which application controls can be relied upon.
Question 2
If ITGCs are INEFFECTIVE, the auditor:
Select an option first.
Correct answer: D — CANNOT rely on automated application controls without additional work
Explanation: This is the single most important concept in ISC. If CHANGE MANAGEMENT is ineffective, the program tested in March may not be the program that ran in September. A point-in-time test of an automated control extrapolates across the period ONLY if ITGCs guarantee the program did not change.
Question 3
RPO (Recovery Point Objective) measures:
Select an option first.
Correct answer: C — Maximum acceptable DATA LOSS, expressed in time
Explanation: RPO = the maximum acceptable DATA LOSS, measured in TIME ('how old can the restored data be?'). It drives BACKUP FREQUENCY. RTO measures maximum acceptable DOWNTIME and drives RECOVERY INFRASTRUCTURE. They are independent objectives.
Question 4
RTO (Recovery Time Objective) drives:
Select an option first.
Correct answer: B — RECOVERY INFRASTRUCTURE — how quickly systems must be restored
Explanation: RTO = maximum acceptable DOWNTIME, so it drives the RECOVERY INFRASTRUCTURE (hot site, warm site, cold site). RPO drives BACKUP FREQUENCY. An RPO of 5 minutes demands continuous replication; an RTO of 5 minutes demands a hot site.
Question 5
A HOT site is characterised by:
Select an option first.
Correct answer: A — FULLY equipped with LIVE, current data — RTO under an hour, highest cost
Explanation: HOT: fully equipped with live, mirrored data — RTO under an hour, HIGHEST cost. WARM: hardware and network ready but NO current data — RTO of hours to a day, mid cost. COLD: facility and utilities only — RTO of days to weeks, LOWEST cost. Cost trades directly against recovery speed.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 6
A COLD site provides:
Select an option first.
Correct answer: C — FACILITY and UTILITIES only — the longest RTO and the lowest cost
Explanation: A COLD site is essentially an empty room with power, cooling and connectivity. Equipment must be procured and data restored — an RTO of DAYS TO WEEKS. It is the cheapest option, appropriate only where the business can tolerate a long outage.
Question 7
A Business Impact Analysis (BIA) produces:
Select an option first.
Correct answer: C — Critical processes, MTD, RTO, RPO, resource requirements, and financial/operational impacts
Explanation: The BIA identifies CRITICAL PROCESSES and their dependencies, and establishes MTD (maximum tolerable downtime), RTO, RPO, resource needs, and financial/operational impact. Constraint: RTO must be ≤ MTD. The BIA comes FIRST — without it, you protect the wrong things at the wrong cost.
Question 8
System availability is computed as:
Select an option first.
Correct answer: B — MTBF / (MTBF + MTTR)
Explanation: Availability = MTBF / (MTBF + MTTR), where MTBF = Mean Time Between Failures and MTTR = Mean Time To Repair. Availability rises by failing LESS OFTEN (higher MTBF) or recovering FASTER (lower MTTR) — and the second is often far cheaper than the first.
Question 9
A CHECK DIGIT is designed to detect:
Select an option first.
Correct answer: C — TRANSPOSITION or entry errors in an IDENTIFICATION NUMBER
Explanation: A CHECK DIGIT is an extra digit mathematically derived from the other digits of an identifier. If the number is mis-keyed or transposed, the recomputed check digit will not match and the entry is rejected. It guards the ACCURACY of identification numbers specifically.
Question 10
A HASH TOTAL is:
Select an option first.
Correct answer: C — A sum of a field with NO intrinsic meaning (e.g. account numbers), used purely to detect processing errors
Explanation: A HASH TOTAL sums a field that is MEANINGLESS as a total — the sum of all customer account numbers, for instance. It has no financial significance; its only purpose is to detect whether a record was lost, added or altered during processing. A BATCH (financial) total sums a MEANINGFUL field such as dollar amounts.
Question 11
A LIMIT (reasonableness) check would detect:
Select an option first.
Correct answer: C — A value OUTSIDE a predetermined acceptable range (e.g. 400 hours worked in a week)
Explanation: A LIMIT or REASONABLENESS check rejects values outside a predetermined range. A missing field is caught by a COMPLETENESS check; a duplicate by a DUPLICATE check; an unauthorised login by ACCESS controls. Matching the error type to the control is the skill being tested.
Question 12
A VALIDITY check verifies that:
Select an option first.
Correct answer: D — A field contains data of the correct TYPE, or a value from an AUTHORISED LIST
Explanation: A VALIDITY check confirms the entered data is valid — that a transaction code matches an authorised list, or a field contains only permissible values. It rejects entries that fall outside the permissible set.
Question 13
Application controls operate at the:
Select an option first.
Correct answer: C — TRANSACTION level — input, processing and output
Explanation: APPLICATION controls operate at the TRANSACTION level: INPUT (edit checks, validation, batch totals); PROCESSING (run-to-run totals, logic checks); and OUTPUT (distribution restrictions, reconciliation, error-log review). They sit ON TOP of the ITGCs, and are only as trustworthy as the ITGCs beneath them.
Question 14
The SDLC phase in which requirements are defined is:
Select an option first.
Correct answer: A — REQUIREMENTS ANALYSIS
Explanation: The SDLC phases: (1) Planning/feasibility; (2) REQUIREMENTS ANALYSIS; (3) System design; (4) Development/coding; (5) Testing/QA; (6) Implementation/deployment; (7) Maintenance. The classic risk in phase 2 is SCOPE CREEP; in phase 5, inadequate testing.
Question 15
The WATERFALL methodology is characterised by:
Select an option first.
Correct answer: A — SEQUENTIAL phases with heavy documentation — suited to STABLE requirements
Explanation: WATERFALL: sequential, heavily documented, rigid — appropriate where requirements are STABLE and well understood. AGILE: iterative sprints, flexible, suited to CHANGING requirements. DEVOPS: integrates development and operations with CI/CD and automated testing.
Question 16
AGILE methodologies are best suited to projects with:
Select an option first.
Correct answer: C — CHANGING or EVOLVING requirements
Explanation: AGILE uses short, iterative SPRINTS with frequent delivery and feedback — ideal when requirements are EVOLVING. Note that Agile does NOT remove the need for controls; it AUTOMATES them. In a CI/CD pipeline, the approval gates and automated tests ARE the change-management control.
Question 17
In the CLOUD SHARED RESPONSIBILITY model under IaaS, the CUSTOMER manages:
Select an option first.
Correct answer: B — The OS, runtime, applications AND data
Explanation: IaaS: the customer manages the OS, runtime, applications and data (AWS EC2). PaaS: the customer manages applications and data only (Heroku). SaaS: the customer manages data and configuration only (Salesforce). The provider manages everything BELOW the customer's layer.
Question 18
Under SaaS, the customer is responsible for:
Select an option first.
Correct answer: C — DATA and CONFIGURATION only
Explanation: Under SaaS, the customer manages only its DATA and CONFIGURATION (user access, settings). The provider manages the application, runtime, OS, virtualisation, servers and network. Crucially, outsourcing does NOT outsource ACCOUNTABILITY — it just means you now need a SOC report to cover what you no longer control.
Question 19
A PUBLIC cloud deployment model means:
Select an option first.
Correct answer: A — SHARED, MULTI-TENANT infrastructure (AWS, Azure)
Explanation: PUBLIC = shared, multi-tenant infrastructure. PRIVATE = dedicated to one organisation. COMMUNITY = shared by organisations with common concerns. HYBRID = public and private orchestrated together. The audit concern with PUBLIC cloud is MULTI-TENANCY — your data shares hardware with strangers.
Question 20
ETL stands for and means:
Select an option first.
Correct answer: C — Extract, Transform, Load — transform BEFORE loading, typically into a structured data warehouse
Explanation: ETL: Extract → TRANSFORM → Load (transform BEFORE loading; feeds a structured DATA WAREHOUSE). ELT: Extract → Load → TRANSFORM (load raw, transform later; feeds a DATA LAKE). WHERE the transformation happens is the entire difference.
Question 21
A DATA WAREHOUSE uses:
Select an option first.
Correct answer: D — SCHEMA-ON-WRITE — structure is imposed BEFORE loading; analytics-optimised
Explanation: A DATA WAREHOUSE is structured, SCHEMA-ON-WRITE, and analytics-optimised — structure is imposed up front (governed, but slower to change). A DATA LAKE stores raw, unstructured data with SCHEMA-ON-READ — flexible, cheap, and prone to becoming a 'data swamp' with no governance. That governance risk is the audit angle.
Question 22
The first three normal forms require, respectively:
Select an option first.
Correct answer: B — 1NF atomic values; 2NF no PARTIAL dependencies; 3NF no TRANSITIVE dependencies
Explanation: 1NF: atomic values, no repeating groups. 2NF: 1NF + no PARTIAL dependencies (non-key attributes depend on the FULL primary key). 3NF: 2NF + no TRANSITIVE dependencies (non-key attributes depend only on the key, not on each other). Normalisation reduces redundancy, which reduces INCONSISTENT data — the audit rationale.
Question 23
The data lifecycle stage in which data is CLASSIFIED is:
Select an option first.
Correct answer: B — CREATE — classification happens at creation, because you cannot protect data appropriately until you know what it is worth
Explanation: The data lifecycle: CREATE (classify) → READ (access controls) → UPDATE (audit trails) → DELETE (logical removal) → DISCLOSE (DLP, authorisation) → DESTROY (sanitise). Classification comes FIRST — every downstream control depends on it.
Question 24
DELETION differs from DESTRUCTION in that deletion:
Select an option first.
Correct answer: A — Is LOGICAL — the data may still be RECOVERABLE
Explanation: DELETION is LOGICAL — the pointer is removed but the data often remains recoverable. DESTRUCTION is physical and irreversible (overwriting, degaussing, shredding). Selling a decommissioned server whose data was only 'deleted' is a genuine breach — a favourite exam scenario.
Question 25
The government data classification hierarchy is:
Select an option first.
Correct answer: D — Top Secret → Secret → Confidential → Unclassified
Explanation: GOVERNMENT: Top Secret → Secret → Confidential → Unclassified. COMMERCIAL: Restricted → Confidential → Internal → Public. Classification drives access controls, handling, retention and destruction requirements.
Question 26
A DUPLICATE CHECK in a purchasing system prevents:
Select an option first.
Correct answer: D — Paying the SAME INVOICE TWICE
Explanation: A DUPLICATE CHECK compares a new transaction against those already processed and rejects an exact repeat. Its classic use is preventing the same invoice from being PAID TWICE — whether by error or by a fraudster resubmitting a paid invoice.
Question 27
A three-way match compares:
Select an option first.
Correct answer: A — PURCHASE ORDER, RECEIVING REPORT and INVOICE
Explanation: A THREE-WAY MATCH compares the PURCHASE ORDER (was it authorised?), the RECEIVING REPORT (did the goods arrive?), and the INVOICE (is the billing correct?). All three must agree before payment. It is the primary control against paying for goods never ordered or never received.
Question 28
A BATCH TOTAL sums:
Select an option first.
Correct answer: D — A MEANINGFUL financial field, such as invoice amounts
Explanation: A BATCH (financial) TOTAL sums a MEANINGFUL field — invoice dollar amounts, for example — and the total is compared before and after processing. A HASH TOTAL sums a field with NO intrinsic meaning (account numbers), purely to detect lost or altered records. A RECORD COUNT counts records.
Question 29
The 'test data' CAAT technique involves:
Select an option first.
Correct answer: A — Running the AUDITOR'S OWN fictitious transactions (including invalid ones) through the CLIENT'S program
Explanation: TEST DATA: the auditor's OWN prepared transactions — deliberately including INVALID ones — are run through the CLIENT'S program to confirm that the programmed controls accept the valid and reject the invalid. Its limitation: it tests the program at a POINT IN TIME.
Question 30
PARALLEL SIMULATION involves:
Select an option first.
Correct answer: A — REAL client data through the AUDITOR'S OWN program, comparing the outputs
Explanation: PARALLEL SIMULATION: the auditor writes (or controls) an independent program replicating the client application's logic, runs the CLIENT'S REAL DATA through it, and compares outputs. A difference points to a defect in the client's processing. Contrast TEST DATA (fake data, client's program) and the ITF (dummy entity, live system).
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.