You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 271
KEY ROTATION is important because:
Select an option first.
Correct answer: C — A key compromised UNDETECTED can be used indefinitely; rotation LIMITS the exposure WINDOW
Explanation: If a key is compromised WITHOUT DETECTION, an attacker can decrypt data indefinitely. ROTATING keys periodically LIMITS THE WINDOW during which any single compromised key is useful. It also limits the volume of data encrypted under any one key.
Question 272
A HARDWARE SECURITY MODULE (HSM) protects keys by:
Select an option first.
Correct answer: B — Storing and using keys inside TAMPER-RESISTANT hardware — the key never leaves in plaintext
Explanation: An HSM stores and USES cryptographic keys inside TAMPER-RESISTANT hardware. Operations are performed INSIDE the module, so the private key NEVER LEAVES IT in plaintext — even an administrator cannot extract it. That is a fundamentally stronger guarantee than software key storage.
Question 273
A DIGITAL SIGNATURE provides:
Select an option first.
Correct answer: D — AUTHENTICITY, INTEGRITY and NON-REPUDIATION — but NOT confidentiality
Explanation: A DIGITAL SIGNATURE (hashing the message and encrypting the hash with the sender's PRIVATE key) proves WHO sent it (authenticity), that it was NOT ALTERED (integrity), and that the sender CANNOT DENY sending it (non-repudiation). It does NOT make the message SECRET — for that you also need to ENCRYPT it.
Question 274
To send a CONFIDENTIAL message, the sender encrypts with:
Select an option first.
Correct answer: D — The RECIPIENT'S PUBLIC key — only the recipient's private key can decrypt it
Explanation: For CONFIDENTIALITY: encrypt with the RECIPIENT'S PUBLIC key, so only the RECIPIENT'S PRIVATE key can decrypt. For a SIGNATURE: encrypt the hash with the SENDER'S PRIVATE key, so anyone with the sender's PUBLIC key can verify it. The two use OPPOSITE keys, and the exam tests exactly this.
Question 275
NON-REPUDIATION means the sender:
Select an option first.
Correct answer: A — CANNOT credibly DENY having sent the message
Explanation: NON-REPUDIATION: because only the SENDER holds their PRIVATE key, a valid digital signature proves they sent it — they cannot credibly deny it. This matters for contracts, transactions and audit trails, and it is a property that symmetric encryption (where both parties share a key) cannot provide.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 276
An entity's TLS certificate has EXPIRED. The consequence is:
Select an option first.
Correct answer: D — Browsers display SECURITY WARNINGS, users are trained to ignore them, and the site may become inaccessible
Explanation: An EXPIRED certificate triggers browser warnings. The immediate harm is availability and reputational; the deeper harm is that it TRAINS USERS TO CLICK THROUGH security warnings — which is exactly what an attacker running a lookalike site relies on. Certificate lifecycle management is a real operational control.
Question 277
An organisation with no CERTIFICATE INVENTORY risks:
Select an option first.
Correct answer: D — Unexpected EXPIRY causing outages — and unknown certificates that cannot be revoked if compromised
Explanation: Without an inventory, certificates EXPIRE unexpectedly (causing outages, sometimes in critical systems) and UNKNOWN certificates cannot be ROTATED or REVOKED if the key is compromised. Automated certificate management (ACME/Let's Encrypt, or an enterprise CLM tool) addresses both.
Question 278
A SECURITY BASELINE (hardening standard) specifies:
Select an option first.
Correct answer: A — The MINIMUM required configuration for a system type — disabling unused services, changing defaults, applying settings
Explanation: A BASELINE (CIS Benchmarks, DISA STIGs, vendor guides) specifies the minimum secure CONFIGURATION: disable unused services and ports, change default credentials, enforce password and logging settings, apply the least-privilege model. CONFIGURATION DRIFT — systems slowly deviating from the baseline — is a real audit finding.
Question 279
DEFAULT CREDENTIALS left unchanged on a device are:
Select an option first.
Correct answer: C — A CRITICAL vulnerability — default credentials are published and are among the first things an attacker tries
Explanation: DEFAULT CREDENTIALS for routers, cameras, printers, databases and IoT devices are PUBLISHED and freely searchable. They are among the first things an attacker (and every automated scanner) tries. Changing them is a trivially cheap, extremely high-value control — and it is routinely missed on network appliances and IoT devices.
Question 280
IoT devices present a distinctive security challenge because they:
Select an option first.
Correct answer: A — Often CANNOT be patched, ship with default credentials, and have long lifespans with no vendor support
Explanation: IoT devices (cameras, sensors, building controls) frequently CANNOT be patched, ship with hardcoded or default credentials, and remain in service for a decade after the vendor stops supporting them. The mitigation is SEGMENTATION — isolate them on their own network so a compromised camera cannot reach the finance systems.
Question 281
An entity's OT (operational technology) network is connected to the IT network. The risk is:
Select an option first.
Correct answer: D — A compromise of the IT network could reach OT systems, with PHYSICAL and SAFETY consequences
Explanation: OT/ICS systems control PHYSICAL processes (manufacturing, utilities, building systems). A breach there has SAFETY and PHYSICAL consequences, not merely financial ones. OT systems often run legacy, unpatchable software. The control is rigorous SEGMENTATION between IT and OT, with tightly controlled and monitored crossing points.
Question 282
A BUSINESS EMAIL COMPROMISE (BEC) attack typically involves:
Select an option first.
Correct answer: C — Impersonating an executive or vendor to induce a FRAUDULENT PAYMENT — often with no malware at all
Explanation: BEC involves NO MALWARE — which is why technical controls miss it. The attacker impersonates a CEO or a known vendor (often after compromising their mailbox and studying real correspondence) and requests an urgent wire transfer or a change of bank details. The controls are PROCESS controls: callback verification on a KNOWN number, dual authorisation, and out-of-band confirmation of banking changes.
Question 283
The most effective control against a fraudulent CHANGE OF VENDOR BANK DETAILS is:
Select an option first.
Correct answer: D — CALLBACK VERIFICATION to a KNOWN, PREVIOUSLY-HELD phone number — never a number supplied in the request
Explanation: Confirming by EMAIL is useless — the attacker controls the mailbox. Calling a number SUPPLIED IN THE REQUEST is worse — the attacker answers. The control is a CALLBACK to a number ALREADY ON FILE from before the request, plus dual authorisation for banking changes.
Question 284
Cyber risk should be reported to the BOARD:
Select an option first.
Correct answer: C — REGULARLY, in BUSINESS terms — quantified impact and risk appetite, not vulnerability counts
Explanation: Boards need cyber risk framed as BUSINESS risk: what could happen, how likely, what it would cost, what our appetite is, and whether the residual risk is acceptable. Reporting patch counts and CVE numbers to a board is meaningless — it gives the appearance of oversight without the substance.
Question 285
An organisation's security policy exists but is not ENFORCED. The control is:
Select an option first.
Correct answer: C — INEFFECTIVE — a policy without enforcement, monitoring and consequences is documentation, not a control
Explanation: A POLICY is not a CONTROL. It becomes one only when it is COMMUNICATED, ENFORCED (technically where possible), MONITORED for compliance, and backed by CONSEQUENCES. Auditors test whether the policy actually changes behaviour — a policy nobody follows provides no assurance at all.
Question 286
TECHNICAL enforcement of a policy is preferable to procedural enforcement because it:
Select an option first.
Correct answer: A — Removes RELIANCE ON HUMAN COMPLIANCE — the system prevents the violation rather than asking people not to commit it
Explanation: A policy stating 'do not use USB drives' relies on compliance. TECHNICALLY DISABLING USB mass storage removes the choice. Wherever a control can be enforced by the system rather than requested of the user, it should be — automation removes human variability, which is the entire reason automated controls need smaller samples.
Question 287
An organisation's BYOD (bring your own device) policy creates the risk that:
Select an option first.
Correct answer: B — CORPORATE DATA resides on PERSONAL devices the organisation does not control and cannot wipe
Explanation: BYOD puts corporate data on devices the organisation does not own, cannot fully control, and may not be able to WIPE when the employee leaves. Controls: mobile device management (MDM), containerisation (separating corporate from personal data), remote wipe of the corporate container only, and a clear policy.
Question 288
A departing employee's PERSONAL phone contains corporate email. The organisation should:
Select an option first.
Correct answer: A — Remotely wipe ONLY the corporate CONTAINER — wiping personal data raises legal and privacy issues
Explanation: Wiping an employee's PERSONAL device entirely (destroying their photos and personal data) creates real legal exposure. CONTAINERISATION separates corporate from personal data, allowing a SELECTIVE wipe of the corporate container only. This should be established in the BYOD policy BEFORE it is needed.
Question 289
REMOTE WORK increases risk because:
Select an option first.
Correct answer: A — The corporate perimeter EXTENDS to home networks and personal devices — outside the organisation's control
Explanation: REMOTE WORK dissolves the perimeter: corporate data flows over home routers with default passwords, alongside family devices, on networks the organisation cannot see. This is a major driver of ZERO TRUST — verify every request explicitly, regardless of where it comes from, because 'inside the network' no longer means anything.
Question 290
A vendor's SOC 2 shows strong controls but the vendor has NO cyber insurance and a weak balance sheet. This matters because:
Select an option first.
Correct answer: D — If a breach occurs, the vendor may lack the FINANCIAL CAPACITY to compensate the user or remediate
Explanation: A SOC report addresses CONTROLS, not FINANCIAL CAPACITY. A vendor with excellent controls but no insurance and no capital may be unable to remediate a breach or compensate you when one occurs. VENDOR FINANCIAL due diligence and contractual protections (indemnities, insurance requirements) are separate from the SOC report.
Question 291
CONCENTRATION RISK in vendor management means:
Select an option first.
Correct answer: B — Excessive DEPENDENCE on a SINGLE vendor — whose failure would be catastrophic and from whom exit is difficult
Explanation: CONCENTRATION RISK: too much depends on one provider. If they fail, are breached, are acquired, or raise prices, the organisation has no realistic alternative. Mitigations: multi-vendor strategies, contractual exit rights, data portability, and a tested continuity plan for the vendor's failure.
Question 292
A FOURTH-PARTY risk is:
Select an option first.
Correct answer: D — Your VENDOR'S vendor — the subservice organisation, whose failure affects you through the chain
Explanation: FOURTH-PARTY (or Nth-party) risk: your vendor depends on ITS vendors, whose failure cascades to you. This is exactly what the SOC CARVE-OUT method exposes. Mapping the chain — and understanding where the single points of failure actually sit — is increasingly a board-level concern.
Question 293
A cloud provider's REGION goes down. A user with all data in that region experiences:
Select an option first.
Correct answer: D — A FULL OUTAGE — availability requires MULTI-REGION or multi-availability-zone architecture, which the user must CONFIGURE
Explanation: Cloud providers offer resilience — but the USER must ARCHITECT for it. Deploying everything into a single region means a regional outage takes you down entirely. Multi-AZ and multi-region deployment is a USER responsibility under the shared responsibility model, and it costs more.
Question 294
Under the SHARED RESPONSIBILITY model, resilience architecture (multi-region) is:
Select an option first.
Correct answer: B — The CUSTOMER'S responsibility — the provider offers the capability; the customer must configure it
Explanation: The provider is responsible for the SECURITY OF THE CLOUD (physical, hypervisor, infrastructure). The customer is responsible for SECURITY IN THE CLOUD — including configuration, access, encryption, and RESILIENCE ARCHITECTURE. A single-region deployment is the customer's choice and the customer's risk.
Question 295
The single most common cause of cloud data breaches is:
Select an option first.
Correct answer: A — CUSTOMER MISCONFIGURATION — a storage bucket left publicly readable, an over-permissive IAM role
Explanation: Cloud breaches overwhelmingly stem from CUSTOMER MISCONFIGURATION, not provider failure: publicly readable storage buckets, over-permissive IAM roles, security groups open to the internet, disabled logging. The provider secured the infrastructure; the customer left the door open. This is the shared responsibility model in action.
Question 296
A CLOUD SECURITY POSTURE MANAGEMENT (CSPM) tool detects:
Select an option first.
Correct answer: A — MISCONFIGURATIONS — public buckets, over-permissive roles, unencrypted volumes, disabled logging
Explanation: CSPM continuously scans cloud configurations against benchmarks and flags MISCONFIGURATIONS. Given that misconfiguration is the leading cause of cloud breaches, CSPM addresses the dominant risk directly — and it is far more effective than periodic manual review of a constantly-changing environment.
Question 297
The BEST evidence that a control OPERATED is:
Select an option first.
Correct answer: C — REPERFORMANCE or INSPECTION of documentary evidence of the control's actual operation
Explanation: The evidence hierarchy holds in ISC as in AUD: REPERFORMANCE and INSPECTION of the control's actual operation are strongest; OBSERVATION shows it operating today but not necessarily all year; INQUIRY ALONE IS NEVER SUFFICIENT. A policy document evidences DESIGN, never OPERATION.
Question 298
OBSERVING a control operating provides evidence about:
Select an option first.
Correct answer: A — The MOMENT OF OBSERVATION — people behave differently when watched, and one day is not a year
Explanation: OBSERVATION has two limitations: it evidences only the MOMENT OBSERVED, and people BEHAVE DIFFERENTLY when watched. It is useful for controls that leave no documentary trail (physical security, segregation in practice), but it must be supplemented for a period conclusion.
Question 299
A SECURITY CHAMPION programme places security-aware staff:
Select an option first.
Correct answer: D — WITHIN business and development teams — embedding security expertise where decisions are actually made
Explanation: SECURITY CHAMPIONS are embedded within development and business teams, bridging the gap between a central security function and the people making daily decisions. They scale security influence far beyond what a small central team can reach, and they catch issues at design time rather than at audit time.
Question 300
SHIFTING SECURITY LEFT means:
Select an option first.
Correct answer: C — Addressing security EARLY in the development lifecycle — at design and coding, rather than at final testing
Explanation: SHIFT LEFT moves security EARLIER: threat modelling at design, secure coding standards, static analysis in the IDE, automated scanning in the pipeline. A flaw caught at design costs a fraction of one caught in production — the same economics as the design-stage cost commitment in target costing.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.