You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 301
THREAT MODELLING is performed:
Select an option first.
Correct answer: C — At DESIGN time — identifying what could go wrong BEFORE the system is built
Explanation: THREAT MODELLING asks, at DESIGN time: what are we building, what could go wrong, what will we do about it, and did we do a good job? Identifying that a design exposes an API without object-level authorisation is far cheaper at the whiteboard than after a breach.
Question 302
A SECURE CODING standard addresses:
Select an option first.
Correct answer: B — Common vulnerability classes — input validation, output encoding, parameterised queries, authentication and error handling
Explanation: SECURE CODING standards target the vulnerability classes that cause real breaches: INPUT VALIDATION (SQL injection), OUTPUT ENCODING (XSS), PARAMETERISED QUERIES, proper AUTHENTICATION and SESSION management, safe ERROR HANDLING (not leaking stack traces), and secure secret handling.
Question 303
STATIC application security testing (SAST) analyses:
Select an option first.
Correct answer: B — SOURCE CODE, without executing it — catching flaws early, but with false positives
Explanation: SAST analyses SOURCE CODE without running it — it catches flaws EARLY (shift left) and can run in the IDE and the pipeline, but it generates FALSE POSITIVES and cannot see runtime or configuration issues. DAST tests the RUNNING application from the outside, catching what SAST cannot. Both are needed.
Question 304
A SECRET (API key, password) hardcoded in SOURCE CODE is:
Select an option first.
Correct answer: C — A SERIOUS vulnerability — it is exposed to everyone with repository access, and persists in the GIT HISTORY forever
Explanation: HARDCODED SECRETS are exposed to everyone with repository access — and REMOVING them does not help, because they persist in the GIT HISTORY. They must be ROTATED, not merely deleted. Controls: secret scanning in the pipeline, and a proper secrets manager or vault.
Question 305
A DEPENDENCY (open-source library) with a known vulnerability is a:
Select an option first.
Correct answer: B — SUPPLY CHAIN risk — modern applications are mostly third-party code, and a flaw in a library is a flaw in your application
Explanation: Modern applications are largely composed of THIRD-PARTY LIBRARIES. A vulnerability in a widely-used dependency (Log4j being the canonical example) instantly becomes a vulnerability in every application using it. Controls: SOFTWARE COMPOSITION ANALYSIS, a software bill of materials (SBOM), and prompt patching of dependencies.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 306
A SOFTWARE BILL OF MATERIALS (SBOM) enables an organisation to:
Select an option first.
Correct answer: B — Rapidly determine WHETHER IT IS AFFECTED when a new vulnerability is announced in a third-party component
Explanation: When a critical vulnerability in a widely-used library is announced, the first question is 'ARE WE AFFECTED?' Without an SBOM, answering that takes weeks of manual investigation. With one, it takes minutes. Log4Shell made this painfully clear across the industry.
Question 307
SLE = $100,000; ARO = 0.5. The ALE is:
Select an option first.
Correct answer: B — $50,000
Explanation: ALE = SLE × ARO = $100,000 × 0.5 = $50,000. An ARO of 0.5 means the event is expected once every two years.
Question 308
An event expected TWICE PER YEAR with an SLE of $30,000 has an ALE of:
Select an option first.
Correct answer: A — $60,000
Explanation: ARO = 2 (twice per year). ALE = $30,000 × 2 = $60,000.
Question 309
An event expected once every 4 years has an ARO of:
Select an option first.
Correct answer: A — 0.25
Explanation: ARO = 1/4 = 0.25. If the SLE were $2,000,000, the ALE would be $2,000,000 × 0.25 = $500,000.
Question 310
A control costs $80,000/yr and reduces ALE from $200,000 to $90,000. The NET BENEFIT is:
Select an option first.
Correct answer: B — $30,000 — the $110,000 ALE reduction less the $80,000 cost
Explanation: ALE reduction = $200,000 − $90,000 = $110,000. Cost = $80,000. NET BENEFIT = $110,000 − $80,000 = $30,000 per year. The control is JUSTIFIED, and the residual $90,000 ALE must be accepted.
Question 311
A control costs $150,000/yr and reduces ALE from $180,000 to $120,000. It is:
Select an option first.
Correct answer: B — NOT justified — it costs $150,000 to save only $60,000
Explanation: ALE reduction = $180,000 − $120,000 = $60,000. Cost = $150,000. NET LOSS = $90,000 per year. The control DESTROYS value. An auditor should challenge it.
Question 312
SLE = $500,000; ARO drops from 0.4 to 0.05 after a control. The ALE reduction is:
Select an option first.
Correct answer: A — $175,000 — from $200,000 to $25,000
Explanation: ALE before = $500,000 × 0.4 = $200,000. ALE after = $500,000 × 0.05 = $25,000. REDUCTION = $175,000. Any control costing under $175,000/yr is justified.
Question 313
Encryption reduces the SLE from $1,000,000 to $200,000; the ARO remains 0.3. The ALE reduction is:
Select an option first.
Correct answer: A — $240,000 — from $300,000 to $60,000
Explanation: ALE before = $1,000,000 × 0.3 = $300,000. ALE after = $200,000 × 0.3 = $60,000. REDUCTION = $240,000. Note encryption reduced the SLE (loss per incident), NOT the ARO — the breach is just as likely, but far less damaging.
Question 314
MTBF = 900 hours; MTTR = 100 hours. Availability is:
Select an option first.
Correct answer: D — 90% — 900/(900+100)
Explanation: Availability = MTBF / (MTBF + MTTR) = 900 / (900 + 100) = 900/1,000 = 90%.
Question 315
MTBF = 990 hours; MTTR = 10 hours. Availability is:
Select an option first.
Correct answer: C — 99%
Explanation: Availability = 990 / (990 + 10) = 990/1,000 = 99%. Note that reducing MTTR from 100 to 10 hours raised availability from 90% to 99% — recovering FASTER is often far cheaper than failing LESS OFTEN.
Question 316
A system with 99% availability is down approximately how many hours per year?
Select an option first.
Correct answer: D — 87.6
Explanation: Downtime = (1 − 0.99) × 8,760 hours = 0.01 × 8,760 = 87.6 hours per year (about 3.65 days).
Question 317
A system with 99.9% availability is down approximately:
Select an option first.
Correct answer: D — 8.76 hours/yr
Explanation: Downtime = 0.001 × 8,760 = 8.76 hours per year. Each additional 'nine' reduces downtime tenfold — and costs dramatically more.
Question 318
A system with 99.99% availability is down approximately:
Select an option first.
Correct answer: A — 53 minutes/yr
Explanation: Downtime = 0.0001 × 8,760 hours = 0.876 hours = about 53 MINUTES per year. 'Five nines' (99.999%) would be about 5 minutes.
Question 319
To improve availability from 90% (MTBF 900, MTTR 100) the CHEAPEST lever is often to:
Select an option first.
Correct answer: C — REDUCE the MTTR — cutting MTTR to 50 hours gives 900/950 = 94.7%, usually cheaper than doubling reliability
Explanation: Two levers: raise MTBF (fail less often — expensive, requiring better hardware or redundancy) or cut MTTR (recover faster — often achievable through better monitoring, documented runbooks, spare parts on site, and trained staff). Reducing MTTR is usually the cheaper first move.
Question 320
Risk = Threat × Vulnerability × Impact. Threat = 0.8; Vulnerability = 0.5; Impact = $200,000. Risk is:
Select an option first.
Correct answer: B — $80,000
Explanation: Risk = 0.8 × 0.5 × $200,000 = $80,000. A control halving the VULNERABILITY (to 0.25) would reduce risk to $40,000.
Question 321
Using the prior facts, patching reduces Vulnerability from 0.5 to 0.1. The new risk is:
Select an option first.
Correct answer: C — $16,000 — 0.8 × 0.1 × $200,000
Explanation: New risk = 0.8 × 0.1 × $200,000 = $16,000. The risk fell by $64,000. Note PATCHING reduced the VULNERABILITY term — it did not change the THREAT (0.8) or the IMPACT.
Question 322
Using the same facts, ENCRYPTION reduces Impact from $200,000 to $20,000 (vulnerability stays 0.5). The new risk is:
Select an option first.
Correct answer: D — $8,000 — 0.8 × 0.5 × $20,000
Explanation: New risk = 0.8 × 0.5 × $20,000 = $8,000. ENCRYPTION reduced the IMPACT term — the breach is just as likely, but the stolen data is unusable. Identifying WHICH TERM a control affects is the analytical skill.
Question 323
An organisation has 200 servers; 12 are unpatched for a critical vulnerability. The exposure rate is:
Select an option first.
Correct answer: C — 6%
Explanation: Exposure = 12/200 = 6%. Note that 6% may still be catastrophic if even ONE of those 12 is internet-facing — the PERCENTAGE matters far less than WHICH systems are exposed.
Question 324
A phishing simulation: 500 employees, 60 clicked, 15 entered credentials. The CLICK rate is:
Select an option first.
Correct answer: D — 12%
Explanation: Click rate = 60/500 = 12%. The CREDENTIAL ENTRY rate = 15/500 = 3% — and 15/60 = 25% of those who clicked went on to enter credentials. All three metrics matter; the credential rate is the most alarming.
Question 325
Using the prior facts, the CREDENTIAL ENTRY rate among those who CLICKED is:
Select an option first.
Correct answer: B — 25% — 15 of the 60 who clicked
Explanation: Of the 60 who clicked, 15 entered credentials = 25%. This is the most operationally significant figure: a click is recoverable, but entering credentials is a compromise. It also shows that a warning page after the click could cut the harm by 75%.
Question 326
An organisation detects an intrusion 180 days after compromise and contains it in 5 days. The DWELL TIME is:
Select an option first.
Correct answer: C — 180 days — from compromise to DETECTION
Explanation: DWELL TIME = time from COMPROMISE to DETECTION = 180 days. The 5 days is the CONTAINMENT time. A 180-day dwell time indicates a serious failure of the DETECT function — the attacker had six months to move laterally and exfiltrate.
Question 327
A key of 128 bits has approximately how many possible values?
Select an option first.
Correct answer: B — 2^128 — roughly 3.4 x 10^38
Explanation: A 128-bit key has 2^128 possible values — approximately 3.4 × 10^38. This is why AES-128 remains secure against brute force: exhaustively searching that keyspace is computationally infeasible with current technology.
Question 328
Adding ONE bit to a key length:
Select an option first.
Correct answer: A — DOUBLES the keyspace — each additional bit doubles the number of possible keys
Explanation: Each additional BIT DOUBLES the keyspace. So AES-256 is not 'twice as strong' as AES-128 — it has 2^128 times as many possible keys. This exponential relationship is why relatively modest key lengths provide enormous security margins.
Question 329
ECC-256 provides security roughly equivalent to RSA:
Select an option first.
Correct answer: D — RSA-3072
Explanation: ECC-256 ≈ RSA-3072 in strength. ECC achieves equivalent security with a MUCH SHORTER key, which is why it dominates mobile and IoT — less computation, less bandwidth, less battery, the same security.
Question 330
NIST recommends a minimum symmetric key strength through 2030 of:
Select an option first.
Correct answer: A — 112 bits
Explanation: NIST: a minimum of 112-bit security through 2030, and 128-bit beyond. AES-128 comfortably exceeds this. Legacy algorithms (DES at 56 bits, 3DES) fall below it and should be retired.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.