You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 331
A password of 8 lowercase letters has approximately how many combinations?
Select an option first.
Correct answer: D — 26^8 — about 209 billion
Explanation: Combinations = 26^8 ≈ 2.09 × 10^11 (about 209 billion). At modern GPU cracking speeds this falls in minutes — which is why NIST emphasises LENGTH over complexity, and why breached-password screening matters more than composition rules.
Question 332
A passphrase of 4 random common words (from a 7,776-word list) has entropy of about:
Select an option first.
Correct answer: A — About 51 bits — 7,776^4, or roughly 12.9 bits per word
Explanation: 7,776^4 ≈ 3.6 × 10^15 combinations, or about 51 BITS of entropy (log2(7776) ≈ 12.9 bits per word × 4). This is far stronger than an 8-character complex password — and vastly easier to remember. It is the basis of the 'diceware' passphrase recommendation.
Question 333
An organisation retains data for 8 years but its privacy notice states 2 years. The excess retention is:
Select an option first.
Correct answer: A — 6 YEARS of unnecessary retention — a privacy violation and an enlarged breach exposure
Explanation: Excess = 8 - 2 = 6 YEARS. This breaches the entity's own PRIVACY NOTICE and the DATA MINIMISATION principle — and it enlarges the blast radius of any breach by six years' worth of records that should have been destroyed.
Question 334
GDPR breach notification to the supervisory authority is required within:
Select an option first.
Correct answer: A — 72 hours of BECOMING AWARE
Explanation: 72 HOURS from BECOMING AWARE (not from the breach occurring). Notification may be PHASED if full information is not yet available. Individuals must ALSO be notified without undue delay if the risk to them is high.
Question 335
HIPAA breach notification to affected individuals is required within:
Select an option first.
Correct answer: B — 60 days
Explanation: HIPAA requires notification to affected INDIVIDUALS without unreasonable delay and no later than 60 DAYS from discovery. Breaches affecting 500 or more individuals also require notification to HHS and prominent media outlets. Contrast GDPR's 72-hour authority notification.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 336
An organisation's SIEM produces 10,000 alerts/day; analysts can review 200. The unreviewed proportion is:
Select an option first.
Correct answer: B — 98% — a clear indication of ALERT FATIGUE and an untuned SIEM
Explanation: Unreviewed = (10,000 − 200)/10,000 = 98%. Genuine attacks are almost certainly buried in the unreviewed 98%. The fix is TUNING (suppressing known-benign patterns) and AUTOMATION (auto-triaging low-value alerts) — not hiring 50 more analysts.
Question 337
A ransomware demand is $2m; recovery from backups costs $300,000 and takes 5 days. Ignoring the ethics and legality, the economically rational choice is:
Select an option first.
Correct answer: B — RESTORE — $300,000 is far cheaper, provided the backups are TESTED and the 5-day outage is within the MTD
Explanation: Restoring at $300,000 is economically superior to a $2m ransom — PROVIDED the backups are TESTED and RESTORABLE, and the 5-day outage falls within the business's MTD. Note also that paying provides no guarantee of decryption, funds criminality, and may itself be illegal in some jurisdictions.
Question 338
A firewall rule review finds 400 rules, of which 90 relate to decommissioned systems. The stale-rule proportion is:
Select an option first.
Correct answer: C — 22.5% — nearly a quarter of the ruleset is obsolete, and each stale rule is potential unnecessary exposure
Explanation: Stale rules = 90/400 = 22.5%. Each obsolete rule may permit traffic that no longer has any business justification — and stale rules accumulate because nobody wants to be the person who breaks production by removing one. Periodic RULE REVIEW is a high-value audit procedure.
Question 339
An entity's mean time to DETECT is 150 days and mean time to RESPOND is 20 days. Total exposure is:
Select an option first.
Correct answer: B — 170 DAYS from compromise to resolution
Explanation: Total = MTTD (150) + MTTR (20) = 170 DAYS during which the attacker was in the environment. Reducing DETECTION time has the far larger effect here — which is the argument for investing in the DETECT function rather than adding more preventive controls.
Question 340
SLE = $400,000; ARO = 0.25. A control costing $60,000/yr reduces the ARO to 0.05. The decision is:
Select an option first.
Correct answer: D — IMPLEMENT — ALE falls from $100,000 to $20,000, an $80,000 saving against a $60,000 cost
Explanation: ALE before = $400,000 × 0.25 = $100,000. ALE after = $400,000 × 0.05 = $20,000. REDUCTION = $80,000. Cost = $60,000. NET BENEFIT = $20,000/yr. Marginal but positive — implement, and note that the $20,000 residual ALE must be explicitly accepted.
Question 341
Same facts, but the control costs $90,000/yr. The correct conclusion is:
Select an option first.
Correct answer: A — REJECT — the $80,000 ALE reduction does NOT cover the $90,000 cost; accepting the risk is the rational choice
Explanation: ALE reduction = $80,000. Cost = $90,000. NET LOSS = $10,000/yr. Implementing would DESTROY $10,000 of value annually. The rational response is to ACCEPT the $100,000 ALE (or find a cheaper control). An auditor who recommends a control that fails cost-benefit has not done the analysis.
Question 342
An organisation has TWO options: Control A costs $50,000 and cuts the ARO from 0.4 to 0.1. Control B costs $30,000 and cuts the SLE from $500,000 to $250,000. SLE is $500,000; ARO is 0.4. The BETTER choice is:
Select an option first.
Correct answer: D — CONTROL A — it saves $150,000 for $50,000 (net $100,000); Control B saves $100,000 for $30,000 (net $70,000)
Explanation: Baseline ALE = $500,000 × 0.4 = $200,000. CONTROL A: ALE = $500,000 × 0.1 = $50,000 → saves $150,000, costs $50,000, NET $100,000. CONTROL B: ALE = $250,000 × 0.4 = $100,000 → saves $100,000, costs $30,000, NET $70,000. A wins on NET BENEFIT despite costing more. Comparing costs alone would give the wrong answer.
Question 343
Using the prior facts, implementing BOTH controls gives an ALE of:
Select an option first.
Correct answer: A — $25,000 — ARO 0.1 x SLE $250,000
Explanation: With BOTH: ARO = 0.1 AND SLE = $250,000. ALE = $250,000 × 0.1 = $25,000. Total cost = $80,000. Total saving from the $200,000 baseline = $175,000. NET BENEFIT = $95,000 — which is LESS than Control A alone ($100,000). Adding Control B to Control A costs $30,000 and saves only $25,000. Diminishing returns are real.
Question 344
A system has MTBF 500 hrs and MTTR 50 hrs (90.9% availability). Doubling MTBF costs $200,000; halving MTTR costs $50,000. To maximise availability per dollar:
Select an option first.
Correct answer: C — HALVE the MTTR — it gives 500/525 = 95.2% for $50,000, versus 1000/1050 = 95.2% for $200,000
Explanation: Doubling MTBF: 1,000/(1,000+50) = 95.24%. Halving MTTR: 500/(500+25) = 95.24%. IDENTICAL availability — but one costs $200,000 and the other $50,000. Reducing MTTR is FOUR TIMES more cost-effective here. This is why monitoring, runbooks and trained staff often beat buying more reliable hardware.
Question 345
An organisation's dwell time is 200 days. It invests heavily in MORE PREVENTIVE controls. This is likely:
Select an option first.
Correct answer: D — MISALLOCATED — a 200-day dwell time is a DETECT failure; more prevention does not shorten the time to notice a breach that already happened
Explanation: A 200-day DWELL TIME means the attacker was INSIDE for 200 days undetected. That is a failure of DETECT, not of PREVENT. Adding more preventive controls does not help you NOTICE the intrusion that already succeeded. The investment should go to monitoring, detection engineering, and response capability.
Question 346
An entity encrypts data at rest, and stores the KEY in the same database. A breach of the database:
Select an option first.
Correct answer: D — Yields BOTH the data AND the key — the encryption provides NO protection, and the breach safe harbour does NOT apply
Explanation: Encryption's SAFE HARBOUR under breach laws requires that the KEY was NOT also compromised. Storing the key WITH the data means a single breach yields both — the encryption is worthless, the safe harbour does not apply, and the breach IS reportable. Key management is not a detail; it is the whole control.
Question 347
An organisation has an RPO of 1 hour and an RTO of 4 hours, but backs up NIGHTLY to a COLD site. The gap is:
Select an option first.
Correct answer: C — BOTH objectives are unmet — nightly backups give a 24-hour RPO (not 1), and a cold site gives an RTO of days (not 4 hours)
Explanation: TWO separate failures. RPO: nightly backups mean up to 24 HOURS of data loss against a stated objective of 1 HOUR. RTO: a COLD site takes DAYS to stand up against a stated objective of 4 HOURS. The stated objectives and the actual capability are wholly disconnected — a classic finding where the BIA was done and then ignored.
Question 348
To meet an RPO of 1 hour AND an RTO of 4 hours, the entity needs:
Select an option first.
Correct answer: B — HOURLY backups/replication (for the RPO) AND a WARM or HOT site (for the RTO) — the two objectives drive DIFFERENT investments
Explanation: RPO drives BACKUP FREQUENCY (hourly snapshots or continuous replication). RTO drives RECOVERY INFRASTRUCTURE (a warm or hot site). They are INDEPENDENT objectives requiring SEPARATE investments. Meeting one does not meet the other — hourly backups to a cold site still take days to restore.
Question 349
An organisation implements MFA, but its VPN allows a legacy protocol that BYPASSES MFA. The control is:
Select an option first.
Correct answer: D — INEFFECTIVE — a single bypass path defeats the control entirely; attackers find and use exactly these gaps
Explanation: A control with a BYPASS PATH is not a control. Attackers systematically probe for legacy protocols, exempted accounts and alternative endpoints that skip MFA. The audit procedure is to test whether MFA can be BYPASSED — not merely whether it is CONFIGURED. Configuration is design; the absence of a bypass is operation.
Question 350
An MFA deployment exempts 12 'service accounts' and 5 executives (for convenience). The security posture is:
Select an option first.
Correct answer: D — COMPROMISED — 17 high-value accounts have no MFA, and executives are the PRIMARY phishing targets
Explanation: EXECUTIVES are the primary targets of spear-phishing precisely because of their access and authority — exempting them for convenience inverts the risk logic. SERVICE ACCOUNTS need their own controls (vaulting, restricted interactive login, monitoring), not a blanket exemption. Seventeen unprotected high-value accounts is not a strong posture.
Question 351
A quarterly access review is performed, but the reviewer approves 400 users in 6 minutes. The auditor should conclude:
Select an option first.
Correct answer: C — The review was NOT PERFORMED — 400 users in 6 minutes is under one second each; this is a rubber stamp
Explanation: 400 users in 6 minutes is 0.9 SECONDS PER USER — physically impossible to review meaningfully. The METADATA (time taken, number of removals, whether any access was questioned) is powerful audit evidence that a review was performed in name only. The control exists on paper and not in fact.
Question 352
A phishing simulation shows a 2% click rate, but the organisation's TRAINING is mandatory and simulations are ANNOUNCED IN ADVANCE. The 2% figure is:
Select an option first.
Correct answer: A — MISLEADING — an announced simulation measures alertness during a period of heightened awareness, not real-world susceptibility
Explanation: ANNOUNCING a phishing simulation destroys its validity — you are measuring performance while people are actively watching for it. A real attacker does not announce themselves. Simulations must be UNANNOUNCED and realistic to produce a meaningful baseline. A suspiciously good result should prompt scrutiny of the METHOD.
Question 353
An entity's SIEM detected the intrusion on DAY 1, but nobody acted until DAY 90. The failure is in:
Select an option first.
Correct answer: C — RESPOND — detection WORKED; the failure was in triage, escalation and action
Explanation: The SIEM DETECTED it on day 1 — the DETECT function worked. The failure was RESPOND: the alert was not triaged, not escalated, or lost in the noise. This is a common and painful finding — organisations invest in detection tooling and then lack the people and processes to act on what it tells them.
Question 354
An organisation buys an expensive EDR tool but has no one to monitor it. This is:
Select an option first.
Correct answer: B — SECURITY THEATRE — a detection tool nobody monitors detects nothing; the ALERT is not the control, the RESPONSE is
Explanation: A detection tool generating alerts into an empty room is not a control. The RESPONSE is the control. An organisation without the capacity to monitor and act should consider a MANAGED service (MDR) — buying tooling it cannot operate is a waste of money that produces a false sense of security.
Question 355
An entity's logs are stored on the SAME server they monitor. An attacker who compromises the server:
Select an option first.
Correct answer: C — CAN ALTER OR DELETE the logs, erasing the evidence of the intrusion
Explanation: Logs stored on the monitored system are within the attacker's reach the moment they compromise it — and erasing them is standard practice. Logs must be forwarded IMMEDIATELY to a SEPARATE, APPEND-ONLY system (a SIEM, a log server) that the compromised account cannot modify.
Question 356
An organisation's backup strategy: nightly to a NAS on the same network, replicated to a cloud bucket with the same admin credentials. A ransomware attack would:
Select an option first.
Correct answer: C — Likely ENCRYPT ALL THREE COPIES — same network, same credentials; there is no OFFLINE or IMMUTABLE copy
Explanation: An attacker with domain admin reaches the NAS (same network) AND the cloud bucket (same credentials). All three copies are encrypted. The 3-2-1 rule is not satisfied in SUBSTANCE — three copies exist, but they share a FATE. The requirement is an OFFLINE, AIR-GAPPED or IMMUTABLE copy the attacker cannot reach even with full credentials.
Question 357
A cloud backup with OBJECT LOCK (immutability) enabled for 30 days survives ransomware because:
Select an option first.
Correct answer: B — It CANNOT BE DELETED OR ALTERED for 30 days — even by an administrator with full credentials
Explanation: OBJECT LOCK / WORM makes the backup UNDELETABLE for a set period — even by a root administrator. That is precisely the property that defeats ransomware, because the attacker's stolen admin credentials confer no power to destroy it. It is the strongest single backup control available.
Question 358
An entity's privacy notice permits using data for 'service improvement'. It uses customer data to TRAIN A COMMERCIAL AI MODEL sold to third parties. This is:
Select an option first.
Correct answer: C — Likely OUTSIDE the stated purpose — 'service improvement' does not plainly encompass building a product sold to others; PURPOSE LIMITATION is breached
Explanation: PURPOSE LIMITATION requires data to be used only for the purposes stated at collection. 'Service improvement' does not plainly cover training a model SOLD TO THIRD PARTIES — that is a NEW purpose requiring a fresh lawful basis. This is a live and heavily litigated issue, and the SOC 2 PRIVACY criterion would test exactly this.
Question 359
An organisation anonymises data and concludes GDPR no longer applies. Re-identification is possible by combining it with public data. The conclusion is:
Select an option first.
Correct answer: D — WRONG — if re-identification is possible by reasonable means, the data is PSEUDONYMISED, not anonymised, and GDPR STILL APPLIES
Explanation: TRUE ANONYMISATION means re-identification is impossible BY ANY REASONABLE MEANS — including by combining the data with other available datasets. If re-identification is achievable, the data remains PERSONAL DATA and stays fully within GDPR. Organisations routinely overestimate how anonymous their 'anonymised' data really is.
Question 360
A user with legitimate access downloads 50,000 customer records at 3am. The control that should detect this is:
Select an option first.
Correct answer: B — UEBA (user and entity behaviour analytics) — the ACCESS was authorised, so only ANOMALOUS BEHAVIOUR detection catches it
Explanation: Every ACCESS control passed — the user was authorised. What is anomalous is the BEHAVIOUR: volume, timing, and deviation from their own baseline. UEBA establishes what NORMAL looks like for each user and flags departures. It is the primary detective control against the AUTHORISED insider — against whom access controls are, by definition, useless.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.