You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 361
The reason ACCESS CONTROLS cannot stop a malicious insider is that:
Select an option first.
Correct answer: C — The insider's access is AUTHORISED — access controls permit exactly what they were designed to permit
Explanation: An access control's job is to permit AUTHORISED access. A malicious insider IS authorised — so the control works exactly as designed, and permits the abuse. Defending against insiders requires DIFFERENT controls: least privilege (limit what they can reach), segregation of duties (require a second person), monitoring/UEBA (detect anomalous use), and prompt de-provisioning.
Question 362
An organisation's vulnerability scan finds 4,000 issues. It patches by CVSS score alone, ignoring exploitability and exposure. This approach is:
Select an option first.
Correct answer: D — SUBOPTIMAL — a CRITICAL vulnerability on an isolated internal test server matters less than a MEDIUM one on an internet-facing system being actively exploited
Explanation: CVSS measures SEVERITY IN THE ABSTRACT. Real prioritisation requires CONTEXT: is it internet-facing? Is it being ACTIVELY EXPLOITED in the wild? Is the affected system critical? A medium-severity flaw on an exposed, actively-exploited, business-critical system outranks a critical one on an isolated test box.
Question 363
A control is DESIGNED to detect misstatements above $50,000. Performance materiality is $30,000. The control is:
Select an option first.
Correct answer: C — NOT SUFFICIENTLY PRECISE — it would MISS misstatements between $30,000 and $50,000, exactly the range that needs covering
Explanation: PRECISION is the threshold at which a control would actually catch an error. A control detecting only misstatements above $50,000 MISSES the $30,000-$50,000 range — precisely what performance materiality requires be covered. Testing an imprecise control more often only confirms, with greater confidence, that it is imprecise.
Question 364
An entity's incident response plan requires notifying the CISO. The CISO is on leave and the deputy is not named. This reveals:
Select an option first.
Correct answer: B — A SINGLE POINT OF FAILURE in the plan — incidents do not wait for people to return from leave; deputies and escalation paths must be defined
Explanation: An IR plan built around named INDIVIDUALS rather than ROLES, with no defined DEPUTIES, fails the moment someone is unavailable — and incidents overwhelmingly occur outside business hours, at weekends, and during holidays. Plans must define ROLES, DEPUTIES and 24/7 escalation paths. A tabletop exercise would have found this.
Question 365
An organisation stores its incident response plan ONLY on the network it protects. During a ransomware attack:
Select an option first.
Correct answer: C — The plan is ENCRYPTED and INACCESSIBLE — exactly when it is needed most
Explanation: A ransomware attack encrypts the network — including the IR plan, the contact lists, the network diagrams and the recovery runbooks stored on it. The plan must be available OFFLINE (printed copies, an out-of-band system). Organisations discover this in the worst possible way, and it is entirely foreseeable.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 366
An organisation's security spend is 80% PROTECT, 15% DETECT, 5% RESPOND. Its dwell time is 250 days. The rational reallocation is:
Select an option first.
Correct answer: B — Toward DETECT and RESPOND — prevention will eventually fail, and a 250-day dwell time shows the failure goes unnoticed for eight months
Explanation: An 80/15/5 split against a 250-day dwell time is a diagnosis in itself. Prevention WILL eventually fail — that is the premise of defence in depth. What matters then is how fast you NOTICE and how fast you ACT. The reallocation toward DETECT and RESPOND follows directly from the evidence.
Question 367
An entity's DLP tool is deployed but no data has been CLASSIFIED. The DLP will:
Select an option first.
Correct answer: C — Detect almost NOTHING — DLP can only protect data it can RECOGNISE, and classification is the prerequisite
Explanation: DLP works by RECOGNISING sensitive data — through classification labels, pattern matching, or fingerprinting. With NO CLASSIFICATION and no configured patterns, it has no idea what to look for. This is why the data lifecycle BEGINS with classification: every downstream protective control depends on it.
Question 368
An organisation achieves ISO 27001 certification AND an unqualified SOC 2. It is then breached. This demonstrates that:
Select an option first.
Correct answer: B — NO control environment eliminates risk — RESIDUAL RISK always remains, and assurance is about REASONABLE, not ABSOLUTE, assurance
Explanation: Controls provide REASONABLE, not ABSOLUTE, assurance. Even a well-controlled organisation can be breached — by a zero-day, a sophisticated adversary, or an unlucky combination of events. RESIDUAL RISK is never zero. A breach is not, by itself, proof that the certifications were wrong or the auditors negligent.
Question 369
A SOC 1 report addresses:
Select an option first.
Correct answer: A — INTERNAL CONTROL OVER FINANCIAL REPORTING (ICFR) at the service organisation
Explanation: SOC 1 addresses ICFR at the service organisation, and its AUDIENCE is the USER ENTITY'S FINANCIAL STATEMENT AUDITOR. That is its entire reason for existing. If the question concerns FINANCIAL REPORTING, the answer is SOC 1.
Question 370
A SOC 2 report addresses:
Select an option first.
Correct answer: D — The TRUST SERVICES CRITERIA (security, availability, processing integrity, confidentiality, privacy)
Explanation: SOC 2 addresses the TRUST SERVICES CRITERIA. Its audience is MANAGEMENT and CUSTOMERS, and its use is RESTRICTED. SOC 1 addresses ICFR for user auditors; SOC 3 is a public, general-use summary of a SOC 2.
Question 371
A SOC 3 report is:
Select an option first.
Correct answer: C — A PUBLIC, GENERAL-USE summary of a SOC 2, with less detail
Explanation: SOC 3 covers the SAME Trust Services Criteria as a SOC 2, but is a GENERAL-USE report with LESS detail — no description of tests or results. It can be freely distributed and is often posted on a company's website as a marketing credential.
Question 372
A TYPE 1 SOC report covers:
Select an option first.
Correct answer: A — The DESIGN of controls at a POINT IN TIME
Explanation: TYPE 1: the DESIGN and implementation of controls at a POINT IN TIME — a snapshot. TYPE 2: DESIGN plus OPERATING EFFECTIVENESS over a PERIOD (typically 6–12 months). Only a TYPE 2 supports RELIANCE by a user auditor.
Question 373
A TYPE 2 SOC report covers:
Select an option first.
Correct answer: C — DESIGN and OPERATING EFFECTIVENESS over a PERIOD
Explanation: A TYPE 2 report tells you the controls were well designed AND that they ACTUALLY WORKED across a period (typically 6–12 months). A TYPE 1 tells you only that they were well designed on ONE DAY. A user auditor seeking to place reliance needs a TYPE 2.
Question 374
The Trust Services Criterion required in EVERY SOC 2 is:
Select an option first.
Correct answer: D — SECURITY (the 'common criteria')
Explanation: SECURITY is the ONLY MANDATORY criterion in a SOC 2 — it is called the COMMON CRITERIA. The service organisation SELECTS which of the other four (Availability, Processing Integrity, Confidentiality, Privacy) to include. A SOC 2 covering ONLY Security is entirely valid, so always check WHICH criteria a report actually covers.
Question 375
The five Trust Services Criteria are:
Select an option first.
Correct answer: D — Security, Availability, Processing Integrity, Confidentiality, Privacy
Explanation: The five TSC: SECURITY (mandatory); AVAILABILITY (the system is available per the SLA); PROCESSING INTEGRITY (processing is complete, valid, accurate, timely and authorised); CONFIDENTIALITY (confidential information is protected); PRIVACY (personal information is handled per the notice).
Question 376
The CARVE-OUT method for a subservice organisation means:
Select an option first.
Correct answer: B — The subservice organisation's controls are EXCLUDED from the report
Explanation: CARVE-OUT (the DEFAULT and most common): the subservice organisation's controls are EXCLUDED from the report. The user must obtain a SEPARATE SOC report on the subservice organisation. INCLUSIVE: the subservice controls ARE included, and the subservice organisation cooperates with the auditor.
Question 377
Under the CARVE-OUT method, the user entity must:
Select an option first.
Correct answer: D — OBTAIN a SEPARATE SOC report on the subservice organisation, or perform other procedures
Explanation: The carve-out leaves a HOLE in the user's assurance — and it is the USER'S job to fill it, typically by obtaining the subservice organisation's own SOC report. The carve-out SHIFTS the work to the user; it does not eliminate it. Candidates routinely miss this.
Question 378
A BRIDGE (gap) letter:
Select an option first.
Correct answer: A — Is management's UNAUDITED ASSERTION covering the gap between the SOC report period-end and the user's year-end
Explanation: A BRIDGE LETTER is issued by the SERVICE ORGANISATION'S MANAGEMENT, asserting that no material changes to controls and no significant incidents occurred between the SOC report's period-end and the user's current date. It is UNAUDITED, it is COMFORT rather than EVIDENCE, and it is NOT a substitute for a SOC report. Maximum gap: roughly six months.
Question 379
COMPLEMENTARY USER ENTITY CONTROLS (CUECs) are:
Select an option first.
Correct answer: A — Controls the SOC report ASSUMES are operating AT THE USER ENTITY
Explanation: CUECs are controls the SOC report ASSUMES are in place AT THE USER ENTITY. The service organisation's controls achieve their objectives ONLY IN COMBINATION with them. The user auditor must IDENTIFY them in the SOC report and TEST them at the user — a step routinely overlooked.
Question 380
The SERVICE auditor's opinion in a SOC 1 covers:
Select an option first.
Correct answer: A — The fairness of the DESCRIPTION of the system, the SUITABILITY OF DESIGN of controls, and (Type 2) their OPERATING EFFECTIVENESS
Explanation: The SERVICE auditor opines on: (1) whether management's DESCRIPTION of the system is fairly presented; (2) whether the controls were SUITABLY DESIGNED; and, for a TYPE 2, (3) whether they OPERATED EFFECTIVELY throughout the period. The service auditor expresses NO opinion on any user entity's financial statements.
Question 381
A SOC for CYBERSECURITY report is:
Select an option first.
Correct answer: C — A GENERAL-USE report on an entity's ENTERPRISE-WIDE cybersecurity risk management programme
Explanation: SOC for CYBERSECURITY is a GENERAL-USE report on an entity's ENTERPRISE-WIDE cybersecurity risk management programme — and it applies to ANY entity, not just service organisations. SOC 1 and SOC 2 examine controls at a SERVICE ORGANISATION relevant to its USER ENTITIES.
Question 382
A SOC for SUPPLY CHAIN report addresses:
Select an option first.
Correct answer: B — Controls within a PRODUCTION, MANUFACTURING or DISTRIBUTION system
Explanation: SOC for SUPPLY CHAIN reports on controls within an entity's PRODUCTION, MANUFACTURING or DISTRIBUTION system — providing assurance to customers and business partners about the supply chain. It is a distinct engagement from SOC 1, SOC 2 and SOC for Cybersecurity.
Question 383
The user auditor's PRIMARY reason for obtaining a SOC 1 report is to:
Select an option first.
Correct answer: B — Obtain evidence about CONTROLS AT THE SERVICE ORGANISATION that are relevant to the USER'S financial statement audit
Explanation: The user auditor obtains a SOC 1 to get evidence about controls at the SERVICE ORGANISATION that affect the USER'S financial statements. Outsourcing the PROCESS does not outsource the AUDIT — the auditor still needs evidence about those controls.
Question 384
A SOC 2 report's use is:
Select an option first.
Correct answer: B — RESTRICTED to management, specified user entities and other specified parties
Explanation: A SOC 2 is RESTRICTED — to management of the service organisation, user entities, and other specified parties who understand the system and the criteria. A SOC 3, by contrast, is GENERAL USE and freely distributable.
Question 385
The service organisation's MANAGEMENT is responsible for:
Select an option first.
Correct answer: C — Preparing the DESCRIPTION of the system and providing a WRITTEN ASSERTION
Explanation: MANAGEMENT of the service organisation prepares the DESCRIPTION of the system, provides a WRITTEN ASSERTION about the fairness of that description and the suitability of the controls' design (and operating effectiveness for a Type 2), and is responsible for the controls themselves. The SERVICE AUDITOR examines and opines.
Question 386
PROCESSING INTEGRITY (a Trust Services Criterion) means processing is:
Select an option first.
Correct answer: D — COMPLETE, VALID, ACCURATE, TIMELY and AUTHORISED
Explanation: PROCESSING INTEGRITY means system processing is COMPLETE, VALID, ACCURATE, TIMELY and AUTHORISED — that the system does what it is supposed to do, correctly. Note it does NOT mean the DATA itself is correct; it means the PROCESSING of that data is reliable.
Question 387
The CONFIDENTIALITY criterion differs from PRIVACY in that privacy concerns:
Select an option first.
Correct answer: D — PERSONAL INFORMATION specifically, and how it is collected, used, retained and disclosed per the entity's notice
Explanation: CONFIDENTIALITY protects information DESIGNATED as confidential (trade secrets, business plans, contracts) — of any type. PRIVACY concerns PERSONAL INFORMATION specifically, and whether it is collected, used, retained, disclosed and disposed of in accordance with the entity's PRIVACY NOTICE and applicable criteria.
Question 388
A qualified SOC opinion would be issued if:
Select an option first.
Correct answer: B — The DESCRIPTION is not fairly presented, controls are NOT suitably designed, or (Type 2) controls did NOT operate effectively
Explanation: A QUALIFIED (modified) SOC opinion arises where the DESCRIPTION is not fairly presented, the controls are NOT SUITABLY DESIGNED, or (for a Type 2) they did NOT OPERATE EFFECTIVELY. The basis for the modification must be described so users can assess its significance.
Question 389
A SOC 2 report's DESCRIPTION CRITERIA are set out in:
Select an option first.
Correct answer: C — The AICPA's DESCRIPTION CRITERIA (DC section 200) — a separate set from the TSC
Explanation: TWO separate sets of criteria apply to a SOC 2. The DESCRIPTION CRITERIA (DC 200) govern whether management's DESCRIPTION of the system is fairly presented. The TRUST SERVICES CRITERIA govern whether the CONTROLS are suitably designed and operating. The auditor opines against both.
Question 390
The period covered by a SOC 2 Type 2 report is typically:
Select an option first.
Correct answer: A — 6 to 12 months
Explanation: A TYPE 2 report covers a PERIOD — typically 6 to 12 months. A shorter period (a first-year engagement might cover 3 months) provides less evidence of sustained operating effectiveness, and a user auditor should consider whether it is sufficient.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.