You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 121
INFRASTRUCTURE AS CODE (IaC) improves control because:
Select an option first.
Correct answer: A — Infrastructure changes go through CODE REVIEW and VERSION CONTROL — the same change management as application code
Explanation: IaC (Terraform, CloudFormation) defines infrastructure in code, so changes are subject to VERSION CONTROL, PEER REVIEW and the CI/CD pipeline — the same change management as application code. It also makes configuration AUDITABLE and REPRODUCIBLE, replacing undocumented manual console changes.
Question 122
The audit risk with IaC is that:
Select an option first.
Correct answer: A — A single flawed TEMPLATE deploys the SAME misconfiguration EVERYWHERE, at scale and instantly
Explanation: IaC's strength is also its risk: a flawed template propagates the SAME misconfiguration across hundreds of resources instantly. The control is rigorous CODE REVIEW of templates plus AUTOMATED POLICY SCANNING (policy-as-code) BEFORE deployment — because after deployment, the mistake is everywhere.
Question 123
A CONTAINER (Docker) differs from a virtual machine in that a container:
Select an option first.
Correct answer: A — SHARES the host OS kernel — lighter and faster, but with a weaker isolation boundary
Explanation: A VM includes a FULL guest OS with strong hypervisor isolation. A CONTAINER SHARES the host kernel — far lighter and faster, but with a WEAKER isolation boundary. A kernel vulnerability can therefore potentially allow container ESCAPE, affecting other containers on the same host.
Question 124
A container IMAGE from a public registry presents the risk that:
Select an option first.
Correct answer: C — It may contain KNOWN VULNERABILITIES or MALICIOUS code — image scanning and trusted registries are the controls
Explanation: Public container images may contain outdated packages with known vulnerabilities, or deliberately malicious code. Controls: use TRUSTED/PRIVATE registries; SCAN images for vulnerabilities before deployment; use MINIMAL base images; and SIGN images to verify provenance.
Question 125
An API without AUTHENTICATION and RATE LIMITING risks:
Select an option first.
Correct answer: C — UNAUTHORISED data access and ENUMERATION/scraping of the entire dataset
Explanation: An unauthenticated API is an open door. Without RATE LIMITING, even an authenticated one can be used to ENUMERATE and scrape the entire dataset record by record. API controls: authentication, authorisation (per-object, not just per-endpoint), rate limiting, input validation, and logging.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 126
BROKEN OBJECT LEVEL AUTHORISATION (an API flaw) means:
Select an option first.
Correct answer: D — An authenticated user can access ANOTHER user's records by simply CHANGING THE ID in the request
Explanation: BOLA (the top API vulnerability) occurs when an API authenticates the USER but does not check whether that user is authorised for the specific OBJECT requested. Changing /account/1234 to /account/1235 returns someone else's data. Authorisation must be checked PER OBJECT, not merely per endpoint.
Question 127
A LOG RETENTION period that is too SHORT means:
Select an option first.
Correct answer: D — A breach detected LATE cannot be INVESTIGATED — the evidence has already been deleted
Explanation: With a dwell time often measured in months, logs retained for only 30 days mean that by the time you DETECT a breach, the evidence of how it started is GONE. Retention must exceed the realistic detection window. The tension is with cost and privacy — but too short is a genuine investigative failure.
Question 128
TIME SYNCHRONISATION (NTP) across systems matters because:
Select an option first.
Correct answer: A — Correlating events across systems during an investigation is IMPOSSIBLE if their clocks disagree
Explanation: Forensic investigation depends on building a TIMELINE across firewall, server, application and endpoint logs. If those systems' clocks disagree by minutes or hours, the timeline is meaningless and causation cannot be established. Consistent NTP synchronisation is an unglamorous but essential control.
Question 129
An entity's audit log records WHO but not WHAT WAS CHANGED. This is:
Select an option first.
Correct answer: C — INSUFFICIENT — accountability requires knowing what the change WAS, not merely that someone made one
Explanation: An audit log recording only 'User X modified Record Y at 10:03' is nearly useless for investigation. A useful log captures the BEFORE and AFTER values — what the data WAS and what it BECAME. Without that, you cannot determine whether the change was legitimate or assess the damage.
Question 130
A DATA RETENTION SCHEDULE specifies:
Select an option first.
Correct answer: A — HOW LONG each data category must be KEPT and WHEN it must be DESTROYED
Explanation: A RETENTION SCHEDULE balances competing obligations: legal and regulatory retention requirements, business need, and PRIVACY/minimisation obligations to DELETE. Keeping everything forever is both a privacy violation and an enlarged breach exposure; deleting too early can be a legal violation.
Question 131
A LEGAL HOLD requires the organisation to:
Select an option first.
Correct answer: D — SUSPEND routine DELETION of data relevant to anticipated or ongoing litigation
Explanation: A LEGAL HOLD SUSPENDS the routine retention schedule for data relevant to litigation. Destroying data subject to a hold — even through an automated, routine process — is SPOLIATION, and carries severe legal consequences. Systems must be capable of suspending automated deletion for specified data.
Question 132
An automated deletion routine destroys records subject to a LEGAL HOLD. This is:
Select an option first.
Correct answer: C — SPOLIATION — the routine nature of the deletion is NOT a defence, and the consequences can be severe
Explanation: Destroying evidence subject to a legal hold is SPOLIATION, and 'the system did it automatically' is NOT a defence — the organisation was obliged to suspend the routine. Courts have imposed adverse inference instructions and sanctions for exactly this. Retention systems must support holds.
Question 133
The audit trail requirement that most often FAILS in practice is:
Select an option first.
Correct answer: C — LOG REVIEW — logs are generated diligently and reviewed by nobody
Explanation: Organisations generate enormous volumes of logs and REVIEW almost none of them. The GENERATION is not the control — the REVIEW is. An auditor should ask who reviews the logs, how often, what they look for, and what happened the last time something was found.
Question 134
Nightly backups mean a worst-case RPO of:
Select an option first.
Correct answer: A — 24 hours
Explanation: A failure occurring just BEFORE the next nightly backup loses up to 24 HOURS of data. Backup FREQUENCY determines the RPO. If the business needs a 4-hour RPO, backups must run at least every 4 hours.
Question 135
Hourly snapshots provide a worst-case RPO of:
Select an option first.
Correct answer: C — 1 hour
Explanation: Hourly snapshots mean at most ONE HOUR of data is lost. To achieve a 15-minute RPO you would need snapshots every 15 minutes (or continuous replication).
Question 136
A business has an MTD of 48 hours. An RTO of 72 hours is:
Select an option first.
Correct answer: B — UNACCEPTABLE — the RTO EXCEEDS the MTD, so recovery arrives AFTER the business has suffered unacceptable damage
Explanation: The constraint is RTO ≤ MTD. An RTO of 72 hours against an MTD of 48 hours means that even if the recovery plan executes PERFECTLY, it arrives 24 hours too late. The RTO must be reduced (better DR infrastructure) or the MTD reassessed.
Question 137
A control operates MONTHLY. A reasonable test sample size is approximately:
Select an option first.
Correct answer: D — 2-5 of the 12 occurrences
Explanation: Sample size scales with FREQUENCY. A MONTHLY control has a population of only 12, so a sample of 2-5 is typical (higher where reliance is greater). A DAILY control (hundreds of occurrences) would need 20-40.
Question 138
A control operates ANNUALLY. The test sample is:
Select an option first.
Correct answer: B — 1 — you cannot sample more instances than exist
Explanation: An ANNUAL control has a population of ONE. The auditor tests that SINGLE occurrence — thoroughly. Applying a standard sample size of 25 to a population of 1 is a category error.
Question 139
An AUTOMATED control with effective ITGCs may be tested with a sample of:
Select an option first.
Correct answer: B — 1 — a program executes IDENTICALLY every time, so one instance can support the conclusion
Explanation: Once the LOGIC is verified and ITGCs confirm it did NOT CHANGE, a SINGLE instance may suffice — a program does the same thing every time. This is the key efficiency benefit of automation, and it is available ONLY if the ITGCs are effective.
Question 140
A SOC report covers 1 Jan–30 Sep. The user's year-end is 31 Dec. The GAP is:
Select an option first.
Correct answer: D — 3 MONTHS (1 Oct–31 Dec)
Explanation: The GAP is 1 October to 31 December = 3 MONTHS. A bridge letter provides limited (unaudited) comfort; the auditor may also need additional procedures depending on the risk.
Question 141
A SOC report covers 1 Apr–31 Mar. The user's year-end is 31 Dec. The uncovered portion of the user's year is:
Select an option first.
Correct answer: D — The period 1 Jan–31 Mar of the user's year is covered by the PRIOR report; the current report covers 1 Apr–31 Dec — so there is NO gap if BOTH reports are obtained
Explanation: The SOC period 1 Apr–31 Mar covers 1 Apr–31 Dec of the user's calendar year. The remaining 1 Jan–31 Mar falls in the PRIOR SOC report's period. Obtaining BOTH reports covers the full year — a common arrangement where periods do not align.
Question 142
An entity's change log shows 60 production deployments; the change management system records 48. The unexplained difference is:
Select an option first.
Correct answer: B — 12 deployments that BYPASSED the change management process — each must be investigated
Explanation: 60 − 48 = 12 deployments with NO corresponding change ticket. Each represents a bypass of the control and must be investigated: was it an emergency change (with retrospective approval), a mislabelled ticket, or an unauthorised change?
Question 143
An entity has 1,200 user accounts; 85 belong to terminated employees. The exposure rate is:
Select an option first.
Correct answer: D — About 7.1% of accounts are orphaned — a significant de-provisioning failure
Explanation: 85/1,200 = 7.1% of accounts belong to people who no longer work there. Each is a credential a disgruntled former employee (or an attacker who obtained it) could use. Prompt, ideally automated, de-provisioning from the HR system is the control.
Question 144
A DR test restores systems in 30 hours against an RTO of 24 hours. The result is:
Select an option first.
Correct answer: B — A FAILURE — the tested recovery EXCEEDED the RTO, so the plan does not meet the business requirement
Explanation: The DR test is a FAILURE against the stated RTO: 30 hours > 24 hours. The value of testing is precisely to discover this BEFORE a real disaster. The response: improve the recovery process, invest in faster infrastructure, or revisit whether the 24-hour RTO is realistic.
Question 145
An entity's data centre has 99.5% availability. Annual downtime is approximately:
Select an option first.
Correct answer: B — 43.8 hours
Explanation: Downtime = (1 − 0.995) × 8,760 = 0.005 × 8,760 = 43.8 hours per year (about 1.8 days).
Question 146
An automated 3-way match tested effectively with a sample of 1. ITGCs are effective EXCEPT for change management. The auditor should:
Select an option first.
Correct answer: D — REJECT the efficiency — without effective CHANGE MANAGEMENT, the single test cannot be extrapolated across the period, and the sample must be expanded or substantive procedures performed
Explanation: The sample-of-1 efficiency for automated controls is available ONLY when ITGCs — especially CHANGE MANAGEMENT — are effective. Without them, the auditor has no assurance the program tested is the program that ran all year. The efficiency evaporates, and either the sample must be expanded across the period or substantive procedures must be performed.
Question 147
An entity has effective ACCESS and OPERATIONS ITGCs but ineffective CHANGE MANAGEMENT. Automated application controls:
Select an option first.
Correct answer: A — CANNOT be relied upon — change management is the ITGC domain that specifically supports EXTRAPOLATION of an automated control test across time
Explanation: The ITGC domains are not interchangeable. ACCESS controls stop the WRONG PEOPLE getting in. CHANGE MANAGEMENT is what assures you the PROGRAM LOGIC DID NOT CHANGE — and that is the specific assurance needed to extrapolate a point-in-time automated control test across the period. Effective access controls do not substitute for it.
Question 148
A user entity's SOC 1 shows effective controls, but the user does NOT perform 4 of the 9 CUECs. The user auditor should conclude:
Select an option first.
Correct answer: B — The corresponding control chains are BROKEN AT THE USER — the SOC report's assurance does not carry through, and the auditor must respond
Explanation: The SOC report is CORRECT: the service organisation's controls worked. But four of them DEPEND on user actions that are NOT HAPPENING. The chain is broken at the USER'S end. The user auditor must identify which financial statement assertions are affected and respond — the unqualified SOC opinion is no comfort at all here.
Question 149
An entity's DR test succeeds, but the test restored only the APPLICATION — not the AUTHENTICATION service it depends on. The test:
Select an option first.
Correct answer: C — FAILED in substance — in a real disaster, a restored application no one can log into is useless
Explanation: A DR test that restores the application but not its DEPENDENCIES (authentication, DNS, network, database, licence servers) has proven nothing. In a real event, users cannot log in. DR testing must exercise the FULL DEPENDENCY CHAIN — which is precisely what a CMDB (mapping asset relationships) exists to reveal.
Question 150
A DR site is fully equipped, but the RESTORE has never been tested and the backups have never been verified. The organisation has:
Select an option first.
Correct answer: C — EXPENSIVE INFRASTRUCTURE and NO PROVEN RECOVERY CAPABILITY — the two are not the same thing
Explanation: A hot site is not a recovery CAPABILITY — it is a recovery FACILITY. Without TESTED backups and a TESTED restore, the organisation has bought expensive infrastructure and proven nothing. The restore is the control; the site is merely where you run it.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.