You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 151
An entity's change management is effective for APPLICATION code but NOT for DATABASE changes made directly via SQL. The auditor should:
Select an option first.
Correct answer: B — Recognise that DIRECT DATABASE ACCESS BYPASSES the application entirely — including every automated application control
Explanation: DIRECT DATABASE ACCESS is a total bypass. Every input validation, edit check, three-way match and authorisation control lives in the APPLICATION — a direct SQL UPDATE goes straight around all of them. Controls over direct database access (restriction, logging, review of DBA activity) are as critical as application change management, and are far more often weak.
Question 152
A DBA has UPDATE access to production financial tables. The mitigating control should be:
Select an option first.
Correct answer: A — Independent MONITORING and REVIEW of DBA activity logs — the access may be operationally necessary, but it must be watched
Explanation: Some DBA access is operationally NECESSARY. The mitigating control is INDEPENDENT REVIEW of what they actually did: logging all direct database changes to a system the DBA CANNOT ALTER, and having someone OUTSIDE the DBA function review them. The log must be beyond the reach of the person it monitors.
Question 153
An entity's ETL loads 1,000,000 records; the warehouse contains 999,400. The 600-record gap:
Select an option first.
Correct answer: D — Must be INVESTIGATED — it may be legitimate (rejected duplicates) or a silent data loss corrupting every downstream report
Explanation: A 600-record gap has TWO possible explanations: LEGITIMATE rejection (duplicates, failed validation — which should appear on an EXCEPTION REPORT that someone reviews), or SILENT DATA LOSS. Until you know WHICH, every report built on that warehouse is suspect. Reconciliation without INVESTIGATION of the difference is not a control.
Question 154
An entity's data warehouse reconciliation is performed, but exceptions are never investigated. The control is:
Select an option first.
Correct answer: C — INEFFECTIVE — the reconciliation IDENTIFIES the difference but nothing RESOLVES it; the control's purpose is unfulfilled
Explanation: A reconciliation that identifies differences nobody investigates is a control that produces a number and changes nothing. The RESOLUTION of exceptions is what makes it a control. An auditor tests not merely that the reconciliation was PERFORMED, but that the differences were INVESTIGATED and CLEARED.
Question 155
An entity's automated control is effective and ITGCs are effective, but the control's OUTPUT (an exception report) is never reviewed. The control is:
Select an option first.
Correct answer: D — INCOMPLETE — the automated control DETECTS the exception, but detection without RESOLUTION achieves nothing
Explanation: The automated control does its job — it FLAGS the exception. But if nobody REVIEWS and RESOLVES the flagged items, the misstatement remains. The COMPLETE control is the automated detection PLUS the human review and resolution. Testing only the automated half proves only half the control.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 156
An entity's data lifecycle skips CLASSIFICATION at creation. The downstream consequences include:
Select an option first.
Correct answer: C — DLP cannot recognise sensitive data; access controls cannot be risk-based; retention cannot be applied; and destruction requirements are unknown
Explanation: CLASSIFICATION at CREATION is the foundation. Without it: DLP cannot recognise what to protect; ACCESS controls cannot be calibrated to sensitivity; RETENTION schedules cannot be applied; and DESTRUCTION requirements are unknown. Every subsequent stage of the lifecycle depends on a decision made at the first.
Question 157
The CIA triad comprises:
Select an option first.
Correct answer: A — Confidentiality, Integrity, Availability
Explanation: The CIA triad: CONFIDENTIALITY (only authorised parties see data — threat: theft); INTEGRITY (data accurate and unaltered — threat: malicious modification); AVAILABILITY (systems usable when needed — threat: denial of service). Map every control to a pillar.
Question 158
Information security risk is expressed as:
Select an option first.
Correct answer: C — THREAT × VULNERABILITY × IMPACT
Explanation: Risk = Threat × Vulnerability × Impact. Controls reduce VULNERABILITY or IMPACT — they cannot eliminate the THREAT (hackers exist regardless). What remains after controls is RESIDUAL risk, which the organisation must explicitly accept.
Question 159
Annual Loss Expectancy (ALE) equals:
Select an option first.
Correct answer: B — SLE × ARO (Single Loss Expectancy × Annualised Rate of Occurrence)
Explanation: ALE = SLE × ARO. SLE is the loss per incident; ARO is how often it is expected per year. A control is cost-effective only if its COST is LESS than the REDUCTION IN ALE it achieves.
Question 160
A control is cost-effective when:
Select an option first.
Correct answer: B — Its COST is LESS than the REDUCTION IN ALE it achieves
Explanation: A control is justified only if it costs LESS than the reduction in ALE it delivers. Spending $500,000 to prevent a $50,000 annual expected loss is itself a control failure — that economic judgement is exactly what the exam wants.
Question 161
SYMMETRIC encryption uses:
Select an option first.
Correct answer: D — The SAME key to encrypt and decrypt — fast, but with a key-distribution problem
Explanation: SYMMETRIC (AES, DES): the SAME key encrypts and decrypts. It is FAST, but suffers a KEY DISTRIBUTION problem — how do you securely share the key? ASYMMETRIC (RSA, ECC) uses a public/private PAIR, solving key exchange but running slower.
Question 162
ASYMMETRIC encryption:
Select an option first.
Correct answer: C — Uses a PUBLIC/PRIVATE key PAIR — slower, but solves key exchange and enables digital signatures
Explanation: ASYMMETRIC encryption uses a PUBLIC/PRIVATE key PAIR. It is SLOWER than symmetric but solves the key-exchange problem and enables DIGITAL SIGNATURES. In practice, TLS uses asymmetric crypto to exchange a SYMMETRIC key, then symmetric crypto for the traffic — the security of one and the speed of the other.
Question 163
HASHING is:
Select an option first.
Correct answer: C — A ONE-WAY, fixed-length transformation used for INTEGRITY and PASSWORD STORAGE
Explanation: HASHING (SHA-256) is ONE-WAY and produces a FIXED-LENGTH output. It CANNOT be reversed — which is precisely why passwords are stored HASHED, not encrypted. It is used for INTEGRITY verification and password storage. Hashing is NOT encryption.
Question 164
Multi-factor authentication requires:
Select an option first.
Correct answer: D — TWO OR MORE factors from DIFFERENT categories (know / have / are)
Explanation: The three factors: something you KNOW (password, PIN); something you HAVE (token, smartcard, push); something you ARE (biometric). MFA requires two or more from DIFFERENT categories. A password plus a security question is NOT MFA — both are 'something you know'.
Question 165
Under NIST SP 800-63B, forced periodic password rotation is:
Select an option first.
Correct answer: D — NOT recommended unless there is evidence of compromise
Explanation: NIST now recommends AGAINST forced rotation absent evidence of compromise — because it makes passwords WORSE (users respond with Password1!, Password2!, and sticky notes). NIST also recommends against composition rules, and recommends screening against breached-password lists and ALLOWING paste/password managers.
Question 166
Defence in depth means:
Select an option first.
Correct answer: A — LAYERED, OVERLAPPING controls — on the premise that every control will eventually fail
Explanation: DEFENCE IN DEPTH layers controls (perimeter, network, endpoint, application, data, identity, physical) on the premise that EVERY control will eventually FAIL. Layering means one failure is not fatal. A single perfect control is a worse design than several imperfect ones.
Question 167
A STATELESS firewall:
Select an option first.
Correct answer: B — Matches each PACKET against an ACL, with NO session memory
Explanation: STATELESS: matches each packet against an ACL independently — fast, but with NO session memory. STATEFUL: tracks connection state in a session table. WAF: inspects HTTP/HTTPS at the APPLICATION layer. NGFW: stateful + deep packet inspection + IDS/IPS + application/user awareness.
Question 168
A Web Application Firewall (WAF) is needed because a traditional firewall:
Select an option first.
Correct answer: C — CANNOT detect SQL injection or XSS — that traffic is legitimate HTTP on port 443
Explanation: A traditional firewall sees legitimate HTTP traffic on port 443 and passes it. SQL INJECTION and XSS are attacks embedded WITHIN that legitimate traffic. Only a WAF, which understands what the request is asking the APPLICATION to do, can detect them.
Question 169
The most common INITIAL attack vector is:
Select an option first.
Correct answer: D — PHISHING / social engineering — it targets HUMANS, not systems
Explanation: PHISHING is the most common initial vector, and NO technical control fully prevents it — the attack targets PEOPLE. That is why security awareness TRAINING is itself a control, and why an exam answer emphasising user awareness is often correct.
Question 170
Ransomware is a form of:
Select an option first.
Correct answer: C — MALWARE — it encrypts data and demands payment for the key
Explanation: RANSOMWARE is MALWARE that encrypts the victim's data and demands payment for the decryption key. The primary defence is TESTED, OFFLINE BACKUPS — an organisation that can restore does not need to pay. Backups that are online and writable can themselves be encrypted by the attacker.
Question 171
The NIST Cybersecurity Framework's five functions are:
Select an option first.
Correct answer: B — Identify, Protect, Detect, Respond, Recover
Explanation: IPDRR: IDENTIFY (asset management, risk assessment, governance); PROTECT (access control, training, data security); DETECT (anomalies, continuous monitoring); RESPOND (planning, communications, mitigation); RECOVER (recovery planning, improvements). It is OUTCOME-BASED and VOLUNTARY.
Question 172
The incident response phases (PICERL) begin with:
Select an option first.
Correct answer: B — PREPARATION
Explanation: PICERL: PREPARATION (the IR plan, tools, training) → IDENTIFICATION (detect/alert) → CONTAINMENT (isolate) → ERADICATION (remove the threat) → RECOVERY (restore and monitor) → LESSONS LEARNED. Note CONTAINMENT precedes ERADICATION — stop the bleeding before hunting the cause.
Question 173
In incident response, CONTAINMENT comes BEFORE eradication because:
Select an option first.
Correct answer: B — You must STOP THE SPREAD before hunting and removing the root cause
Explanation: CONTAINMENT (isolating affected systems, disabling accounts) limits the damage while investigation proceeds. ERADICATION (removing the malware, closing the vulnerability) comes next. Attempting eradication first, while the attacker is still moving laterally, allows the incident to spread.
Question 174
The IR phase most often SKIPPED is:
Select an option first.
Correct answer: D — LESSONS LEARNED — which is why the same incident recurs
Explanation: LESSONS LEARNED (the post-incident review) is routinely skipped once the crisis passes — which is precisely why the same incident recurs. The plan should be tested in advance through TABLETOP EXERCISES, before it is needed for real.
Question 175
Data Loss Prevention (DLP) depends fundamentally on:
Select an option first.
Correct answer: D — DATA CLASSIFICATION — DLP can only protect data it can RECOGNISE
Explanation: DLP can only protect data it can RECOGNISE — which requires CLASSIFICATION first. That is why the data lifecycle BEGINS with classification, not with tooling. DLP types: NETWORK (data in motion), ENDPOINT (USB, print, screenshots), and STORAGE/CLOUD (data at rest).
Question 176
GDPR requires breach notification within:
Select an option first.
Correct answer: D — 72 HOURS
Explanation: GDPR (EU): 72-HOUR breach notification to the supervisory authority; rights of access, deletion and portability; fines up to 4% of GLOBAL revenue. HIPAA (US health): breach notice within 60 days. CCPA (California): rights to know, delete, and opt out of sale.
Question 177
GDPR's maximum fine is:
Select an option first.
Correct answer: D — Up to 4% of GLOBAL annual revenue (or €20 million, whichever is higher)
Explanation: GDPR's tiered fines reach up to 4% of GLOBAL ANNUAL TURNOVER or €20 million, whichever is HIGHER. The extraterritorial reach — applying to anyone processing EU residents' data, wherever the company sits — combined with that fine level is what reshaped global privacy practice.
Question 178
HIPAA protects:
Select an option first.
Correct answer: D — PROTECTED HEALTH INFORMATION (PHI), through its Privacy and Security Rules
Explanation: HIPAA governs PROTECTED HEALTH INFORMATION (PHI) via the PRIVACY RULE (permitted uses and disclosures) and the SECURITY RULE (administrative, physical and technical safeguards for electronic PHI). Breach notification is required within 60 days.
Question 179
PCI DSS applies to organisations that:
Select an option first.
Correct answer: B — STORE, PROCESS or TRANSMIT CARDHOLDER (payment card) data
Explanation: PCI DSS (Payment Card Industry Data Security Standard) applies to any organisation that STORES, PROCESSES or TRANSMITS cardholder data. It is a CONTRACTUAL standard imposed by the card brands — not a law — but non-compliance can result in fines and loss of the ability to accept cards.
Question 180
Encryption AT REST and IN TRANSIT should be:
Select an option first.
Correct answer: C — BOTH deployed — they protect DIFFERENT moments in the data's life
Explanation: AT-REST encryption alone leaves data exposed DURING TRANSMISSION. IN-TRANSIT alone leaves it exposed ON THE DISK. They protect different moments and neither substitutes for the other. AT REST: full-disk (BitLocker), database-level (TDE). IN TRANSIT: TLS 1.2+, IPsec VPN.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.