You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 181
A Public Key Infrastructure's weakest link is often:
Select an option first.
Correct answer: A — REVOCATION — a compromised certificate is only harmless if clients actually CHECK the revocation list
Explanation: REVOCATION is the practical weak link. A certificate can be revoked (via CRL or OCSP), but that only helps if CLIENTS ACTUALLY CHECK — and many do not, or fail open when the check times out. That gap between DESIGN and PRACTICE is a favourite exam theme.
Question 182
The principle of LEAST PRIVILEGE means:
Select an option first.
Correct answer: B — Users receive ONLY the MINIMUM access necessary to perform their job
Explanation: LEAST PRIVILEGE grants users only the MINIMUM access needed for their role — limiting the damage from both accidents and compromised accounts. It pairs with NEED TO KNOW (restricting data access) and SEGREGATION OF DUTIES (splitting incompatible functions).
Question 183
Segregation of duties separates:
Select an option first.
Correct answer: B — AUTHORISATION, RECORDING and CUSTODY of assets
Explanation: The three incompatible functions: AUTHORISATION (approving a transaction), RECORDING (entering it in the books), and CUSTODY of the related assets. Anyone holding TWO of the three can both PERPETRATE and CONCEAL a misappropriation.
Question 184
A ZERO TRUST architecture assumes:
Select an option first.
Correct answer: C — NO implicit trust — every request is verified regardless of network location
Explanation: ZERO TRUST rejects the old 'castle and moat' model, which trusted anything inside the perimeter. It assumes BREACH and verifies EVERY request explicitly — regardless of whether it originates inside or outside the network. 'Never trust, always verify.'
Question 185
A honeypot is:
Select an option first.
Correct answer: C — A DECOY system designed to attract and study attackers
Explanation: A HONEYPOT is a decoy system, deliberately made attractive to attackers, used to DETECT intrusions, STUDY attacker techniques, and DIVERT attention from real assets. Any traffic to a honeypot is inherently suspicious — since no legitimate user has any reason to go there.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 186
Vulnerability scanning differs from penetration testing in that a pen test:
Select an option first.
Correct answer: C — Actively EXPLOITS vulnerabilities to demonstrate real-world impact
Explanation: A VULNERABILITY SCAN identifies and lists known weaknesses (largely automated). A PENETRATION TEST goes further — actively EXPLOITING them to demonstrate what an attacker could ACTUALLY achieve, including chaining several minor weaknesses into a serious compromise. Both require formal authorisation.
Question 187
A DDoS attack targets:
Select an option first.
Correct answer: D — AVAILABILITY — overwhelming a system so legitimate users cannot access it
Explanation: A DISTRIBUTED DENIAL OF SERVICE attack floods a system with traffic from many sources, exhausting its capacity so LEGITIMATE users cannot access it. It attacks AVAILABILITY. It steals nothing and alters nothing — which is why mapping attacks to CIA pillars clarifies the response.
Question 188
SQL INJECTION exploits:
Select an option first.
Correct answer: C — Inadequate INPUT VALIDATION — malicious SQL is submitted through an input field
Explanation: SQL INJECTION submits malicious SQL through an application input field, which the application then passes to the database. The defence is INPUT VALIDATION and PARAMETERISED QUERIES. A network firewall cannot stop it — the traffic is legitimate HTTP.
Question 189
Cross-site scripting (XSS) involves:
Select an option first.
Correct answer: D — Injecting malicious SCRIPT into a web page, which then executes in another user's browser
Explanation: XSS injects malicious SCRIPT into a web page, which then EXECUTES IN ANOTHER USER'S BROWSER — stealing session cookies, capturing keystrokes, or redirecting the user. Like SQL injection, the defence is INPUT VALIDATION and OUTPUT ENCODING.
Question 190
A MAN-IN-THE-MIDDLE attack:
Select an option first.
Correct answer: B — INTERCEPTS communication between two parties who believe they are talking directly
Explanation: A MITM attack intercepts (and possibly alters) communication between two parties who believe they are communicating directly. The defence is strong ENCRYPTION IN TRANSIT (TLS) with proper CERTIFICATE VALIDATION — which is why ignoring browser certificate warnings is dangerous.
Question 191
PRIVILEGE ESCALATION means an attacker:
Select an option first.
Correct answer: A — Gains HIGHER-LEVEL access than originally obtained
Explanation: PRIVILEGE ESCALATION: having gained a foothold with limited access, the attacker exploits a weakness to obtain HIGHER privileges (administrator, root). It is why LEAST PRIVILEGE matters — and why privileged accounts require additional controls (MFA, session recording, just-in-time elevation).
Question 192
An INSIDER THREAT is dangerous because the insider:
Select an option first.
Correct answer: D — Already has AUTHORISED ACCESS and knowledge of where valuable data resides
Explanation: An INSIDER already has AUTHORISED ACCESS and knows where the valuable data is and how the controls work. Perimeter defences are useless against them. The controls that DO work: least privilege, segregation of duties, monitoring/UEBA, and prompt de-provisioning on termination.
Question 193
Prompt de-provisioning of TERMINATED employees' access is critical because:
Select an option first.
Correct answer: C — A retained credential gives a disgruntled former employee continued access to systems
Explanation: A terminated employee whose credentials remain ACTIVE retains the ability to access, exfiltrate or destroy data — with a possible motive. De-provisioning should be IMMEDIATE (ideally automated from the HR system) and covered by a periodic ACCESS RECERTIFICATION review.
Question 194
A USER ACCESS REVIEW (recertification) is a:
Select an option first.
Correct answer: C — DETECTIVE control — it periodically identifies inappropriate or excess access
Explanation: An ACCESS REVIEW is DETECTIVE: managers periodically confirm that each user's access remains appropriate. It catches ACCESS CREEP (privileges accumulated across role changes and never removed) and missed de-provisioning. It does not PREVENT inappropriate access being granted in the first place.
Question 195
ACCESS CREEP occurs when:
Select an option first.
Correct answer: B — A user CHANGES ROLES and accumulates new access without the OLD access being removed
Explanation: ACCESS CREEP: as employees move between roles, they GAIN new privileges but the OLD ones are never REVOKED. Over years, a long-serving employee accumulates access far exceeding any legitimate need — often enough to breach segregation of duties without anyone noticing.
Question 196
Role-Based Access Control (RBAC) grants access based on:
Select an option first.
Correct answer: A — The user's ROLE — simplifying administration and supporting least privilege
Explanation: RBAC assigns permissions to ROLES, and users to roles. It simplifies administration (change the role, not 500 users), supports LEAST PRIVILEGE, and makes access reviews tractable. Its weakness: poorly designed roles that are too broad simply institutionalise excess access.
Question 197
PATCH MANAGEMENT is important because:
Select an option first.
Correct answer: D — UNPATCHED known vulnerabilities are among the most common causes of breaches
Explanation: Most successful breaches exploit KNOWN vulnerabilities for which a PATCH ALREADY EXISTED. Timely patching is one of the highest-value security controls. The tension is with AVAILABILITY — patches must be tested, but delay leaves the window open.
Question 198
A ZERO-DAY vulnerability is one that:
Select an option first.
Correct answer: A — Is UNKNOWN to the vendor — no patch exists yet
Explanation: A ZERO-DAY is a vulnerability UNKNOWN to the vendor, so NO PATCH exists. Patching cannot defend against it. Defence relies on DEFENCE IN DEPTH — network segmentation, endpoint detection, least privilege — so that exploitation of one flaw does not become total compromise.
Question 199
NETWORK SEGMENTATION limits:
Select an option first.
Correct answer: C — LATERAL MOVEMENT — an attacker who compromises one segment cannot easily reach others
Explanation: SEGMENTATION divides the network into zones (VLANs, subnets, microsegments). Its security value is limiting LATERAL MOVEMENT: an attacker who compromises a workstation in the marketing segment cannot easily reach the finance database. It contains the blast radius.
Question 200
An IDS differs from an IPS in that an IPS:
Select an option first.
Correct answer: A — ACTIVELY BLOCKS detected threats, whereas an IDS only DETECTS and ALERTS
Explanation: An INTRUSION DETECTION SYSTEM (IDS) DETECTS and ALERTS — passive. An INTRUSION PREVENTION SYSTEM (IPS) sits INLINE and ACTIVELY BLOCKS. The trade-off: an IPS false positive BLOCKS LEGITIMATE TRAFFIC, which is why some organisations run in detect-only mode.
Question 201
A VPN provides:
Select an option first.
Correct answer: A — An ENCRYPTED TUNNEL over an untrusted network, protecting data IN TRANSIT
Explanation: A VIRTUAL PRIVATE NETWORK creates an ENCRYPTED TUNNEL across an untrusted network (the internet), protecting data IN TRANSIT and authenticating the endpoint. It protects the CHANNEL — it does NOT protect a compromised endpoint at either end.
Question 202
Security AWARENESS TRAINING is a control because:
Select an option first.
Correct answer: A — PHISHING targets PEOPLE, and no technical control fully prevents it
Explanation: PHISHING and social engineering target HUMANS, and no technical control fully stops them. TRAINING (with simulated phishing exercises) is therefore a genuine control. When an exam scenario involves a user clicking a malicious link, an answer emphasising awareness training is often correct.
Question 203
The PRIVACY principle of DATA MINIMISATION means:
Select an option first.
Correct answer: D — Collecting ONLY the personal data NECESSARY for the stated purpose
Explanation: DATA MINIMISATION: collect only what is NECESSARY for the stated purpose, keep it only as long as needed, and use it only for that purpose. It is a core GDPR principle. The security corollary: data you never collected cannot be breached.
Question 204
The GDPR 'right to erasure' is also known as:
Select an option first.
Correct answer: D — The RIGHT TO BE FORGOTTEN
Explanation: The RIGHT TO ERASURE ('right to be forgotten') allows a data subject to require deletion of their personal data in specified circumstances. Other GDPR rights: ACCESS, RECTIFICATION, PORTABILITY, RESTRICTION, and OBJECTION (including to automated decision-making).
Question 205
PSEUDONYMISATION differs from ANONYMISATION in that pseudonymised data:
Select an option first.
Correct answer: D — CAN be re-identified using additional information held separately — so it remains PERSONAL DATA
Explanation: PSEUDONYMISED data CAN be re-identified using a separately-held key — so under GDPR it REMAINS PERSONAL DATA and stays in scope. ANONYMISED data cannot be re-identified by any reasonable means, and therefore falls OUTSIDE GDPR entirely. The distinction has enormous compliance consequences.
Question 206
A DATA PROCESSOR under GDPR:
Select an option first.
Correct answer: A — Processes personal data ON BEHALF OF a controller, following the controller's instructions
Explanation: The DATA CONTROLLER determines the PURPOSES and MEANS of processing. The DATA PROCESSOR processes ON BEHALF OF the controller, following instructions. A cloud provider is typically a PROCESSOR. Both have obligations, but the controller bears primary accountability.
Question 207
A Data Protection Impact Assessment (DPIA) is required when processing:
Select an option first.
Correct answer: B — Is likely to result in a HIGH RISK to individuals' rights and freedoms
Explanation: A DPIA is required under GDPR where processing is likely to result in a HIGH RISK to individuals — large-scale processing of special categories, systematic monitoring of public areas, or automated decision-making with legal effects. It must be conducted BEFORE the processing begins.
Question 208
Risk = Threat × Vulnerability × Impact. A control that ENCRYPTS data reduces:
Select an option first.
Correct answer: D — The IMPACT — the stolen data is unusable
Explanation: You cannot eliminate the THREAT (attackers exist regardless). ENCRYPTION does not stop the data being STOLEN — it makes the stolen data USELESS, reducing the IMPACT. PATCHING, by contrast, reduces the VULNERABILITY. Identifying which term a control affects is the analytical skill being tested.
Question 209
PATCHING a known vulnerability reduces:
Select an option first.
Correct answer: A — The VULNERABILITY
Explanation: PATCHING closes the specific weakness, reducing the VULNERABILITY term. It does not reduce the THREAT (attackers still exist) or the IMPACT (if breached by another means, the damage is the same). What remains after all controls is RESIDUAL RISK, which must be explicitly ACCEPTED by management.
Question 210
RESIDUAL RISK is:
Select an option first.
Correct answer: D — What REMAINS after controls — and it must be explicitly ACCEPTED by management
Explanation: INHERENT risk is the risk before controls. RESIDUAL risk is what REMAINS after them. It can never be zero, and management must explicitly ACCEPT it (or transfer it via insurance, or avoid the activity). An organisation that believes its residual risk is zero has not understood the exercise.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.