You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 211
The four risk RESPONSES are:
Select an option first.
Correct answer: C — Accept, Avoid, Mitigate, Transfer
Explanation: The four responses: ACCEPT (live with it); AVOID (stop the activity); MITIGATE/REDUCE (implement controls); TRANSFER (insurance, contractual indemnity, outsourcing). Note that TRANSFER via insurance moves the FINANCIAL loss but NOT the reputational damage or the regulatory obligation.
Question 212
Cyber INSURANCE transfers:
Select an option first.
Correct answer: C — The FINANCIAL loss — but NOT the reputational damage or the regulatory obligation
Explanation: Cyber insurance transfers FINANCIAL loss. It does NOT transfer REPUTATIONAL damage, the REGULATORY obligation (a fine is often uninsurable), or the ACCOUNTABILITY to customers. Treating insurance as a substitute for controls is a category error the exam likes to expose.
Question 213
A control costing $200,000 annually reduces ALE from $500,000 to $450,000. The control is:
Select an option first.
Correct answer: D — NOT cost-effective — it costs $200,000 to save $50,000
Explanation: ALE reduction = $500,000 − $450,000 = $50,000. The control costs $200,000. Spending $200,000 to save $50,000 DESTROYS $150,000 of value annually. A control must cost LESS than the ALE reduction it achieves — and an auditor should say so.
Question 214
An organisation with a $2m ALE implements a $300,000 control reducing ALE to $800,000. The control is:
Select an option first.
Correct answer: C — JUSTIFIED — it costs $300,000 to save $1.2m in expected annual loss
Explanation: ALE reduction = $2,000,000 − $800,000 = $1,200,000. Cost = $300,000. NET BENEFIT = $900,000 per year. Comfortably justified. Note the remaining $800,000 of ALE is RESIDUAL RISK that management must explicitly accept.
Question 215
An MFA implementation is defeated because both factors are 'something you KNOW'. The lesson is:
Select an option first.
Correct answer: B — The factors must come from DIFFERENT CATEGORIES — a password plus a security question is NOT multi-factor
Explanation: MFA requires factors from DIFFERENT categories (KNOW / HAVE / ARE). A password plus a security question are BOTH 'something you know' — an attacker who phishes one can usually phish or research the other. Two factors from the SAME category add almost no protection.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 216
SMS-based MFA is considered WEAKER than an authenticator app because:
Select an option first.
Correct answer: A — SMS is vulnerable to SIM-SWAPPING and interception
Explanation: SMS-based one-time codes are vulnerable to SIM SWAPPING (an attacker socially engineers the carrier into porting the victim's number) and to interception. NIST has deprecated SMS as a restricted authenticator. An AUTHENTICATOR APP or a HARDWARE TOKEN (FIDO2) is materially stronger.
Question 217
A PHISHING-RESISTANT authentication factor is:
Select an option first.
Correct answer: A — A HARDWARE SECURITY KEY (FIDO2/WebAuthn) — it cryptographically binds to the legitimate domain
Explanation: A FIDO2 HARDWARE KEY is PHISHING-RESISTANT because it cryptographically binds the credential to the LEGITIMATE DOMAIN. Even if a user is tricked into visiting a lookalike site, the key simply will not authenticate. One-time codes (SMS, TOTP) CAN be phished in real time by a relay attack.
Question 218
An organisation stores passwords using ENCRYPTION rather than HASHING. This is:
Select an option first.
Correct answer: B — A WEAKNESS — encryption is REVERSIBLE, so anyone with the key can recover every password in plaintext
Explanation: Passwords should be HASHED (with a SALT, using a slow algorithm such as bcrypt or Argon2), NOT encrypted. ENCRYPTION is REVERSIBLE — an attacker who obtains the key recovers EVERY password in plaintext. Hashing is one-way, so even a full database breach does not directly reveal the passwords.
Question 219
A SALT added to a password hash prevents:
Select an option first.
Correct answer: D — RAINBOW TABLE attacks — precomputed hash lookups, and it ensures identical passwords hash differently
Explanation: A SALT is a unique random value added to each password before hashing. It defeats RAINBOW TABLES (precomputed hash-to-password lookups) and ensures that two users with the SAME password produce DIFFERENT hashes — so cracking one does not crack the other.
Question 220
A LEAST PRIVILEGE violation is:
Select an option first.
Correct answer: B — An accounts payable clerk with the ability to CREATE VENDORS and APPROVE PAYMENTS
Explanation: A clerk who can BOTH create a vendor AND approve payments to it can invent a fictitious vendor and pay it — the SHELL VENDOR fraud. This violates BOTH least privilege AND segregation of duties. Vendor master maintenance must be segregated from payment approval.
Question 221
A PRIVILEGED ACCESS MANAGEMENT (PAM) solution provides:
Select an option first.
Correct answer: D — VAULTING of privileged credentials, JUST-IN-TIME elevation, and SESSION RECORDING
Explanation: PAM addresses the highest-risk accounts (administrator, root, service accounts): VAULTING credentials so they are never known to users; granting JUST-IN-TIME, time-limited elevation rather than standing privilege; and RECORDING privileged sessions for accountability.
Question 222
A SERVICE ACCOUNT (used by an application) presents a control risk because it:
Select an option first.
Correct answer: C — Often has HIGH privileges, a NON-EXPIRING password, and NO individual accountability
Explanation: SERVICE ACCOUNTS typically have BROAD privileges, passwords that NEVER EXPIRE (because rotating them breaks the application), and NO individual accountability (many people know the credentials). They are a favourite attacker target. Controls: vaulting, restricting interactive login, and monitoring their use.
Question 223
A company detects an intrusion 200 days after it began. This 'DWELL TIME' indicates:
Select an option first.
Correct answer: C — A failure of the DETECT function — the attacker had 200 days to move laterally and exfiltrate data
Explanation: DWELL TIME (from compromise to detection) is a key security metric. A long dwell time means the attacker had months to escalate privileges, move laterally, identify valuable data and exfiltrate it. It indicates a failure of the DETECT function — most organisations over-invest in PROTECT and under-invest in DETECT and RESPOND.
Question 224
Most organisations' security investment is:
Select an option first.
Correct answer: D — Skewed toward PROTECT, and UNDER-invested in DETECT and RESPOND — which is why breaches go undiscovered for months
Explanation: The classic imbalance: heavy spend on PROTECT (firewalls, antivirus, access controls), light spend on DETECT (monitoring, SIEM, threat hunting) and RESPOND (IR capability, tabletop exercises). Since prevention will eventually fail, an organisation that cannot DETECT is one that will discover its breach from a journalist.
Question 225
A TABLETOP EXERCISE is used to:
Select an option first.
Correct answer: B — TEST the incident response plan in a discussion-based simulation, before a real incident
Explanation: A TABLETOP EXERCISE walks the response team through a simulated incident in a discussion format — testing whether the plan actually works, whether people know their roles, and where the gaps are. Discovering that the IR plan's contact list is three years out of date is far better done in a tabletop than in a real breach.
Question 226
Under GDPR, a data breach must be notified to the SUPERVISORY AUTHORITY within 72 hours of:
Select an option first.
Correct answer: B — BECOMING AWARE of it
Explanation: The 72-hour clock starts when the controller BECOMES AWARE of the breach — not when it occurred, and not when the investigation is complete. Notification may be made in PHASES if full information is not yet available. Affected INDIVIDUALS must also be notified without undue delay if the risk to them is high.
Question 227
A vendor RISK ASSESSMENT should be performed:
Select an option first.
Correct answer: A — BEFORE onboarding, and PERIODICALLY thereafter — proportionate to the risk the vendor poses
Explanation: THIRD-PARTY RISK MANAGEMENT requires due diligence BEFORE onboarding (SOC reports, security questionnaires, penetration test results) and ONGOING monitoring thereafter — with the depth PROPORTIONATE to the risk. A vendor with access to customer data warrants far more scrutiny than the office cleaner.
Question 228
A SUPPLY CHAIN attack compromises an organisation by:
Select an option first.
Correct answer: D — Compromising a TRUSTED VENDOR or SOFTWARE UPDATE, which the target then installs voluntarily
Explanation: A SUPPLY CHAIN attack compromises a trusted supplier — a software vendor, an update mechanism, a managed service provider — so the target installs the malicious code VOLUNTARILY, through a channel it trusts. It bypasses perimeter defences entirely, and is extremely difficult to detect.
Question 229
An organisation accepts a residual risk of $400,000 ALE. This decision should be:
Select an option first.
Correct answer: B — Made and DOCUMENTED by MANAGEMENT at an appropriate level — risk acceptance is a business decision, not a technical one
Explanation: RISK ACCEPTANCE is a BUSINESS decision, and it must be made at an appropriate MANAGEMENT level and DOCUMENTED. IT can quantify the risk and propose controls, but it cannot decide the organisation's appetite. An undocumented, IT-level acceptance of a material risk is itself a governance failure.
Question 230
An SLE of $250,000 with an ARO of 0.2 produces an ALE of:
Select an option first.
Correct answer: A — $50,000
Explanation: ALE = SLE × ARO = $250,000 × 0.2 = $50,000. An ARO of 0.2 means the event is expected once every FIVE YEARS. A control costing more than $50,000 per year to eliminate this risk would NOT be cost-effective.
Question 231
An event expected ONCE EVERY 10 YEARS has an ARO of:
Select an option first.
Correct answer: D — 0.1
Explanation: ARO (Annualised Rate of Occurrence) = 1/10 = 0.1. If the SLE were $1,000,000, the ALE would be $1,000,000 × 0.1 = $100,000 — the amount you should be willing to spend annually to eliminate it.
Question 232
A vulnerability with NO known exploit and NO sensitive data at risk should be:
Select an option first.
Correct answer: C — PRIORITISED LOWER — risk-based patching allocates scarce resources to the highest-impact vulnerabilities first
Explanation: Not all vulnerabilities are equal. RISK-BASED patching prioritises by EXPLOITABILITY (is it being exploited in the wild?), EXPOSURE (is the system internet-facing?), and IMPACT (what data is at risk?). Treating every CVE as equally urgent guarantees the genuinely critical ones are delayed.
Question 233
A CRITICAL, internet-facing vulnerability being ACTIVELY EXPLOITED should be:
Select an option first.
Correct answer: A — PATCHED IMMEDIATELY, via the emergency change process
Explanation: An ACTIVELY EXPLOITED, INTERNET-FACING, CRITICAL vulnerability is the highest priority there is. It warrants the EMERGENCY change process — and the emergency path must itself be controlled (logged, retrospectively approved, reviewed). This is precisely why an emergency process must exist.
Question 234
A firewall rule permitting ANY source to ANY destination on ANY port is:
Select an option first.
Correct answer: D — A CATASTROPHIC control failure — it defeats the firewall's entire purpose
Explanation: An ANY-ANY-ANY rule means the firewall permits everything — it is a firewall in name only. Such rules are often added temporarily during troubleshooting and NEVER REMOVED. FIREWALL RULE REVIEW (identifying overly permissive, redundant and stale rules) is a standard and high-value audit procedure.
Question 235
A FIREWALL RULE REVIEW would look for:
Select an option first.
Correct answer: A — OVERLY PERMISSIVE rules, STALE rules for decommissioned systems, and rules with no business justification
Explanation: A rule review identifies: OVERLY PERMISSIVE rules (any-any); STALE rules for systems long decommissioned; REDUNDANT and SHADOWED rules; and rules with NO documented business justification or owner. Firewall rulesets accrete over years and are rarely pruned.
Question 236
An employee emails a spreadsheet of customer data to their personal account. The control that should have prevented this is:
Select an option first.
Correct answer: B — ENDPOINT or NETWORK DLP — detecting and blocking the exfiltration of classified data
Explanation: DATA LOSS PREVENTION (network DLP inspecting outbound email, or endpoint DLP) is the control designed for exactly this. Its effectiveness depends on the data having been CLASSIFIED — DLP can only protect what it can RECOGNISE.
Question 237
An employee copies data to a USB drive. The relevant control is:
Select an option first.
Correct answer: B — ENDPOINT DLP or USB port control on the device
Explanation: Data leaving via a USB port never touches the network, so NETWORK DLP cannot see it. The control must be at the ENDPOINT: endpoint DLP, or disabling/whitelisting USB mass storage entirely. Matching the DLP type to the exfiltration channel is the analytical step.
Question 238
An organisation's PRIVACY NOTICE says data is retained for 2 years. It has records from 8 years ago. This is:
Select an option first.
Correct answer: A — A PRIVACY VIOLATION — data must be handled in accordance with the stated notice, and minimisation requires deletion
Explanation: The PRIVACY criterion (and GDPR) requires personal data to be handled IN ACCORDANCE WITH THE NOTICE the entity gave. Retaining data for 8 years having promised 2 breaches both the notice AND the DATA MINIMISATION principle — and it enlarges the blast radius of any future breach.
Question 239
Data you never collected:
Select an option first.
Correct answer: A — CANNOT BE BREACHED — which is the security corollary of data minimisation
Explanation: DATA MINIMISATION is both a PRIVACY principle and a SECURITY control. Data you never collected cannot be stolen, cannot be misused, and does not have to be protected, encrypted, backed up or destroyed. Reducing the data footprint reduces the attack surface.
Question 240
A ransomware victim with TESTED, IMMUTABLE, OFFLINE backups:
Select an option first.
Correct answer: B — Can RESTORE rather than pay — which is why backups are the primary ransomware control
Explanation: An organisation that can RESTORE does not need to PAY. This is why ransomware defence rests on TESTED, IMMUTABLE, OFFLINE backups. Note that modern ransomware also EXFILTRATES data and threatens to publish it ('double extortion') — so backups solve the availability problem but not the confidentiality one.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.