You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 241
'DOUBLE EXTORTION' ransomware means the attacker:
Select an option first.
Correct answer: C — ENCRYPTS the data AND EXFILTRATES it, threatening to PUBLISH it if the ransom is not paid
Explanation: DOUBLE EXTORTION: the attacker EXFILTRATES the data BEFORE encrypting it, then threatens to PUBLISH it. Backups defeat the ENCRYPTION (availability) but NOT the PUBLICATION threat (confidentiality). Prevention of exfiltration — DLP, egress monitoring, segmentation — therefore matters even for organisations with perfect backups.
Question 242
The BEST defence against phishing is:
Select an option first.
Correct answer: B — LAYERED — email filtering, MFA (ideally phishing-resistant), user training, and rapid detection/response
Explanation: NO single control stops phishing. DEFENCE IN DEPTH: email filtering (catch most of it); PHISHING-RESISTANT MFA (so a stolen password is useless); USER TRAINING with simulations (catch what filtering misses); and rapid DETECTION and RESPONSE (for what gets through). Any single control alone will fail.
Question 243
An attacker phishes a password but cannot log in because a FIDO2 key is required. This demonstrates:
Select an option first.
Correct answer: A — MFA's value — a stolen PASSWORD alone is INSUFFICIENT, and a phishing-resistant factor cannot be relayed
Explanation: MFA's core value: a STOLEN PASSWORD alone is USELESS. And a FIDO2 key is PHISHING-RESISTANT — it cryptographically binds to the legitimate domain, so even a real-time relay attack against a lookalike site fails. TOTP and SMS codes, by contrast, CAN be relayed.
Question 244
A user reports a phishing email. The organisation should:
Select an option first.
Correct answer: B — INVESTIGATE — determine whether others received or CLICKED it, and block the sender/domain
Explanation: A reported phish is a DETECTION EVENT. The response: search the mail environment for OTHER recipients; determine whether anyone CLICKED or entered credentials; block the sender, domain and any linked URLs; reset affected credentials; and hunt for any resulting compromise. And REWARD the reporting, so people keep doing it.
Question 245
An organisation that PUNISHES employees for reporting security mistakes will:
Select an option first.
Correct answer: C — SUPPRESS reporting — mistakes will be hidden, and incidents will be discovered far later
Explanation: PUNISHING self-reported mistakes destroys the reporting culture. Employees hide errors, and the organisation discovers its breaches months later from a third party. A BLAME-FREE reporting culture is a genuine security control, and it is why organisations reward phishing reports rather than shaming those who clicked.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 246
A penetration test finds NO vulnerabilities. This most likely means:
Select an option first.
Correct answer: D — The test's SCOPE was too NARROW, or it was time-boxed — 'no findings' is more often a scoping artefact than a security triumph
Explanation: A pen test finding NOTHING should prompt scrutiny of the SCOPE, the TIME allowed, and the RULES OF ENGAGEMENT. Was social engineering excluded? Was the test limited to a handful of IPs? Was it time-boxed to two days? 'No findings' is far more often a scoping artefact than evidence of genuine security.
Question 247
A RED TEAM exercise differs from a penetration test in that it:
Select an option first.
Correct answer: A — Simulates a REAL ADVERSARY over an extended period, testing DETECTION and RESPONSE — not just whether vulnerabilities exist
Explanation: A PEN TEST asks 'CAN we get in?' A RED TEAM asks 'CAN THEY DETECT AND STOP US?' — simulating a real adversary over weeks, using any means (phishing, physical, technical), with the BLUE TEAM unaware. It tests the DETECT and RESPOND functions, not merely the presence of vulnerabilities.
Question 248
A PURPLE TEAM exercise involves:
Select an option first.
Correct answer: B — The RED and BLUE teams working COLLABORATIVELY — the attackers explain their techniques so defenders can improve detection
Explanation: A PURPLE TEAM is COLLABORATIVE: the red team executes a technique, the blue team checks whether their tooling detected it, and they tune the detection together. It converts an adversarial exercise into a rapid improvement loop, and it is often more valuable than a pure red team for organisations early in their maturity.
Question 249
An organisation's SIEM generates 10,000 alerts per day, of which staff review 200. This indicates:
Select an option first.
Correct answer: B — ALERT FATIGUE — the SIEM is untuned, and genuine attacks are almost certainly being missed in the noise
Explanation: ALERT FATIGUE is a real and common failure. An untuned SIEM generating thousands of false positives guarantees that genuine attacks are LOST IN THE NOISE. The fix is TUNING — suppressing known-benign patterns, prioritising by risk, and automating the triage of low-value alerts.
Question 250
A control that is DESIGNED well but NOT OPERATING is:
Select an option first.
Correct answer: A — INEFFECTIVE — design and operating effectiveness are BOTH required
Explanation: BOTH are required. A well-DESIGNED control that is never PERFORMED provides no assurance whatever. Conversely, a diligently performed control that is poorly DESIGNED (too imprecise to catch a material error) is equally useless. The auditor evaluates design FIRST, then tests operation.
Question 251
An organisation performs quarterly access reviews but managers approve them without examining the detail. The control is:
Select an option first.
Correct answer: B — INEFFECTIVE in OPERATION — a rubber-stamped review provides no assurance, however well designed
Explanation: A RUBBER-STAMPED review is a control that exists on paper only. The auditor should test whether the reviewer actually EXAMINED the access, whether any access was ACTUALLY REMOVED as a result, and how long the review took. A review that never results in a removal is a strong indicator of rubber-stamping.
Question 252
An access review that NEVER results in any access being removed is:
Select an option first.
Correct answer: B — A STRONG INDICATOR of rubber-stamping — some access creep is essentially inevitable
Explanation: In any organisation of size, people change roles, projects end, and contractors leave. A review across hundreds of users that finds NOTHING to remove, quarter after quarter, is almost certainly not being performed properly. Auditors look for evidence of ACTUAL REMOVALS as proof the review has teeth.
Question 253
PHYSICAL security is relevant to information security because:
Select an option first.
Correct answer: A — Physical access to a server or workstation can DEFEAT most logical controls
Explanation: An attacker with PHYSICAL ACCESS to a device can often bypass logical controls entirely — booting from external media, removing the drive, installing a hardware keylogger, or simply stealing it. Physical security (locks, badges, cameras, visitor escorts, secure disposal) is a genuine layer of the defence.
Question 254
DISPOSING of a server without SANITISING its drives risks:
Select an option first.
Correct answer: C — DISCLOSURE of all data on the drive — deletion is LOGICAL and the data remains recoverable
Explanation: DELETION is logical; the data REMAINS RECOVERABLE. Proper DESTRUCTION requires OVERWRITING (multiple passes), DEGAUSSING (for magnetic media), or PHYSICAL DESTRUCTION (shredding). Selling or scrapping a 'deleted' drive is a well-documented and entirely avoidable breach.
Question 255
A CERTIFICATE OF DESTRUCTION from a disposal vendor provides:
Select an option first.
Correct answer: D — Documentary EVIDENCE that media were destroyed — but the vendor's own controls should also be assessed
Explanation: A CERTIFICATE OF DESTRUCTION is EVIDENCE — but it is only as reliable as the VENDOR. Third-party risk applies here too: the vendor's own controls, chain of custody, and facility security should be assessed, and higher-risk media should ideally be destroyed on site before it ever leaves.
Question 256
An entity's incident response plan lists a contact who left THREE YEARS AGO. This indicates:
Select an option first.
Correct answer: D — The plan has NOT BEEN TESTED or MAINTAINED — exactly the kind of failure a tabletop exercise exists to find
Explanation: A three-year-old contact list is proof the plan has been WRITTEN but never TESTED or MAINTAINED. In a real incident, the response team would waste critical time discovering the plan is fiction. TABLETOP EXERCISES exist to surface exactly this — cheaply, and before it matters.
Question 257
The FIRST action on discovering an active intrusion is generally to:
Select an option first.
Correct answer: A — CONTAIN — isolate affected systems to stop the spread, while preserving EVIDENCE
Explanation: CONTAINMENT comes first: isolate the affected systems (network isolation rather than powering down, which destroys volatile memory evidence). Preserve FORENSIC EVIDENCE. Only then ERADICATE and RECOVER. Wiping systems immediately destroys the evidence needed to understand the scope and prevent recurrence.
Question 258
POWERING OFF a compromised machine immediately may:
Select an option first.
Correct answer: C — DESTROY volatile FORENSIC EVIDENCE in memory (running processes, network connections, encryption keys)
Explanation: POWERING OFF destroys VOLATILE MEMORY — running processes, active network connections, injected code, and sometimes the encryption keys themselves. The preferred containment is NETWORK ISOLATION (unplug the network cable, or isolate the VLAN) which stops the spread while PRESERVING memory for forensic capture.
Question 259
A BREACH involving personal data of EU residents triggers GDPR obligations even if the company is US-based, because GDPR:
Select an option first.
Correct answer: C — Has EXTRATERRITORIAL reach — it applies to anyone processing EU residents' data, wherever the company sits
Explanation: GDPR's EXTRATERRITORIAL reach is what made it globally significant: it applies to any organisation processing the personal data of individuals IN THE EU, regardless of where the organisation is established — if it offers goods/services to them or monitors their behaviour.
Question 260
An organisation subject to BOTH GDPR and CCPA should:
Select an option first.
Correct answer: C — Comply with the MOST STRINGENT requirement applicable to each data set — the obligations coexist
Explanation: Multiple privacy regimes COEXIST. An organisation must satisfy each one applicable to it — in practice, building to the MOST STRINGENT standard (usually GDPR) and layering on the specific requirements of others (CCPA's 'do not sell' opt-out, for instance).
Question 261
A cloud provider processing personal data on the user's instructions is, under GDPR, a:
Select an option first.
Correct answer: A — PROCESSOR — and a written DATA PROCESSING AGREEMENT is required
Explanation: A cloud provider acting ON THE CUSTOMER'S INSTRUCTIONS is a PROCESSOR. GDPR REQUIRES a written DATA PROCESSING AGREEMENT (Article 28) setting out the subject matter, duration, nature and purpose, the types of data, and the processor's obligations — including sub-processor approval and breach notification to the controller.
Question 262
A processor that decides HOW and WHY to process data becomes:
Select an option first.
Correct answer: D — A CONTROLLER for that processing — with the full accountability that entails
Explanation: If a processor starts making its OWN decisions about the PURPOSES and MEANS of processing (using customer data to train its own models, for instance), it becomes a CONTROLLER for that processing — assuming the full set of controller obligations, including a lawful basis and transparency to data subjects.
Question 263
The ability to REVOKE a compromised digital certificate is undermined when:
Select an option first.
Correct answer: A — CLIENTS FAIL TO CHECK the revocation status (CRL/OCSP), or FAIL OPEN when the check times out
Explanation: REVOCATION only works if CLIENTS CHECK. Many do not, or 'FAIL OPEN' — proceeding with the connection when the OCSP responder is slow or unreachable, rather than blocking. That gap between the DESIGN of PKI and its PRACTICE is a genuine and frequently examined weakness.
Question 264
OCSP STAPLING improves revocation checking by:
Select an option first.
Correct answer: A — Having the SERVER present a recent, signed revocation status — removing the client's need to contact the CA
Explanation: OCSP STAPLING has the SERVER periodically fetch a signed, timestamped OCSP response from the CA and 'staple' it to the TLS handshake. The client gets the revocation status without contacting the CA — improving performance AND privacy, and removing the fail-open failure mode.
Question 265
An organisation's ALE is $600,000. A control costing $150,000 would reduce it to $200,000. The organisation should:
Select an option first.
Correct answer: A — IMPLEMENT it — the $400,000 ALE reduction far exceeds the $150,000 cost
Explanation: ALE reduction = $600,000 − $200,000 = $400,000. Cost = $150,000. NET BENEFIT = $250,000 annually. Clearly justified. The remaining $200,000 of ALE is RESIDUAL RISK, which management must explicitly accept, transfer, or further mitigate.
Question 266
A control reduces the ARO from 0.5 to 0.1 with an SLE of $800,000. The ALE reduction is:
Select an option first.
Correct answer: D — $320,000 — ALE falls from $400,000 to $80,000
Explanation: ALE before = $800,000 × 0.5 = $400,000. ALE after = $800,000 × 0.1 = $80,000. REDUCTION = $320,000. A control costing less than $320,000 per year would be justified.
Question 267
A control reduces the SLE (not the ARO). An example is:
Select an option first.
Correct answer: A — ENCRYPTION — the breach still happens, but the stolen data is unusable, reducing the loss per incident
Explanation: Controls reducing the ARO (frequency) include patching, firewalls and training — they make the incident LESS LIKELY. Controls reducing the SLE (loss per incident) include ENCRYPTION (the stolen data is useless), SEGMENTATION (limiting the blast radius), and BACKUPS (limiting the downtime). Both routes reduce ALE.
Question 268
NETWORK SEGMENTATION reduces:
Select an option first.
Correct answer: D — The SLE — an attacker who compromises one segment cannot reach the rest, limiting the loss per incident
Explanation: SEGMENTATION does not make the intrusion LESS LIKELY (the ARO is unchanged) — it CONTAINS the BLAST RADIUS, reducing the LOSS PER INCIDENT (the SLE). Both are legitimate risk-reduction strategies, and identifying WHICH TERM a control affects is the analytical skill ISC tests.
Question 269
An entity encrypts a laptop's drive. A stolen laptop then represents:
Select an option first.
Correct answer: A — Generally NOT a reportable breach — encryption is a recognised SAFE HARBOUR in most breach notification laws
Explanation: Most breach notification laws (and HIPAA explicitly) provide a SAFE HARBOUR: if the data was ENCRYPTED and the key was not also compromised, the loss of the device is generally NOT a REPORTABLE BREACH. Full-disk encryption on laptops is therefore one of the highest-value, lowest-cost privacy controls available.
Question 270
An entity's encryption keys are stored on the SAME server as the encrypted data. This is:
Select an option first.
Correct answer: A — A CRITICAL failure — an attacker who obtains the server obtains BOTH, rendering the encryption worthless
Explanation: Storing the KEY with the DATA defeats the encryption entirely. Keys must be managed SEPARATELY — in a hardware security module (HSM) or a dedicated key management service, with strict access control, rotation, and separation of duties between those who manage keys and those who manage data.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.