Free IIA IIA-CIA-Part3 Practice Questions 2026 - Page 21

Which of the following best describes a detective control designed to protect an organization from cyberthreats and attacks?

A. A list of trustworthy, good traffic and a list of unauthorized, blocked traffic.

B. Monitoring for vulnerabilities based on industry intelligence.

C. Comprehensive service level agreements with vendors.

D. Firewall and other network perimeter protection tools.

The chief audit executive (CAE) has been asked to evaluate the chief technology officer's proposal to outsource several key functions in the organization's IT department. Which of the following would be the most appropriate action for the CAE to determine whether the proposal aligns with the organization's strategy?

A. Understand strategic context and evaluate whether supporting information is reliable and complete.

B. Ascertain whether governance and approval processes are transparent, documented, and completed.

C. Perform a due diligence review or asses management's review of provider operations.

D. Identify key performance measures and data sources.

Which of the following backup methodologies would be most efficient in backing up a database in the production environment?

A. Disk mirroring of the data being stored on the database.

B. A differential backup that is performed on a weekly basis.

C. An array of independent disks used to back up the database.

D. An incremental backup of the database on a daily basis.

Which of the following analytical techniques would an internal auditor use to verify that none of an organization's employees are receiving fraudulent invoice payments?

A. Perform gap testing.

B. Join different data sources.

C. Perform duplicate testing.

D. Calculate statistical parameters.

Which of the following intangible assets is considered to have an indefinite life?

A. Underground oil deposits

B. Copyright

C. Trademark

D. Land

Which of the following activities best illustrates a user's authentication control?

A. Identity requests are approved in two steps.

B. Logs are checked for misaligned identities and access rights.

C. Users have to validate their identity with a smart card.

D. Functions can toe performed based on access rights

What security feature would Identity a legitimate employee using her own smart device to gam access to an application run by the organization?

A. Using a jailbroken or rooted smart device feature.

B. Using only smart devices previously approved by the organization.

C. Obtaining written assurance from the employee that security policies and procedures are followed.

D. Introducing a security question known only by the employee.

During which phase of the contracting process ere contracts drafted for a proposed business activity?

A. Initiation phase.

B. Bidding phase

C. Development phase

D. Management phase

When executive compensation is based on the organization's financial results, which of the following situations is most likely to arise?

A. The organization reports inappropriate estimates and accruals due to poof accounting controls.

B. The organization uses an unreliable process forgathering and reporting executive compensation data.

C. The organization experiences increasing discontent of employees, if executives are eligible for compensation amounts that are deemed unreasonable.

D. The organization encourages employee behavior that is inconsistent with the interests of relevant stakeholders.

An internal auditor considers the financial statement of an organization as part of a financial assurance engagement. The auditor expresses the organization's electricity and depreciation expenses as a percentage of revenue to be 10% and 7% respectively. Which of the following techniques was used by the internal auditor In this calculation?

A. Horizontal analysis

B. Vertical analysis

C. Ratio analysis

D. Trend analysis