Free IIA IIA-CIA-Part3 Practice Questions 2026 - Page 22

Explanation

Remote wipe is a security feature that allows an organization to remotely erase data and restore a smart device to its default settings when the device is lost, stolen, or compromised. However, remote wipe has a significant limitation: it cannot guarantee that all data is completely removed from the device. Data may remain in residual form in unallocated storage areas, hidden partitions, system caches, or areas not covered by the wipe command. In addition, if the device is offline when the remote wipe command is issued, the wipe will not execute until the device reconnects. If the device is powered off, factory reset, or has its connectivity disabled, the wipe may never occur. Furthermore, data backed up to the cloud, synced to other devices, or stored on removable media is outside the scope of the remote wipe. For these reasons, complete removal of all data cannot be assured, making this the correct limitation.

Why the other options are incorrect:

A. Encrypted data cannot be locked to prevent further access
– This is incorrect. Remote wipe can lock encrypted data to prevent further access, typically by deleting the encryption keys or triggering a device lock. Locking encrypted data is actually one of the capabilities of remote wipe, not a limitation.

B. Default settings cannot be restored on the device
– This is incorrect. Restoring default, or factory, settings is a core function of remote wipe. When a remote wipe is executed successfully, the device is reset to its factory default configuration, so this is not a limitation.

D. Mobile device management software is required for successful remote wipe
– This is not a limitation of remote wipe itself but rather a deployment consideration. Many devices support remote wipe through built-in features, such as Find My Device or Exchange ActiveSync policies, without requiring full MDM software. While MDM enhances and centralizes remote wipe capabilities, it is not a strict requirement for remote wipe to function, so this is not the best description of its limitation.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically mobile device security, remote wipe capabilities, and limitations of mobile security controls.

Explanation

The primary role of an independent witness to the signing of a contract is to attest that the signatures on the contract were genuinely made by the parties named, that is, to validate that the promisor and promisee actually signed the document. By being physically present when the parties sign, the witness can later confirm, if necessary, that the signatures are authentic and were made by the persons whose names appear on the contract. This provides evidentiary support for the authenticity of the signatures and helps prevent disputes over whether a party actually signed the agreement. This is the fundamental purpose of having a witness to a contract signing.

Why the other options are incorrect:

A. A witness verifies the quantities of the copies signed
– The witness's role is not to verify how many copies of the contract are signed. While the number of copies may be documented administratively, counting copies is not the witness's primary function, which is to attest to the authenticity of the signatures.

B. A witness verifies that the contract was signed with the free consent of the promisor and promisee
– While free consent is a legal requirement for a valid contract, the witness is not primarily responsible for verifying that consent was freely given. The witness attests to the act of signing and the identity of the signatories, not to the internal state of mind or voluntariness of the parties. Issues of duress or undue influence would be addressed through other legal means.

C. A witness ensures the completeness of the contract between the promisor and promisee
– Ensuring the completeness of the contract, such as confirming that all pages and terms are present, is typically the responsibility of the parties and their legal counsel, not the witness. The witness's role is focused on the signing event and the authenticity of the signatures, not on verifying that the contract document is complete in all respects.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Contract Law and Procurement — Specifically the role of witnesses in contract execution and the requirements for valid contract signatures.

Explanation

Relevant costs are the costs that will be affected by a specific management decision, that is, the future costs that differ between alternatives. The concept of relevant cost helps management with behavioral analysis by focusing attention on only those costs that change as a result of a decision, while ignoring costs that do not differ, such as sunk costs or unavoidable fixed costs. This enables management to make better business decisions because it clarifies exactly what costs will be incurred for a given course of action and allows managers to compare alternatives on a like-for-like basis. By concentrating on relevant costs, management can avoid being misled by irrelevant or historical costs and can more accurately evaluate the financial consequences of its choices, which directly supports sound decision-making behavior.

Why the other options are incorrect:

A. It explains the assumption that both costs and revenues are linear through the relevant range
– This describes the concept of the relevant range and linear cost behavior assumptions used in cost-volume-profit analysis, not the concept of relevant cost. Relevant cost is about which costs matter for a specific decision, not about linearity assumptions.

B. It enables management to calculate a minimum number of units to produce and sell without having to incur a loss
– This describes break-even analysis, which determines the break-even point, the level of sales at which total revenues equal total costs. While relevant costs may be used in break-even analysis, the concept of relevant cost itself is not defined by calculating a minimum number of units to avoid a loss.

C. It enables management to predict how costs such as the depreciation of equipment will be affected by a change in business decisions
– This is partially related but not accurate as stated. Depreciation of existing equipment is often a sunk cost and therefore not relevant to a decision. Relevant cost focuses on future costs that differ between alternatives, not on predicting how all costs, including sunk costs like depreciation, will be affected. The statement mischaracterizes the concept.

Reference:

IIA-CIA-Part3 content area on Financial Management / Managerial Accounting — Specifically relevant costing, differential costs, and decision-making.

Explanation

In this scenario, the attack began with a phishing email that appeared to come from a legitimate vendor and contained a malicious Excel attachment. The cybercriminal gained access only after the manager opened the spreadsheet, which means the attack succeeded because a human being was deceived. The most effective control to prevent this type of attack is therefore employee education and awareness training, specifically training employees to recognize phishing attacks. When employees are trained to identify suspicious emails, verify sender addresses, avoid opening unexpected attachments, and report suspected phishing attempts, they become the first line of defense against social engineering attacks. Because the attack vector relies on human error rather than a purely technical vulnerability, no technical control can fully compensate for an untrained user who opens a malicious attachment, making employee education the most effective preventive control in this situation.

Why the other options are incorrect:

A. Monitoring network traffic
– Monitoring network traffic is a detective control that can help identify malicious activity after it occurs, but it does not prevent an employee from opening a malicious attachment in the first place. It may detect the attack in progress, but it is not the most effective control for preventing the initial compromise, which occurred through a phishing email.

B. Using whitelists and blacklists to manage network traffic
– Whitelists and blacklists are preventive controls that restrict network traffic to or from known good or bad addresses. While they can block some malicious traffic, they are not effective against phishing emails that come from spoofed or compromised legitimate vendor addresses, and they do not prevent a user from opening a malicious attachment.

C. Restricting access and blocking unauthorized access to the network
– Restricting network access and blocking unauthorized access are important preventive controls, but they do not prevent a user from opening a malicious attachment on an authorized device. Once the malware executes, the attacker may appear to be an authorized user, so this control alone would not have prevented the attack from succeeding.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically cybersecurity risks, phishing, social engineering, and security awareness training.

Explanation

Privacy principles generally require that personal information be retained only for as long as necessary to fulfill the purpose for which it was collected, or as required by law or regulation. Retaining customers' personal information indefinitely violates this principle because it goes beyond the legitimate business or legal need, increases the risk of unauthorized access, misuse, or data breach, and denies customers the ability to have their information properly disposed of when it is no longer needed. This practice is inconsistent with widely accepted privacy principles such as purpose limitation, data minimization, storage limitation, and disposal.

Why the other options are incorrect:

A. Customers can access and update personal information when needed
– This supports privacy principles because it gives customers control over their own information and helps ensure data accuracy. Allowing access and correction is consistent with individual participation and data quality principles, not a violation.

C. Customers reserve the right to reject sharing personal information with third parties
– This is consistent with privacy principles because it gives customers control over the use and disclosure of their personal information. Honoring customer choice regarding third-party sharing aligns with the principle of consent and use limitation, so it does not violate privacy principles.

D. The organization performs regular maintenance on customers' personal information
– Regular maintenance helps ensure that personal information is accurate, current, and complete. This supports the data quality principle of privacy, rather than violating it, so it is not a privacy violation.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically privacy principles, data protection, and personal information management.

Explanation

A one-time password (OTP) is a password that is valid for only one login session or transaction and is typically generated dynamically by a hardware device or software application. A key fob is a common hardware token device used to generate one-time passwords. It produces a new, time-synchronized or event-based code each time the employee needs to authenticate. The OTP generated by the key fob is used once and then becomes invalid, providing strong authentication because the password cannot be reused by an attacker even if it is intercepted. This makes the use of a key fob to produce a token the most likely situation in which a one-time password would be generated.

Why the other options are incorrect:

A. When an employee accesses an online digital certificate
– A digital certificate is an electronic credential used to verify identity and enable secure communications, such as SSL/TLS. Accessing a digital certificate does not generate a one-time password. Certificates use public key infrastructure (PKI) for authentication and encryption, not OTPs.

B. When an employee's biometrics have been accepted
– Biometric authentication verifies identity using physical or behavioral characteristics such as fingerprints, iris patterns, or facial recognition. When biometrics are accepted, the authentication is based on the biometric factor itself. No one-time password is generated as part of the biometric verification process.

C. When an employee creates a unique digital signature
– A digital signature is created using a private key to sign a document or message electronically, providing authentication, integrity, and non-repudiation. Creating a digital signature does not involve generating a one-time password. It uses cryptographic keys, not OTPs.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically authentication methods, including one-time passwords, hardware tokens, and multi-factor authentication.

Explanation

Physical security controls are measures designed to protect the physical assets of an organization, such as servers, network equipment, facilities, and other hardware, from unauthorized access, theft, damage, or environmental threats. Securing system servers with locking mechanisms and restricting access to specific individuals is a classic example of a physical security control. It ensures that only authorized personnel can physically access the servers, reducing the risk of tampering, theft, or sabotage. Locking mechanisms, such as locked server racks, cages, or rooms, and controlled physical access are fundamental physical safeguards for protecting IT infrastructure.

Why the other options are incorrect:

A. Transaction logs are maintained to capture a history of system processing
– Transaction logs are logical controls, specifically detective and audit trail controls, that record system activity for review and accountability. They are not physical security controls because they protect data through logical means, not physical barriers.

B. System security settings require the use of strong passwords and access controls
– Strong passwords and access controls are logical access controls, or technical controls. They govern access to systems and data through logical means such as authentication and authorization, not through physical barriers.

C. Failed system login attempts are recorded and analyzed to identify potential security incidents
– Recording and analyzing failed login attempts is a logical detective control. It monitors system access activity to identify potential security incidents, but it does not involve physical protection of assets.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically physical security controls versus logical (technical) controls, and the protection of IT assets.

Explanation

A firewall is a network security control whose primary function is to prevent unauthorized outside users from accessing an organization's data through the organization's network. It acts as a barrier between the organization's internal network and external networks such as the internet, inspecting incoming and outgoing traffic and allowing or blocking it based on predefined security rules. By filtering traffic at the network perimeter, a firewall blocks unauthorized access attempts, malicious traffic, and other external threats, thereby protecting the organization's data and systems from outside intrusion. This makes the firewall the control specifically designed for the purpose described in the question.

Why the other options are incorrect:

B. Encryption
– Encryption protects the confidentiality of data by converting it into an unreadable form that can only be decrypted with the proper key. While it protects data from being understood if intercepted or accessed, it does not prevent unauthorized outside users from accessing the network in the first place. Encryption is a data protection control, not a network perimeter access control.

C. Antivirus
– Antivirus software detects, prevents, and removes malicious software, such as viruses, worms, and trojans, on computers and devices. It protects against malware infections but does not control or prevent unauthorized network access from outside users. Its function is malware detection and removal, not network perimeter defense.

D. Biometrics
– Biometrics is an authentication method that verifies identity using physical or behavioral characteristics such as fingerprints, iris patterns, or facial recognition. It controls access to systems or physical facilities based on who the user is, but it is not designed to prevent unauthorized outside users from accessing the organization's network. It is an authentication control, not a network perimeter control.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically network security, perimeter controls, and information security controls.

Explanation

A matrix organization is a structure that combines two or more lines of authority, typically a functional structure, such as marketing, finance, or engineering, and a project or product structure. Employees in a matrix organization often report to both a functional manager and a project or product manager. This dual-reporting arrangement allows management to utilize personnel from various functions across projects or products, drawing on specialized expertise from different functional areas while focusing on specific projects or product lines. This combination of product and functional departments is the defining characteristic of a matrix organization, making option B the correct statement.

Why the other options are incorrect:

A. A unity-of-command concept requires employees to report technically, functionally, and administratively to the same manager
– The unity-of-command concept holds that each employee should report to only one manager, which is the opposite of how a matrix organization operates. In a matrix, employees typically report to two managers, such as a functional manager and a project manager, which violates the traditional unity-of-command principle. This statement describes a traditional hierarchical structure, not a matrix organization.

C. Authority, responsibility and accountability of the units involved may vary based on the project's life, or the organization's culture
– While it is true that authority and responsibility in matrix organizations can be complex and may shift over time or vary by culture, this statement is too vague and general to be the defining or most accurate characteristic of matrix organizations. Option B more precisely captures what a matrix organization is: a combination of product and functional departments that allows flexible use of personnel.

D. It is best suited for firms with scattered locations or for multi-line, large-scale firms
– This statement describes conditions under which a divisional or geographic structure might be appropriate, not specifically a matrix organization. While matrix structures can be used by large, complex organizations, the statement does not accurately capture the essence of what a matrix organization is or its primary characteristic.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Organizational Behavior — Specifically organizational structures, including matrix organizations.

Explanation:

Biometric access controls verify identity using unique physical or behavioral characteristics of an individual. Among the biometric methods listed, retinal print comparison uses the most unique human recognition characteristic. The retina — the layer of tissue at the back of the eye containing blood vessels — has a highly complex and distinctive pattern of blood vessels that is unique to each individual, even among identical twins. Retinal patterns are extremely stable over a person's lifetime and are very difficult to replicate or forge, making retinal scanning one of the most accurate and secure biometric authentication methods available. This high degree of uniqueness and stability is why retinal print comparison is considered to use the most unique human recognition characteristic among the options.

Why the other options are incorrect:

A. Facial comparison using photo identification
– Facial recognition compares facial features (e.g., distance between eyes, nose shape, jawline) to verify identity. While facial features are distinctive, they can change with age, weight, facial hair, or expression, and photo identification is relatively easy to forge or spoof. Facial characteristics are less unique and less reliable than retinal patterns.

B. Signature comparison
– Signature comparison is a behavioral biometric that analyzes the way a person signs their name, including speed, pressure, and stroke pattern. Signatures can vary from one signing to another and can be forged or imitated with practice, making them less unique and less reliable than retinal patterns.

C. Voice comparison
– Voice comparison is a behavioral/biometric method that analyzes vocal characteristics such as pitch, tone, and cadence. Voices can change due to illness, emotion, or aging, and can be imitated or recorded and replayed, making voice recognition less unique and less secure than retinal scanning.

Reference:

IIA-CIA-Part3 content area on Information Technology — specifically biometric authentication methods and access controls.