CBA Information Technology Auditing Questions and Answers

Question 1

An IT auditor is evaluating a bank's use of a public cloud service provider (CSP) for hosting its mobile banking application.
Under the shared responsibility model, which of the following controls is MOST likely the bank's responsibility to implement and audit?

Accepted Answer

Configuration of the virtual machine operating systems and security groups.

Answer

Physical security of the data center facilities.

Answer

Security of the underlying network infrastructure.

Answer

Maintenance of the hypervisor that manages virtual resources.

Question 2

During a review of a bank's Business Continuity Plan (BCP), an auditor notes that the plan has not been updated in over three years. The Business Impact Analysis (BIA) is also outdated. Which of the following is the GREATEST risk associated with this finding?

Accepted Answer

The recovery strategies may no longer be effective for current critical business operations.

Answer

The plan may not be compliant with archival and record retention policies.

Answer

The cost of executing the plan may have increased beyond the allocated budget.

Answer

The contact information for key personnel listed in the plan may be incorrect.

Question 3

Which of the following IT governance frameworks provides a comprehensive model that bridges the gap between technical issues, business risks, and control requirements, making it highly suitable for auditors in the banking sector?

Accepted Answer

COBIT (Control Objectives for Information and Related Technologies)

Answer

ITIL (Information Technology Infrastructure Library)

Answer

ISO/IEC 27001

Answer

Scrum

Question 4

A bank's IT auditor is performing a review of Information Technology General Controls (ITGCs). Which of the following areas is considered one of the four core domains of an ITGC audit?

Accepted Answer

Change management processes.

Answer

Application-level transaction validation.

Answer

End-user satisfaction surveys.

Answer

IT project portfolio management.

Question 5

In an audit of a bank's data governance program, which of the following findings would represent the MOST significant weakness?

Accepted Answer

There is a lack of clearly defined ownership and stewardship for critical data elements.

Answer

The data classification policy has not been reviewed by the legal department.

Answer

A complete data lineage for a non-critical marketing report cannot be produced.

Answer

The bank has not yet adopted the latest version of its data analytics software.

Question 6

An IT auditor is tasked with assessing the effectiveness of a bank's cybersecurity controls. Which audit procedure would provide the MOST assurance regarding the bank's ability to detect and respond to real-world threats?

Accepted Answer

Conducting a controlled penetration test and simulating an attack scenario.

Answer

Reviewing the bank's incident response plan and related policy documents.

Answer

Interviewing key IT security personnel about their roles and responsibilities.

Answer

Performing a vulnerability scan of the external-facing network.

An IT auditor is evaluating a bank's use of a public cloud service provider (CSP) for hosting its mobile banking application.Under the shared responsibility model, which of the following controls is MOST likely the bank's responsibility to implement and audit?

An IT auditor is evaluating a bank's use of a public cloud service provider (CSP) for hosting its mobile banking application.
Under the shared responsibility model, which of the following controls is MOST likely the bank's responsibility to implement and audit?