CBA Information Technology Audits Questions and Answers

Question 1

An IT auditor is reviewing a bank's change management process for its core banking system. Which of the following represents the MOST significant control weakness?

Accepted Answer

The same developer who codes a change is responsible for deploying it into the production environment.

Answer

Change requests are documented using a paper-based form before being entered into the tracking system.

Answer

End-user testing is performed in a dedicated test environment but not by the original requester.

Answer

Emergency changes are verbally approved and documented retrospectively within five business days.

Question 2

A bank recently experienced a significant data center outage due to a natural disaster. The IT department successfully failed over to the disaster recovery (DR) site. When auditing the bank's Business Continuity Plan (BCP), which of the following is the MOST important audit procedure to perform?

Accepted Answer

Assessing the adequacy of the Business Impact Analysis (BIA) to ensure the Recovery Time Objectives (RTOs) for critical systems were met.

Answer

Reviewing the BCP documentation to ensure it includes contact information for key personnel.

Answer

Verifying that the cost of the disaster recovery site is within the approved IT budget.

Answer

Interviewing IT staff to confirm they received annual BCP awareness training.

Question 3

During an audit of logical access controls for the bank's wire transfer system, which of the following conditions would be of GREATEST concern to a Certified Bank Auditor?

Accepted Answer

Shared, generic user accounts are used by the treasury department for end-of-day processing.

Answer

A former employee's access was revoked two business days after their termination date.

Answer

The system does not enforce a minimum password length of 12 characters.

Answer

Access reviews are conducted semi-annually by department managers instead of quarterly.

Question 4

An auditor is evaluating the controls over a bank's new customer-facing mobile application, which was developed by a third-party vendor. According to the FFIEC IT Examination Handbook, which of the following is a primary responsibility of the bank's management?

Accepted Answer

Conducting a thorough risk assessment and due diligence process before and during the engagement.

Answer

Performing code-level security reviews of the vendor's software.

Answer

Ensuring the vendor's disaster recovery plan is tested annually.

Answer

Requiring the vendor to use the same brand of firewall as the bank for consistency.

Question 5

A Certified Bank Auditor is planning an audit of the bank's cybersecurity incident response plan. Which audit test would BEST assess the plan's practical effectiveness?

Accepted Answer

Reviewing the results and lessons learned from a recent tabletop exercise or simulation drill.

Answer

Confirming the plan has been reviewed and approved by the Board of Directors within the last year.

Answer

Verifying that the plan includes an up-to-date contact list for all incident response team members.

Answer

Ensuring the plan is stored in a secure, access-controlled location both on-site and off-site.

Question 6

Which of the following activities is a key component of an IT governance framework within a financial institution?

Accepted Answer

Ensuring that IT strategy is aligned with the bank's overall business strategy and objectives.

Answer

Daily reconciliation of nostro accounts.

Answer

Performing penetration testing on external-facing applications.

Answer

Installing and configuring antivirus software on all employee workstations.