CBA Information Technology Audits 3

Question 1

A bank's IT auditor is assessing vendor management controls for a cloud-based core banking provider. Which document is MOST important to review?

Accepted Answer

The Service Level Agreement and right-to-audit clause

Answer

The SLA defines performance commitments and the right-to-audit clause ensures the bank can verify the vendor's controls, which is essential for regulatory compliance.

Question 2

An auditor reviewing a bank's IT change management process finds that emergency changes are frequently implemented without post-implementation review. What risk does this create?

Accepted Answer

Unauthorized or poorly tested changes may persist in the production environment

Answer

Without post-implementation reviews, emergency changes may introduce security vulnerabilities or operational errors that remain undetected in production.

Question 3

When auditing a bank's network segmentation controls, what is the auditor PRIMARILY assessing?

Accepted Answer

Whether sensitive systems are isolated from less-secure network zones

Answer

Network segmentation isolates sensitive banking systems (e.g., core banking, cardholder data environments) from general networks, limiting the blast radius of a breach.

Question 4

Which BEST describes the purpose of penetration testing in a bank's IT audit program?

Accepted Answer

To simulate real-world attacks and identify exploitable vulnerabilities before malicious actors do

Answer

Penetration testing proactively identifies vulnerabilities by simulating actual attacker techniques, allowing the bank to remediate weaknesses before they are exploited.

Question 5

A bank IT auditor finds that developers have access to the production environment. What control deficiency does this represent?

Accepted Answer

A lack of segregation of duties between development and production

Answer

Developers with production access can introduce unauthorized code changes or access sensitive data, violating the segregation of duties principle.

(CBA) Certified Bank Auditor Practice Test

(CBA) Certified Bank Auditor Practice Test

CBA Information Technology Audits 3