Certified Internal Auditor Technology & Digital Applications 3 — Questions and Answers
Question 1: When auditing an organization's use of artificial intelligence, which concern is MOST unique compared to traditional software audits?
- Software licensing compliance
- Model bias and explainability of automated decisions (Correct answer)
- Network infrastructure capacity
- Vendor contract terms
Correct answer: Model bias and explainability of automated decisions
AI introduces unique risks around algorithmic bias and the inability to fully explain model decisions, which are not present in deterministic software.
Question 2: A company migrating its ERP system to the cloud should ensure which control is in place to prevent unauthorized data access during migration?
- Employee background checks
- Data encryption in transit (Correct answer)
- Increased system performance monitoring
- Updated software licensing agreements
Correct answer: Data encryption in transit
Encrypting data in transit protects sensitive information from interception during the cloud migration process.
Question 3: Which metric best measures the effectiveness of an organization's patch management program?
- Number of IT staff responsible for patching
- Percentage of critical vulnerabilities remediated within defined SLAs (Correct answer)
- Total cost of patch deployment activities
- Frequency of vendor-released security updates
Correct answer: Percentage of critical vulnerabilities remediated within defined SLAs
Measuring the percentage of critical vulnerabilities patched within SLAs directly assesses whether the patch management program is timely and effective.
Question 4: What is the role of a Security Information and Event Management (SIEM) system?
- Blocking malicious network traffic in real time
- Aggregating and correlating security log data for threat detection (Correct answer)
- Managing user identities and access credentials
- Encrypting sensitive data stored in databases
Correct answer: Aggregating and correlating security log data for threat detection
A SIEM collects, aggregates, and correlates security event data from multiple sources to identify potential threats and support incident response.
Question 5: Which type of IT audit procedure would BEST verify that terminated employees' access has been revoked?
- Reviewing the HR termination policy document
- Comparing active user accounts to current employee records (Correct answer)
- Interviewing the IT security manager about procedures
- Observing the IT team process a new termination
Correct answer: Comparing active user accounts to current employee records
Comparing active system accounts against current HR records directly tests whether terminated employee access has actually been removed.
Question 6: In a containerized application environment, which security risk is MOST specific to container technology?
- SQL injection in application code
- Container escape allowing access to the host system (Correct answer)
- Cross-site scripting in web interfaces
- Weak password policies for user accounts
Correct answer: Container escape allowing access to the host system
Container escape vulnerabilities allow malicious processes to break out of the container sandbox and gain access to the underlying host system.
Question 7: An auditor discovers that application developers also have access to the production environment. This PRIMARILY represents a failure of which control?
- Encryption controls
- Segregation of duties (Correct answer)
- Backup and recovery
- Capacity planning
Correct answer: Segregation of duties
Allowing developers access to production violates segregation of duties, as they could deploy unauthorized code or manipulate production data.
Certified Internal Auditor Technology & Digital Applications 3
When auditing an organization's use of artificial intelligence, which concern is MOST unique compared to traditional software audits?