Certified Internal Auditor Technology & Digital Applications 5

Question 1

Which type of malware encrypts an organization's files and demands payment for the decryption key?

Accepted Answer

Ransomware

Answer

Ransomware encrypts victim files or systems and extorts payment in exchange for providing the decryption key.

Question 2

An auditor reviewing a vendor's SOC 2 Type II report is primarily evaluating which aspect of third-party risk?

Accepted Answer

Effectiveness of the vendor's controls over a period of time

Answer

A SOC 2 Type II report provides an independent assessment of whether a service organization's controls operated effectively over a specified review period.

Question 3

What is the PRIMARY purpose of network segmentation from an information security perspective?

Accepted Answer

Limiting lateral movement by containing breaches to isolated segments

Answer

Network segmentation limits an attacker's ability to move laterally through the environment by isolating systems into separate network zones.

Question 4

An organization's data classification policy assigns 'confidential' to certain records. Which control is MOST directly aligned with enforcing this classification?

Accepted Answer

Role-based access control restricting confidential data to authorized roles

Answer

Role-based access control directly enforces data classification by ensuring only authorized roles can access confidential information.

Question 5

Which audit approach involves embedding continuous monitoring routines directly within an application to report exceptions in near real time?

Accepted Answer

Embedded audit modules

Answer

Embedded audit modules are routines inserted into application systems that automatically capture and report exception transactions for auditor review.

Certified Internal Auditor Practice Test

Certified Internal Auditor Practice Test

Certified Internal Auditor Technology & Digital Applications 5