CIA CIA Information Technology & Systems 2

Question 1

Which COBIT framework domain is most focused on acquiring and implementing IT solutions?

Accepted Answer

Build, Acquire and Implement

Answer

The 'Build, Acquire and Implement' domain of COBIT covers how IT solutions are acquired, developed, and put into production.

Question 2

An internal auditor reviewing IT application controls would examine which of the following?

Accepted Answer

Input validation and edit checks within a specific application

Answer

Application controls are embedded within specific systems and include input validation, processing controls, and output controls.

Question 3

What does 'RPO' stand for in business continuity planning, and what does it measure?

Accepted Answer

Recovery Point Objective; the maximum tolerable data loss measured in time

Answer

Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time before a disaster.

Question 4

An auditor finds that a company does not perform penetration testing. This gap most directly affects the assessment of:

Accepted Answer

IT security vulnerability management

Answer

Penetration testing is a key component of vulnerability management that identifies exploitable weaknesses in IT security.

Question 5

Under a CIA audit, which of the following would be classified as an IT application control rather than a general control?

Accepted Answer

Automated three-way match of purchase orders, receipts, and invoices

Answer

An automated three-way match is an application control embedded in the accounts payable system to prevent payment errors.

CIA - Certified Internal Accountant Practice Test