CIA CIA IT Audit & Information Systems 2 — Questions and Answers
Question 1: What is the difference between a Recovery Time Objective (RTO) and a Recovery Point Objective (RPO)?
- RTO is the maximum tolerable downtime; RPO is the maximum acceptable data loss (Correct answer)
- RTO is the backup frequency; RPO is the time to restore a system
- RTO measures data integrity; RPO measures system availability
- RTO applies to hardware; RPO applies to software
Correct answer: RTO is the maximum tolerable downtime; RPO is the maximum acceptable data loss
RTO defines how quickly systems must be restored after a disruption, while RPO defines how much data loss (measured in time) is acceptable.
Question 2: Which of the following is an example of an application control rather than an IT general control?
- Password complexity requirements
- Segregation of IT duties
- Input validation edit checks (Correct answer)
- Disaster recovery planning
Correct answer: Input validation edit checks
Input validation edit checks (e.g., rejecting non-numeric data in a numeric field) are application-level controls that govern specific data processing within a system.
Question 3: What is the primary risk addressed by data encryption in transit?
- Unauthorized modification of stored records
- Interception and reading of data by unauthorized parties (Correct answer)
- System downtime during transmission
- Incorrect data entry by users
Correct answer: Interception and reading of data by unauthorized parties
Encryption in transit protects data from being read if intercepted during transmission over networks by making it unreadable without the decryption key.
Question 4: In IT auditing, what does 'segregation of duties' within the IT function typically require?
- All IT staff to rotate jobs annually
- Separation of system development, operations, and security roles (Correct answer)
- Independent third-party reviews of all code
- Outsourcing IT operations to reduce conflict of interest
Correct answer: Separation of system development, operations, and security roles
IT segregation of duties separates the development, operations, and security functions to prevent individuals from both creating and deploying unauthorized changes.
Question 5: When auditing an ERP system, which procedure would best test the completeness of recorded transactions?
- Tracing from source documents to the system (Correct answer)
- Vouching from system records back to source documents
- Reviewing system configuration settings
- Interviewing IT personnel about data flows
Correct answer: Tracing from source documents to the system
Tracing from source documents to the system tests completeness by verifying that transactions originating outside the system were actually captured and recorded.
Question 6: What is the purpose of penetration testing in an IT audit context?
- Measure system processing speed under load
- Simulate attacks to identify exploitable security vulnerabilities (Correct answer)
- Validate backup restoration procedures
- Assess IT staff knowledge of security policies
Correct answer: Simulate attacks to identify exploitable security vulnerabilities
Penetration testing involves authorized simulated attacks on systems to proactively identify security weaknesses before malicious actors can exploit them.
CIA CIA IT Audit & Information Systems 2
What is the difference between a Recovery Time Objective (RTO) and a Recovery Point Objective (RPO)?