CIA CIA IT Audit & Information Systems 2

Question 1

What is the difference between a Recovery Time Objective (RTO) and a Recovery Point Objective (RPO)?

Accepted Answer

RTO is the maximum tolerable downtime; RPO is the maximum acceptable data loss

Answer

RTO defines how quickly systems must be restored after a disruption, while RPO defines how much data loss (measured in time) is acceptable.

Question 2

Which of the following is an example of an application control rather than an IT general control?

Accepted Answer

Input validation edit checks

Answer

Input validation edit checks (e.g., rejecting non-numeric data in a numeric field) are application-level controls that govern specific data processing within a system.

Question 3

What is the primary risk addressed by data encryption in transit?

Accepted Answer

Interception and reading of data by unauthorized parties

Answer

Encryption in transit protects data from being read if intercepted during transmission over networks by making it unreadable without the decryption key.

Question 4

In IT auditing, what does 'segregation of duties' within the IT function typically require?

Accepted Answer

Separation of system development, operations, and security roles

Answer

IT segregation of duties separates the development, operations, and security functions to prevent individuals from both creating and deploying unauthorized changes.

Question 5

When auditing an ERP system, which procedure would best test the completeness of recorded transactions?

Accepted Answer

Tracing from source documents to the system

Answer

Tracing from source documents to the system tests completeness by verifying that transactions originating outside the system were actually captured and recorded.

CIA - Certified Internal Accountant Practice Test

CIA - Certified Internal Accountant Practice Test

CIA CIA IT Audit & Information Systems 2