CPCA Compliance and Auditing 2

Question 1

During a compliance audit, an auditor discovers that an employee has been granted access to systems beyond what their job role requires. What principle has been violated?

Accepted Answer

Least privilege

Answer

The least privilege principle requires that users be granted only the minimum access necessary to perform their job functions.

Question 2

Which of the following best describes a compliance gap analysis?

Accepted Answer

A comparison between current security controls and required standards

Answer

A gap analysis compares an organization's current state against required compliance standards to identify areas needing remediation.

Question 3

A CPCA is reviewing audit logs and notices that log entries have timestamps that are inconsistent with each other. What is the most likely root cause?

Accepted Answer

Lack of time synchronization across systems using NTP

Answer

Inconsistent timestamps across systems are typically caused by lack of synchronized clocks, which is addressed by implementing NTP (Network Time Protocol).

Question 4

Under SOC 2 auditing, which of the following Trust Service Criteria (TSC) is considered mandatory for all SOC 2 reports?

Accepted Answer

Security (Common Criteria)

Answer

The Security (Common Criteria) category is the only mandatory TSC in a SOC 2 report; all other criteria are optional and selected based on business needs.

Question 5

An organization wants to demonstrate compliance with payment card industry requirements. Which standard should they audit against?

Accepted Answer

PCI DSS

Answer

PCI DSS (Payment Card Industry Data Security Standard) is the framework specifically designed for organizations that handle cardholder data.

CPCA Exam Practice Test

CPCA Exam Practice Test

CPCA Compliance and Auditing 2