CPCA Compliance and Auditing 3

Question 1

A company is subject to HIPAA and stores electronic protected health information (ePHI). Which rule specifically addresses the security of ePHI?

Accepted Answer

HIPAA Security Rule

Answer

The HIPAA Security Rule establishes national standards for protecting ePHI through administrative, physical, and technical safeguards.

Question 2

During an audit, a CPCA finds that a critical patch has not been applied to a production server for 90 days. This finding would most likely be classified as:

Accepted Answer

A major non-conformity

Answer

A 90-day unpatched critical vulnerability represents a significant failure of a required control, qualifying as a major non-conformity.

Question 3

What distinguishes a Type 1 SOC 2 report from a Type 2 SOC 2 report?

Accepted Answer

Type 1 assesses design at a point in time; Type 2 assesses design and operating effectiveness over a period

Answer

A SOC 2 Type 1 report evaluates the suitability of control design at a specific point in time, while Type 2 evaluates both design and operating effectiveness over a period (typically 6–12 months).

Question 4

Which framework is most commonly used by US federal agencies to categorize information systems based on the potential impact of a security breach?

Accepted Answer

NIST FIPS 199

Answer

NIST FIPS 199 establishes security categorization standards for federal information and information systems using Low, Moderate, and High impact levels.

Question 5

An auditor is testing whether access to a sensitive database requires multi-factor authentication. This is an example of testing which type of control?

Accepted Answer

Preventive control

Answer

Multi-factor authentication is a preventive control because it acts before an event to stop unauthorized access from occurring.

CPCA Exam Practice Test

CPCA Exam Practice Test

CPCA Compliance and Auditing 3