CPCA Compliance and Auditing 4

Question 1

A CPCA is designing a continuous compliance monitoring program. Which approach provides the most real-time visibility into the compliance posture?

Accepted Answer

Automated control testing with dashboards

Answer

Automated continuous control testing with real-time dashboards provides ongoing visibility into compliance status rather than periodic point-in-time snapshots.

Question 2

Which risk treatment option involves transferring the financial consequences of a risk to a third party?

Accepted Answer

Risk transfer

Answer

Risk transfer shifts the financial burden of a risk to another party, such as purchasing cyber liability insurance or outsourcing a process.

Question 3

During a PCI DSS audit, an assessor reviews cardholder data flows. What document is commonly used to map where cardholder data is stored, processed, and transmitted?

Accepted Answer

Data Flow Diagram (DFD)

Answer

A Data Flow Diagram (DFD) visually maps where cardholder data enters, moves through, and exits an environment, which is essential for defining the PCI DSS scope.

Question 4

Which of the following is an example of a compensating control in a compliance framework?

Accepted Answer

Implementing encryption in place of an unachievable technical requirement

Answer

A compensating control is an alternative measure implemented when a primary required control cannot be met, such as using encryption to substitute for a specific technical safeguard.

Question 5

An organization operating under the Sarbanes-Oxley Act (SOX) must ensure which of the following regarding financial reporting systems?

Accepted Answer

Internal controls over financial reporting must be documented and tested

Answer

SOX Section 404 requires management to document, assess, and attest to the effectiveness of internal controls over financial reporting (ICFR).

CPCA Exam Practice Test

CPCA Exam Practice Test

CPCA Compliance and Auditing 4