During a system upgrade at Beta Technologies, several critical errors occurred, leading to significant downtime. A post-incident review of the change management process is underway. Which of the following represents a key control that should be in place within a robust change management process?

Segregation of duties between the development, testing, and deployment functions.

Using minimal documentation for changes to reduce administrative overhead.

Segregation of duties between the development, testing, and deployment functions.

Bypassing testing for urgent changes with senior management's verbal approval.

Permitting developers to deploy changes directly to production with verbal approval.

Global Dynamics is implementing a new security architecture. Their CIO emphasizes that no user or device should be implicitly trusted. What is the fundamental principle of this Zero Trust architecture?

Never trust, always verify - regardless of network location

Verify external connections but trust internal traffic.

Trust traffic implicitly after initial authentication.

Grant complete trust after multi-factor authentication.

Never trust, always verify - regardless of network location

FinSecure Corp. is enhancing its system access controls to comply with new cybersecurity policies. An IT auditor is reviewing the proposed implementation of multi-factor authentication (MFA), which requires users to present at least two authentication factors from different categories. Which of the following proposed combinations would satisfy the requirement for true multi-factor authentication?

Requiring a user-created password followed by a one-time code generated by a physical hardware token.

Using two different complex passwords, one for the network and one for the application.

Requiring a user-created password followed by a system-generated personal identification number (PIN).

Using a fingerprint scan followed by a facial recognition scan to grant access.

The audit team at Bennet & Kline is exploring the use of Robotic Process Automation (RPA) to enhance the efficiency of its procedures. For which of the following audit tasks would RPA be most suitably applied?

Performing a three-way match for a high volume of purchase orders, receiving reports, and vendor invoices.

Negotiating with client management regarding the reasonableness of significant accounting estimates.

Performing a three-way match for a high volume of purchase orders, receiving reports, and vendor invoices.

Assessing the risk of material misstatement for a complex and newly acquired subsidiary.

Formulating the final audit opinion based on the subjective evaluation of accumulated audit evidence.

An entity uses an automated interface to transfer daily sales data from its point-of-sale (POS) system to the general ledger. The auditor discovers that the interface lacks an automated reconciliation control to verify that all transactions transferred completely. On three occasions during the year, the transfer failed partially and transactions were manually re-entered. What is the primary audit concern?

The lack of automated reconciliation, combined with the manual re-entry events, creates a risk that transactions may be lost, duplicated, or incorrectly entered, affecting the completeness and accuracy of revenue.

While automated interfaces are designed for efficiency, the absence of an automated reconciliation control introduces a risk that data integrity may be compromised, particularly when system errors occur, potentially leading to undetected errors in the financial statements.

Although manual re-entry procedures may include visual verification, relying solely on human review is insufficient to guarantee accuracy, as manual processes are inherently susceptible to errors, especially when dealing with large volumes of transactional data, leading to potential misstatements.

The lack of automated reconciliation, combined with the manual re-entry events, creates a risk that transactions may be lost, duplicated, or incorrectly entered, affecting the completeness and accuracy of revenue.

While legacy POS systems may present unique challenges, the lack of reconciliation controls is a concern regardless of the POS system's age or technology, as the absence of such controls creates a vulnerability to data errors and potential misstatements in the financial records.

Omega Services, a consulting firm, wants to simplify its employees' access to multiple cloud-based applications, including their CRM, project management software, and HR portal. To achieve this, the firm is implementing a Single Sign-On (SSO) solution using the Security Assertion Markup Language (SAML) protocol. What is the primary function provided by this SSO implementation?

Authentication to multiple applications with one set of credentials through a federated identity system.

Automatic password changes across all connected applications based on pre-defined complexity rules.

Encryption of all stored data, both in transit and at rest, within each cloud application's environment.

Requiring multiple, unique passwords for each system to enhance security through diverse authentication.

Authentication to multiple applications with one set of credentials through a federated identity system.

Apex Corp. is implementing a new enterprise resource planning (ERP) system. As part of the implementation, management is redesigning several key business processes. Which of the following actions would BEST exemplify the 'Control Activities' component of internal control, according to the COSO framework?

Implementing a security protocol that requires multi-factor authentication for all users accessing financial data within the ERP system.

Establishing a company-wide ethics hotline for employees to anonymously report suspected fraudulent activities.

Implementing a security protocol that requires multi-factor authentication for all users accessing financial data within the ERP system.

Developing a comprehensive risk assessment process to identify potential threats to the successful implementation of the ERP system.

Creating a monthly report summarizing the number of ERP system errors and the related corrective actions taken by the IT department.

GlobalTech Solutions struggles with inconsistent customer data across its CRM, billing, and support systems. Master Data Management (MDM) primarily addresses which of the following issues?

Creating a single, authoritative source of critical business data.

Implementing automated routines for the periodic removal of duplicate records.

Moving infrequently accessed data to long-term storage for cost optimization.

Applying end-to-end encryption to all databases to ensure regulatory compliance.

Creating a single, authoritative source of critical business data.

Free CPA ISC (Information Systems & Controls) 10-Question

Select Exam:

Choose Section:

CPA ISC (Information Systems & Controls) 10-Question Diagnostic

~10 minutes· Question 1 of 10· 12-Week Plan PDF

ISC-IITopic: Threat landscape

An accounting firm, FinSolve LLP, experiences a widespread system outage. The IT department discovers that numerous critical client files on the firm's network drives have been encrypted and are now inaccessible. A message has appeared on affected workstations demanding a payment in cryptocurrency in exchange for a key to decrypt the files. Based on this description, which of the following types of malware has most likely infected FinSolve's network?