IIA iia cia part3 3p practice test

Question 1

A manager decided to build his team's enthusiasm by giving encouraging talks about employee
empowerment, hoping to change the perception that management should make all decisions in the
department.
The manager is most likely trying to impact which of the following components of his team's
attitude?
A. Affective component.
B. Cognition component.
C. Thinking component.
D. Behavioral component.

Question 2

Which of the following can be classified as debt investments?

• A. Investments in the capital stock of a corporation.
• B. Acquisition of government bonds.
• C. Contents of an investment portfolio.
• D. Acquisition of common of a stock corporation.

Question 3

Which of the following devices best controls both physical and logical access to information systems?

• A. Plenum.
• B. Biometric lock.
• C. Identification card.
• D. Electromechanical lock.

Question 4

Which of the following is a cybersecurity monitoring activity intended to deter disruptive codes from
being installed on an organization's systems?

• A. Boundary defense.
• B. Malware defense.
• C. Penetration tests.
• D. Wireless access controls.

Question 5

Which of the following activities best illustrates a user's authentication control?

• A. Identity requests are approved in two steps.
• B. Logs are checked for misaligned identities and access rights.
• C. Users have to validate their identity with a smart card.
• D. Functions can be performed based on access rights.

Question 6

A company produces water buckets with the following costs per bucket:
Direct labor = $2
Direct material = $5
Fixed manufacturing = $3.50
Variable manufacturing = $2.50
The water buckets are usually sold for $15. However, the company received a special order for
50,000 water buckets at $11 each.
Assuming there is adequate manufacturing capacity and all other variables are constant, what is the
relevant cost per unit to consider when deciding whether to accept this special order at the reduced
price?

• A. $9.50
• B. $10.50
• C. $11
• D. $13

Question 7

Which of the following IT disaster recovery plans includes a remote site designated for recovery with
available space for basic services, such as internet and telecommunications, but does not have
servers or infrastructure equipment?

• A. Frozen site.
• B. Cold site.
• C. Warm site.
• D. Hot site.

Question 8

Which of the following organization structures would most likely be able to cope with rapid changes
and uncertainties?

• A. Decentralized.
• B. Centralized.
• C. Departmentalized.
• D. Tall structure.

Question 9

A chief audit executive wants to implement an enterprisewide resource planning software.
Which of the following internal audit assessments could provide overall assurance on the likelihood
of the software implementation's success?

• A. Readiness assessment.
• B. Project risk assessment.
• C. Post-implementation review.
• D. Key phase review.

Question 10

Which of the following statements is true regarding change management?

• A. The degree of risk associated with a proposed change determines whether the change request requires authorization.
• B. Program changes generally are developed and tested in the production environment.
• C. Changes are only required by software programs.
• D. To protect the production environment, changes must be managed in a repeatable, defined, and predictable manner.

Question 11

During disaster recovery planning, the organization established a recovery point objective. Which of
the following best describes this concept?

• A. The maximum tolerable downtime after the occurrence of an incident.
• B. The maximum tolerable data loss after the occurrence of an incident.
• C. The maximum tolerable risk related to the occurrence of an incident.
• D. The minimum recovery resources needed after the occurrence of an incident.

Question 12

Which of the following statements is true regarding user-developed applications (UDAs) and
traditional IT applications?

• A. UDAs and traditional IT applications typically follow a similar development life cycle.
• B. A UDA usually includes system documentation to illustrate its functions, and IT-developed applications typically do not require such documentation.
• C. Unlike traditional IT applications, UDAs typically are developed with little consideration of controls.
• D. IT testing personnel usually review both types of applications thoroughly to ensure they were developed properly.

Question 13

In reviewing an organization's IT infrastructure risks, which of the following controls is to be tested as
part of reviewing workstations?

• A. Input controls.
• B. Segregation of duties.
• C. Physical controls.
• D. Integrity controls.

Question 14

Which of the following is an example of internal auditors applying data mining techniques for
exploratory purposes?

• A. Internal auditors perform reconciliation procedures to support an external audit of financial reporting.
• B. Internal auditors perform a systems-focused analysis to review relevant controls.
• C. Internal auditors perform a risk assessment to identify potential audit subjects as input for the annual internal audit plan.
• D. Internal auditors test IT general controls with regard to operating effectiveness versus design.

Question 15

Which of the following is likely to occur when an organization decides to adopt a decentralized
organizational structure?

• A. A slower response to external change.
• B. Less controlled decision making.
• C. More burden on higher-level managers.
• D. Less use of employees' true skills and abilities.