IIA IIA-CIA-PART3 Online Practice Questions and Exam Preparation

IIA IIA-CIA-PART3 Online Questions & Answers

• Question 1241:

  An organization's IT systems can only be accessed using the organization's virtual private network. However, organizational emails, videoconferencing, and file-sharing tools are cloud-based and can be accessed using multi-factor

  authentication via any device.

  Which of the following risks should the organization acknowledge?

  A. The risk that internal data can be leaked via unapproved applications
  B. The risk that virtual private networks are not secure
  C. The risk that remote access controls are usually ineffective in cloud solutions
  D. The risk that employees may read organizational emails outside of business hours
  A. The risk that internal data can be leaked via unapproved applications

  ---

  Explanation

  Cloud-based applications accessible outside the VPN perimeter increase the possibility of data leakage through unapproved or unsecured applications (shadow IT). Even with multi-factor authentication, risks remain around the use of

  personal devices and uncontrolled storage or sharing.

  Option B is incorrect because VPNs are generally secure if configured correctly. Option C is misleading, as remote access controls can be effective in cloud solutions when properly designed. Option D (employees accessing emails after

  hours) is not a risk related to security but rather a work-life balance issue.

  Thus, the key risk is potential leakage of organizational data via unapproved or uncontrolled applications (Option A).

  IIA Global Technology Audit Guide (GTAG): Auditing Cloud Computing; IIA Standards - Standard 2110: Governance.

• Question 1242:

  Which of the following security controls focuses most on prevention of unauthorized access to the power plant?

  A. An offboarding procedure is initiated monthly to determine redundant physical access rights
  B. Logs generated by smart locks are automatically scanned to identify anomalies in access patterns
  C. Requests for additional access rights are sent for approval and validation by direct supervisors
  D. Automatic notifications are sent to a central security unit when employees enter the premises during nonwork hours
  C. Requests for additional access rights are sent for approval and validation by direct supervisors

  ---

  Explanation

• Question 1243:

  Many people think that conflict is inherently detrimental to an organization. However, studies and actual case experience demonstrate that some conflict is desirable if an organization is to thrive. Identify the technique that management could use to stimulate conflict.

  A. Authoritative command.
  B. Restructuring the organization.
  C. Expansion of resources.
  D. Creation of super ordinate goals.
  B. Restructuring the organization.

  ---

  Explanation

  The interactionist view is that conflict may be constructive as well as destructive because it encourages self-criticism, creativity, and necessary change. Accordingly, managers may decide to stimulate controlled conflict. Techniques for this purpose may include ambiguous or threatening communications; hiring outsiders with different values, managerial styles, attitudes, and backgrounds; designating an individual to argue against the majority opinions of the group:and restructuring the organization to disrupt the status quo.

• Question 1244:

  Which of the following terms does not apply to noise in communication?

  A. Encoding.
  B. Sending.
  C. Interpretation.
  D. Decoding.
  C. Interpretation.

  ---

  Explanation

  Interpretation is a subprocess of perception. Noise is a disruption that impedes the communication process.

• Question 1245:

  Which of the following would most likely be found in an organization that uses a decentralized organizational structure?

  A. There is a higher reliance on organizational culture.
  B. There are clear expectations set for employees.
  C. There are electronic monitoring techniques employed.
  D. There is a defined code for employee behavior.
  B. There are clear expectations set for employees.

  ---

  Explanation

• Question 1246:

  Which of the following is the most likely reason an organization may decide to undertake a stock split?

  A. To keep stock price constant.
  B. To keep shareholders' equity constant.
  C. Toincrease shareholders' equity.
  D. To enhance the stock liquidity.
  D. To enhance the stock liquidity.

  ---

  Explanation

• Question 1247:

  Senior management of a dairy organization asks the internal audit function to undertake an advisory service within the finance function and the internal audit function subsequently issues a report. Which of the following is aligned with IIA guidance on monitoring the results of such an engagement?

  A. Senior management should dedicate a team to carry out a follow-up audit
  B. A member of the finance function should undertake follow-up in line with the scope
  C. Follow-up on the outcome of advisory services is not required
  D. The internal audit function should agree with senior management on the scope of a follow-up
  C. Follow-up on the outcome of advisory services is not required

  ---

  Explanation

  According to the IIA Standards, follow-up is mandatory only for assurance engagements, where corrective action plans are agreed and tracked. Advisory services are intended to add value and offer recommendations but do not require formal

  follow-up by internal audit. Responsibility for implementing recommendations lies with management.

  Options A and B improperly delegate follow-up responsibilities, and Option D incorrectly suggests mandatory follow-up for advisory engagements.

  IIA Standards - Standard 2500: Monitoring Progress (applies to assurance, not advisory services).

• Question 1248:

  Which of the following would an organization execute to effectively mitigate and manage risks created by a crisis or event?

  A. Only preventive measures.
  B. Alternative and reactive measures.
  C. Preventive and alternative measures.
  D. Preventive and reactive measures.
  D. Preventive and reactive measures.

  ---

  Explanation

  To effectively mitigate and manage risks during a crisis, organizations must implement a combination of preventive and reactive measures:

  Preventive measures: These are proactive steps taken before a crisis to reduce the likelihood of occurrence (e.g., risk assessments, internal controls, security protocols).

  Reactive measures: These are actions taken after a crisis occurs to minimize damage, restore operations, and recover from the event (e.g., business continuity plans, incident response strategies).

  (A)

  Incorrect -Only preventive measures.

  While prevention is essential, not all crises can be avoided. Organizations also need response mechanisms.

  (B)

  Incorrect - Alternative and reactive measures.

  Alternative measures (e.g., backup systems) are part of risk management, but without prevention , risks may escalate.

  (C)

  Incorrect - Preventive and alternative measures.

  Alternative measures (e.g., backup resources) help maintain operations but do not directly address crisis response.

  (D)

  Correct - Preventive and reactive measures.

  Best practice in risk management includes both preventing crises and responding effectively when they occur .

  IIA's Global Internal Audit Standards - Crisis Management and Business Resilience

  Emphasizes the need for both prevention and response strategies.

  COSO's ERM Framework - Risk Management in Crisis Situations

  Recommends a combination of risk avoidance, mitigation, and crisis response.

  ISO 22301 - Business Continuity Management

  Highlights the importance of preventive controls and reactive response planning.

• Question 1249:

  A new manager of a production department has been asked to assess the effectiveness of that department. The organization needs to satisfy both internal and external constituents and takes a broad approach to effectiveness. To complete the assignment successfully, the manager should:

  A. Measure the daily productivity of the department.
  B. Do a survey of employee morale, as it is often a major underlying factor in productivity.
  C. Compare the past year's production against annual goals.
  D. Consider short-, medium-, and long-term effectiveness.
  D. Consider short-, medium-, and long-term effectiveness.

  ---

  Explanation

  Kreitner Management, 9th ed., page 298) states, "Organizational effectiveness can be defined as meeting organizational objectives and prevailing societal expectations in the near future, adapting and developing in the intermediate future, and surviving in the distant future." In the near term about one year), it should be effective in achieving its goals, efficient in its use of resources, and a source of satisfaction to its constituencies owners, employees, customers, and society). In the intermediate term 2 to 4 years), it should adapt to new possibilities and obstacles and develop its abilities and those of its members. In the long term 5+ years), the organization should be able to survive in an uncertain world.

• Question 1250:

  In a dynamic equilibrium, successful organizations have a balance between fragmentation and coordination. Which of the following may cause an organization to risk the loss of this equilibrium?

  A. A framework of rules.
  B. A hierarchy of authority.
  C. Formation of cross-functional groups.
  D. Division of labor and technical specialization.
  D. Division of labor and technical specialization.

  ---

  Explanation

  The division of labor and technical specialization often lead to differentiation within an organization. Differentiation leads to fragmentation because specialists often have a narrow focus and make integration more difficult.