IIA IIA-CIA-PART3 Online Practice Questions and Exam Preparation

IIA IIA-CIA-PART3 Online Questions & Answers

• Question 661:

  According to IIA guidance, which of the following is a typical risk associated with the tender process and contracting stage of an organization's IT outsourcing life cycle?

  A. The process is not sustained and is not optimized as planned.
  B. There is a lack of alignment to organizational strategies.
  C. The operational quality is less than projected.
  D. There is increased potential for loss of assets.
  D. There is increased potential for loss of assets.

  ---

  Explanation

• Question 662:

  A manager has a small team of employees, but each individual is self-motivated and could be termed a "high achiever." The manager has been given a particularly difficult assignment. Even for a high achiever, the probability that this job can be completed by one individual by the required deadline is low. Select the best course for the audit manager.

  A. Assign one individual since high achievers thrive on high risks.
  B. Assign two employees to moderate the risk of failure.
  C. Assign all employees to ensure the risk of failure is low.
  D. Ask company management to cancel the job.
  B. Assign two employees to moderate the risk of failure.

  ---

  Explanation

  High achievers wish to do something better than it has been done before. According to McClelland's theory of needs, high achievers thrive when the job provides for personal responsibility, feedback, and moderate risks. They avoid very easy or very difficult tasks, andthey do not like to succeed by chance. Accordingly, one high achiever should not be assigned a job when the probability of its successful completion is very low.

• Question 663:

  Which of the following is the leadership style in which the leader and the followers make decisions on the basis of consensus?

  A. Autocratic.
  B. Benevolent authoritative.
  C. Consultative.
  D. Participative.
  D. Participative.

  ---

  Explanation

  According to path-goal theory, the participative leader consults with employees and uses their suggestions before making a decision. Participative style is most useful when employees believe they control their own destinies, that is, when they have an internal locus of control. Such individuals may be resentful if they are not consulted. Thus, the participative (democratic) leader and his/her followers make the decision on a democratic basis through consensus. Moreover, the leader has complete confidence in subordinates.

• Question 664:

  Which of the following networks is suitable for an organization that has operations in multiple cities and countries?

  A. Wide area network.
  B. Local area network
  C. Metropolitan area network.
  D. Storage area network.
  A. Wide area network.

  ---

  Explanation

  A Wide Area Network (WAN) is the most suitable type of network for an organization that has operations in multiple cities and countries. WANs connect multiple local area networks (LANs) and other types of networks across long

  geographical distances, enabling seamless communication and data sharing among remote offices and branches.

  Option A: Wide Area Network (WAN) (Correct Answer)

  WANs cover extensive geographical areas, such as multiple cities, countries, or even continents.

  They use various communication technologies, including leased lines, satellite connections, VPNs, and MPLS.

  WANs enable organizations with distributed operations to centralize data management and enhance business continuity.

  Example: An international corporation like a multinational bank or a global retail chain relies on a WAN to link its offices worldwide.

  Option B: Local Area Network (LAN) (Incorrect Answer)

  LANs are confined to a small area, such as an office building, factory, or campus.

  They provide high-speed connectivity but are not designed for geographically dispersed locations.

  Example: A single office using Ethernet and Wi-Fi to connect employees' devices.

  Option C: Metropolitan Area Network (MAN) (Incorrect Answer)

  MANs span a city or a large campus but do not extend to multiple countries.

  Example: A city's government agencies using a fiber-optic MAN for interdepartmental communication.

  Option D: Storage Area Network (SAN) (Incorrect Answer)

  SANs are dedicated high-speed networks designed for large-scale data storage and retrieval.

  They are not meant for interconnecting geographically dispersed locations.

  Example: A financial institution using a SAN for high-speed access to critical databases.

  The IIA's Global Technology Audit Guide (GTAG) - IT Risks and Controls emphasizes the importance of network infrastructure in securing and managing organizational data across multiple locations.

  IIA Standard 2110 - Governance requires internal auditors to evaluate whether the organization's IT strategy (including WAN infrastructure) supports business objectives and risk management.

  IIA GTAG 17 - Auditing Network Security highlights the importance of WAN security, VPNs, and encryption when managing international operations.

  Explanation of Answer Choices:IIA References:Thus, the correct answer is A. Wide Area Network (WAN) .

• Question 665:

  How should a chief audit executive learn about emerging risk areas in an organization?

  A. Build and maintain a collaborative network with management
  B. Build an organization-wide risk management process
  C. Review the organization's procedures for conducting an annual risk assessment
  D. Review the organization's procedures for establishing its risk appetite
  A. Build and maintain a collaborative network with management

  ---

  Explanation

  The CAE should remain aware of emerging risks through ongoing communication and collaboration with senior management and other stakeholders. Building strong relationships allows the CAE to obtain early insights into new and developing risks.

  Option B (building a risk management process) is management's responsibility, not internal audit's. Options C and D involve reviewing processes, but they do not directly expose the CAE to emerging risks in real time.

  IIA Standards - Standard 2010: Planning; Practice Guide - Developing a Risk-based Internal Audit Plan.

• Question 666:

  Strategic control measurements of financial results relate to:

  A. Internal efficiency at the business-unit level.
  B. Internal efficiency at the departmental level.
  C. External effectiveness at the business-unit level.
  D. External effectiveness at the business-operating-system level.
  A. Internal efficiency at the business-unit level.

  ---

  Explanation

  Strategic controls should be established to monitor progress, isolate problems, identify invalid assumptions, and take prompt corrective action. As plans are executed at each organizational level, control measurements are made to determine whether objectives have been achieved. Thus, objectives flow down the organizational hierarchy, and control measures flow up. One category of strategic control measures relates to external effectiveness. A second category ofstrategic control measures relates to internal efficiency. At the business-unit level, the latter measures concern financial results.

• Question 667:

  The IT department maintains logs of user identification and authentication for all requests for access to the network. What is the primary purpose of these logs?

  A. To ensure proper segregation of duties
  B. To create a master repository of user passwords
  C. To enable monitoring for systems efficiencies
  D. To enable tracking of privileges granted to users over time
  D. To enable tracking of privileges granted to users over time

  ---

  Explanation

  IIA Business Knowledge for Internal Auditing, IT Controls and Monitoring section.

• Question 668:

  Although bureaucracy is often perceived negatively by the public, bureaucracy is a feature of nearly every large company. Which of the following is a sign that a bureaucracy is dysfunctional?

  A. A diversity of jobs.
  B. Rules that obscure responsibility.
  C. A large number of rules necessary for day to day operations.
  D. Obedience to authority.
  B. Rules that obscure responsibility.

  ---

  Explanation

  A sign that a bureaucracy is dysfunctional is the development of rules that are meaningless or that obscure accountability. A lack of accountability shows that the bureaucracy is ineffective at identifying the source problems and creating solutions to solve the problems.

• Question 669:

  An internal auditor conducts a data privacy audit engagement. Which of the following will most likely be treated as personal information?

  A. Behavioral information.
  B. Internet protocol (IP) addresses.
  C. Device types being used.
  D. Mobile device unique identifiers.
  B. Internet protocol (IP) addresses.

  ---

  Explanation

• Question 670:

  Which of the following is likely to occur when an organization decides to adopt a decentralized organizational structure?

  A. A slower response to external change.
  B. Less controlled decision making.
  C. More burden on higher-level managers.
  D. Less use of employees' true skills and abilities.
  B. Less controlled decision making.

  ---

  Explanation