IIA IIA-CIA-PART3 Online Practice Questions and Exam Preparation

IIA IIA-CIA-PART3 Online Questions & Answers

• Question 891:

  The marketing manager of a corporation wrote an interdepartmental memorandum to the budget manager concerning corrections to the sales forecast for the coming year. What is this an example of?

  A. Downward communication.
  B. Upward communication.
  C. Informal communication.
  D. Horizontal communication.
  D. Horizontal communication.

  ---

  Explanation

  An interdepartmental memorandum, as described, is a horizontal communication in that no superior-subordinate relationship is involved.

• Question 892:

  An attacker, posing as a bank representative, convinced an employee to release certain, financial information that ultimately resulted in fraud. Which of the following best describes this cybersecurity risk?

  A. Shoulder suiting
  B. Pharming,
  C. Phishing.
  D. Social engineering.
  D. Social engineering.

  ---

  Explanation

  Social engineering is a psychological manipulation technique used by attackers to trick individuals into divulging sensitive information. Instead of exploiting technical vulnerabilities, it targets human weaknesses such as trust, fear, or urgency.

  Manipulates Human Behavior - The attacker impersonates a trusted entity (a bank representative) to deceive the employee.

  Leads to Unauthorized Information Disclosure - The employee unknowingly provides sensitive financial data.

  Results in Fraud - The stolen information is misused, causing financial loss.

  Option A: Shoulder Surfing - This occurs when an attacker physically observes someone entering sensitive data (e.g., watching a person type a password).

  Option B: Pharming - This involves redirecting users to a fraudulent website to steal their credentials, not direct impersonation.

  Option C: Phishing - This is a broad category of social engineering that typically involves emails or fake websites , whereas this scenario describes a direct impersonation attack .

  IIA's GTAG on Cybersecurity - Discusses social engineering as a key risk for organizations.

  NIST SP 800-61 (Incident Handling Guide) - Identifies social engineering as a common attack vector.

  COBIT 2019 (IT Governance Framework) - Highlights human-related cybersecurity risks.

  Why Social Engineering is the Correct Answer? Why Not the Other Options?

• Question 893:

  An organization filters data packets from public networks to send to an internal private network. Which of the following devices would accomplish this?

  A. A router
  B. A switch
  C. A hub
  D. A proxy gateway
  D. A proxy gateway

  ---

  Explanation

• Question 894:

  Management literature describes generic influence tactics that may be used to influence superiors, peers, or subordinates. Which of the following is the most commonly used influence tactic?

  A. An upward appeal.
  B. Exchange.
  C. Rational persuasion.
  D. Pressure.
  C. Rational persuasion.

  ---

  Explanation

  The most commonly used influence tactics are consultation, rational persuasion, and inspirational appeals. The least commonly used are pressure tactics, upward appeals, and exchange tactics. Rational persuasion tries to convince others by reliance on a detailed plan, supporting evidence, and reason. Rational persuasion is the method used most often by employees of participative managers.

• Question 895:

  Which of the following is an example of a badly encoded message?

  A. Inattention or disinterest in the message.
  B. Inconsistency between verbal and nonverbal messages.
  C. Gesturing to someone who cannot see the gesture.
  D. Sender's dislike of receiver.
  B. Inconsistency between verbal and nonverbal messages.

  ---

  Explanation

  If body language or tone of voice send a message different from the spoken words, the receiver will not be clear about the meaning of the message.

• Question 896:

  Which of the following is the primary benefit of including end users in the system development process?

  A. Improved integrity of programs and processing.
  B. Enhanced ongoing maintenance of the system.
  C. Greater accuracy of the testing phase.
  D. Reduced need for unexpected software changes.
  C. Greater accuracy of the testing phase.

  ---

  Explanation

• Question 897:

  The director of internal auditing for a large company has established an excellent reputation because of her strong professional credentials and tactful but firm handling of auditor-auditee relationships. With regard to auditees, she must rely upon what sources of power?

  A. Expert and coercive.
  B. Referent and reward.
  C. Referent and expert.
  D. Legitimate and coercive.
  C. Referent and expert.

  ---

  Explanation

  The internal audit director has no formal (legitimate or position) power over auditees. Nor does she have the power to coerce (punish) or reward them. Rather, her ability to exert power (influence others) must derive from her specialized ability and knowledge and the force of her personal qualities.

• Question 898:

  Which of the following is a key performance indicator of the efficiency of the internal audit function?

  A. The number of audits completed
  B. The number of significant audit observations
  C. The percentage of recommendations implemented
  D. The number of training hours per auditor
  A. The number of audits completed

  ---

  Explanation

  Efficiency indicators measure how well resources are used to produce outputs. The number of audits completed reflects efficiency because it shows how effectively the internal audit function utilizes available resources to deliver its plan.

  Option B (observations) reflects risk exposure, not efficiency. Option C measures effectiveness (impact of audit work), not efficiency. Option D reflects investment in staff development, not operational efficiency.

  IIA Practice Guide - Measuring Internal Audit Effectiveness and Efficiency.

• Question 899:

  Which of the following roles would be least appropriate for the internal audit activity to undertake with regard to an organization's corporate social responsibility (CSR) program?

  A. Consult on project design and implementation of the CSR program.
  B. Serve as an advisor on internal controls related to CSR.
  C. Identify and prioritize the CSR issues that are important to the organization.
  D. Evaluate the effectiveness of the organization's CSR efforts.
  C. Identify and prioritize the CSR issues that are important to the organization.

  ---

  Explanation

• Question 900:

  Which of the following is a role of the board of directors in the governance process?

  A. Conduct periodic assessments of the organization's governance systems.
  B. Obtain assurance concerning the effectiveness of the organization's governance systems.
  C. Implement an effective system of internal controls to support the organization's governance systems.
  D. Review and approve operational goals and objectives.
  B. Obtain assurance concerning the effectiveness of the organization's governance systems.

  ---

  Explanation