I85PREP
⌘ K
ETiCPA ATQE Exam study materials
ETiCPA ATQE Exam study resources

ETiCPA ATQE Exam practice questions

One question at a time. Build your ETiCPA ATQE Exam understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1IT Governance and IT Risk Management

In IT governance, what is the primary purpose of separating the roles of IT strategy formulation and IT operations management?

  1. To ensure that operational pressures do not override strategic priorities and that accountability for each is clear Correct answer.
  2. To reduce the number of staff required to run the IT department
  3. To comply with the requirement that the CIO reports to the CFO
  4. To guarantee that all IT projects are delivered within budget

Explanation

Separating strategy from operations creates a governance structure where long-term direction setting is not dominated by day-to-day firefighting. It also assigns clear accountability for each function, which supports effective oversight and decision-making.

Question 2IT Governance and IT Risk Management

Which document typically defines the decision rights and accountability framework for IT in an organization?

  1. The IT governance charter Correct answer.
  2. The network topology diagram
  3. The disaster recovery plan
  4. The service level agreement

Explanation

An IT governance charter establishes who has decision rights, how IT decisions are made, and who is accountable. It is the foundational document for the governance system, unlike operational or technical artifacts.

Question 3IT Governance and IT Risk Management

A risk assessment identifies that a legacy payroll system has no vendor support and processes sensitive employee data. Which risk response is being applied when management decides to replace the system with a supported platform?

  1. Risk acceptance
  2. Risk mitigation Correct answer.
  3. Risk transfer
  4. Risk avoidance

Explanation

Replacing the unsupported system reduces the likelihood and impact of failure, which is mitigation. Avoidance would mean ceasing the payroll activity entirely, which is not the case here.

Question 4IT Governance and IT Risk Management

Which COBIT component describes the organizational structures, roles, and responsibilities that support IT governance?

  1. Culture, ethics, and behavior
  2. Processes
  3. Services, infrastructure, and applications
  4. Organizational structures Correct answer.

Explanation

COBIT defines governance and management enablers, and organizational structures is the enabler that covers roles, responsibilities, and reporting lines. Processes describe activity flows, while culture covers values and behaviors.

Question 5IT Governance and IT Risk Management

An organization classifies a data set as confidential and requires encryption both at rest and in transit. Which governance objective does this control most directly support?

  1. Integrity
  2. Non-repudiation
  3. Availability
  4. Confidentiality Correct answer.

Explanation

Encryption protects data from unauthorized disclosure, which is the definition of confidentiality. Availability concerns timely access, integrity concerns accuracy and completeness, and non-repudiation concerns proof of action.

Question 6IT Governance and IT Risk Management

A risk register entry shows a likelihood of 4 on a 5-point scale and an impact of 5 on a 5-point scale. Using a simple multiplication risk score, what is the risk exposure value?

  1. 1
  2. 45
  3. 9
  4. 20 Correct answer.

Explanation

The risk score is calculated as likelihood multiplied by impact, so 4 times 5 equals 20. This score is then used to rank the risk against others in the register.

Question 7IT Governance and IT Risk Management

Which statement best describes the difference between IT governance and IT management?

  1. Governance evaluates and directs IT; management plans, builds, and runs IT activities Correct answer.
  2. Governance applies only to public companies; management applies to all organizations
  3. Governance focuses on technology; management focuses on people
  4. Governance is performed only by external auditors; management is performed only by internal staff

Explanation

In frameworks such as COBIT, governance is concerned with evaluating stakeholder needs, setting direction, and monitoring performance. Management is concerned with executing the activities that plan, build, run, and monitor IT services.

Question 8IT Governance and IT Risk Management

An organization is adopting a risk appetite statement. Which characteristic makes the statement most useful for IT decision-making?

  1. It is approved by the IT service desk supervisor
  2. It lists every known risk in the organization
  3. It is kept confidential from business units
  4. It specifies quantitative thresholds and qualitative boundaries for acceptable risk Correct answer.

Explanation

A useful risk appetite statement translates tolerance into measurable thresholds and qualitative limits so that decisions can be tested against it. Broad or vague statements do not guide trade-offs between risk and return.

Question 9IT Governance and IT Risk Management

Which activity is a primary responsibility of an IT steering committee?

  1. Writing application source code
  2. Prioritizing IT investments and resolving conflicts between business units Correct answer.
  3. Configuring network switches and routers
  4. Approving individual user access requests

Explanation

IT steering committees provide direction and oversight for IT investments, priorities, and cross-functional issues. Technical configuration, access approval, and coding are operational tasks handled elsewhere.

Question 10IT Governance and IT Risk Management

A company discovers that a third-party cloud provider experienced a breach affecting the company's data. Which governance mechanism most directly clarifies the provider's obligations in this situation?

  1. The IT balanced scorecard
  2. The contract and related service level agreements Correct answer.
  3. The change management policy
  4. The internal audit charter

Explanation

Contracts and SLAs define the provider's responsibilities, including breach notification, remediation, and liability. They are the primary governance instrument for third-party obligations.

Question 11IT Governance and IT Risk Management

Which risk treatment option involves purchasing cyber insurance to cover potential financial losses from a data breach?

  1. Risk mitigation
  2. Risk transfer Correct answer.
  3. Risk avoidance
  4. Risk acceptance

Explanation

Insurance shifts the financial consequence of a risk to another party, which is risk transfer. The risk itself remains, but the organization's exposure to loss is reduced through the policy.

Question 12IT Governance and IT Risk Management

In a RACI matrix for an IT governance process, what does the 'A' designate?

  1. The person who must be consulted before a decision
  2. The person who performs the work
  3. The person who is informed after a decision
  4. The person who is accountable for the final decision or outcome Correct answer.

Explanation

RACI stands for Responsible, Accountable, Consulted, and Informed. The accountable party owns the final result and has the authority to approve it, while only one accountable person is typically assigned per activity.

Question 13IT Governance and IT Risk Management

An organization wants to benchmark its IT governance maturity against a recognized framework. Which approach provides a structured maturity model for IT processes?

  1. Adopting the ITIL service lifecycle as a maturity model
  2. Using the COBIT performance management guidance with capability levels Correct answer.
  3. Using the balanced scorecard as a maturity assessment
  4. Applying the ISO 27001 certification as a maturity score

Explanation

COBIT includes performance management guidance that rates processes on capability levels from 0 to 5. This provides a structured way to assess and benchmark governance maturity.

Question 14IT Governance and IT Risk Management

Which principle of IT governance emphasizes that IT decisions should be made at the lowest appropriate level while remaining aligned with enterprise objectives?

  1. Least privilege
  2. Segregation of duties
  3. Centralization
  4. Subsidiarity Correct answer.

Explanation

Subsidiarity holds that decisions should be taken as close as possible to the point of impact, provided they remain consistent with enterprise direction. This supports responsiveness while preserving alignment.

Question 15IT Governance and IT Risk Management

A risk heat map shows a cluster of risks in the high-likelihood, high-impact quadrant. What is the most appropriate governance response?

  1. Record the risks in the register and take no further action
  2. Assign the risks to the service desk for resolution
  3. Defer action until the next annual risk review
  4. Escalate the risks to executive management for prioritized treatment decisions Correct answer.

Explanation

Risks in the high-likelihood, high-impact quadrant exceed typical operational tolerance and require executive attention. Escalation enables decisions on treatment, ownership, and resource allocation.

Question 16IT Governance and IT Risk Management

Which element of an IT governance framework is most directly concerned with measuring whether IT is delivering value to the business?

  1. Performance measurement and reporting Correct answer.
  2. Service infrastructure
  3. Culture and behavior
  4. Organizational structures

Explanation

Performance measurement and reporting provide the metrics and reporting mechanisms that show whether IT outcomes align with business objectives. Structures, culture, and infrastructure are enablers rather than measurement mechanisms.

Question 17IT Governance and IT Risk Management

What is the main purpose of a control self-assessment in IT governance?

  1. To test the technical configuration of network devices
  2. To have process owners evaluate the effectiveness of their own controls Correct answer.
  3. To calculate the financial return on IT investments
  4. To replace external audits entirely

Explanation

Control self-assessment engages process owners in evaluating their controls, which increases ownership and can identify gaps earlier than periodic audits. It supplements rather than replaces independent audit.

Question 18IT Governance and IT Risk Management

An organization defines a key risk indicator (KRI) for the number of critical vulnerabilities remediated within the agreed service level. What does this KRI primarily measure?

  1. The financial cost of the security team
  2. The availability of the network
  3. The number of employees trained in security awareness
  4. The effectiveness of vulnerability management controls Correct answer.

Explanation

A KRI measures risk exposure or control effectiveness. Remediation timeliness for critical vulnerabilities indicates how well the vulnerability management control is working.

Question 19IT Governance and IT Risk Management

Which situation best illustrates a conflict of interest that segregation of duties is designed to prevent?

  1. A security analyst monitors logs while the security manager reviews reports
  2. A developer writes code and a separate tester validates it
  3. A project manager tracks schedule and a separate team tracks budget
  4. The same administrator can both create a new vendor record and approve payments to that vendor Correct answer.

Explanation

Segregation of duties prevents one person from controlling both the creation of a payee and the disbursement of funds, which would allow fraudulent payments. The other examples describe appropriate separation or unrelated duties.

Question 20IT Governance and IT Risk Management

In risk management, what does the term 'residual risk' refer to?

  1. The risk that exists before any controls are applied
  2. The risk that has been transferred to a third party
  3. The risk that remains after controls and treatments have been applied Correct answer.
  4. The risk that is outside the scope of the risk assessment

Explanation

Residual risk is the exposure remaining after mitigation and other treatments. It is compared with the risk appetite to determine whether further action is needed.

Question 21IT Governance and IT Risk Management

Which practice best supports the governance principle of transparency in IT decision-making?

  1. Documenting decision rationale and making it available to relevant stakeholders Correct answer.
  2. Delegating all decisions to external consultants
  3. Holding decision meetings without agendas or minutes
  4. Limiting decision records to the CIO's private files

Explanation

Transparency requires that decisions and their rationale be visible to those affected and to oversight bodies. Documentation and appropriate disclosure enable accountability and informed challenge.

Question 22IT Governance and IT Risk Management

A board asks for assurance that IT risks are being managed effectively. Which source provides the most independent evidence?

  1. Informal conversations with IT staff
  2. Internal audit reports on IT controls Correct answer.
  3. The IT department's self-reported status updates
  4. Vendor marketing materials

Explanation

Internal audit provides independent and objective assurance on the design and operating effectiveness of controls. Self-reported updates and informal sources lack independence and rigor.

Question 23IT Governance and IT Risk Management

Which factor most strongly influences the level of IT governance rigor appropriate for a small organization?

  1. The number of pages in its policy manual
  2. The brand of its network equipment
  3. The physical size of its data center
  4. The scale, complexity, and risk profile of its IT environment Correct answer.

Explanation

Governance should be proportionate to the organization's size, complexity, and risk exposure. Smaller or lower-risk environments can apply lighter-weight governance while still meeting core objectives.

Question 24IT Governance and IT Risk Management

What is the primary role of a risk owner in IT risk management?

  1. To conduct the external audit
  2. To approve the enterprise risk appetite
  3. To perform the technical remediation work personally
  4. To monitor the risk and ensure that appropriate responses are implemented Correct answer.

Explanation

A risk owner is accountable for managing a specific risk, including monitoring it and ensuring that agreed treatments are carried out. The owner may delegate remediation work but retains accountability.

Question 25IT Governance and IT Risk Management

An IT governance review finds that project approval decisions are made without documented criteria and vary by sponsor. Which governance weakness does this most directly indicate?

  1. Poor physical security controls
  2. Insufficient network capacity
  3. Inadequate software testing coverage
  4. Lack of consistent investment decision-making criteria Correct answer.

Explanation

Inconsistent project approvals without documented criteria point to a gap in investment decision governance. Establishing transparent criteria and decision rights would address the weakness.

Question 26IT Governance and IT Risk Management

An organization is defining its IT risk universe for the first time. Which approach best ensures the risk universe is complete and traceable to business objectives?

  1. Map risks to each business process and supporting IT asset, then validate the mapping with process owners Correct answer.
  2. Limit the universe to technical infrastructure risks managed by the IT operations team
  3. List only the risks raised in the most recent IT audit report
  4. Adopt the risk categories from a peer organization's register without modification

Explanation

A defensible risk universe is built from the value chain outward: business objectives drive processes, processes depend on IT assets and third parties, and each dependency yields risk candidates. Validating the mapping with process owners closes blind spots and assigns accountability early. Copying another organization's categories or restricting scope to infrastructure leaves enterprise-level and application risks unrepresented.

Question 27IT Governance and IT Risk Management

A governance committee wants IT investment decisions to be evaluated consistently. Which mechanism most directly institutionalizes that consistency?

  1. Delegating all investment approval to the IT operations manager
  2. A quarterly presentation on IT spending trends to the executive team
  3. Documented investment decision criteria and thresholds applied to every business case Correct answer.
  4. An annual employee survey on satisfaction with IT services

Explanation

Consistency comes from explicit criteria, thresholds, and a defined approval path that every proposal must satisfy, making decisions comparable and auditable. Trend reporting and satisfaction surveys inform oversight but do not constrain how individual investment choices are made. Delegating approval to a single operational role concentrates authority without criteria.

Question 28IT Governance and IT Risk Management

An IT risk assessment uses a 5-point impact scale, but the business impact thresholds were set for financial loss only. Operational outage, regulatory, and reputational impacts are being scored by intuition. Which improvement most strengthens the assessment?

  1. Increase the impact scale from 5 points to 10 points to allow finer differentiation
  2. Have the IT risk team assign all impact ratings to preserve scoring consistency
  3. Convert all impact scoring to a single financial figure by estimating outage cost per hour
  4. Define explicit impact criteria and thresholds for each impact dimension and calibrate them with business stakeholders Correct answer.

Explanation

Impact scales are only reliable when each dimension has defined thresholds that assessors can apply the same way, and business stakeholders must agree those thresholds because they own the consequences. Expanding the number of points without criteria adds false precision rather than accuracy. Centralizing scoring in the IT risk team improves consistency but removes the business context needed for non-financial impacts.

Question 29IT Governance and IT Risk Management

A risk owner reports that a key risk has been treated and the residual risk is now within appetite. Which evidence best supports accepting that conclusion in governance reporting?

  1. A reduction in the number of incidents reported by the affected business unit
  2. The risk owner's written confirmation that remediation activities are complete
  3. Post-treatment testing results showing the control operating effectively over a defined period, with residual rating recalculated Correct answer.
  4. Closure of the associated remediation project ticket in the workflow system

Explanation

Accepting a residual risk requires evidence that the treatment actually works, so operating-effectiveness testing over a period plus a recalculated residual rating is the strongest support. Completion statements and closed tickets show activity, not effect. Incident counts can fall for reasons unrelated to the control, such as detection gaps or changed business volume.

Question 30IT Governance and IT Risk Management

An enterprise risk framework requires that IT risks be aggregated with risks from other functions. IT and business units use different likelihood scales, different impact dimensions, and different rating definitions. Which action is the most defensible first step toward meaningful aggregation?

  1. Adopt a common enterprise rating methodology with defined scales and impact dimensions, and map existing IT ratings into it Correct answer.
  2. Average the IT and business unit ratings for each shared risk to produce a blended score
  3. Standardize on the IT methodology because IT risks are the most numerous in the register
  4. Report IT and business risks separately and aggregate only the counts of high-rated items

Explanation

Aggregation is only meaningful when ratings mean the same thing, so a shared methodology with defined scales and dimensions, plus a documented mapping from legacy ratings, is the sound first step. Averaging incompatible scores produces a number with no interpretable meaning. Counting high-rated items across different definitions still compares unlike things, and imposing the IT methodology ignores the business impact perspective the enterprise view requires.

Question 31IT General Controls and Control Frameworks

In an IT general controls review, which item is a preventive control over changes to a production ERP system?

  1. A monthly review of privileged access logs
  2. A weekly reconciliation of change tickets to deployments
  3. A mandatory code review and approval gate before deployment Correct answer.
  4. A post-incident root cause analysis report

Explanation

A preventive control stops an undesired event before it occurs, so an enforced approval gate that blocks deployment until review is complete qualifies. The other items detect or remediate problems after the fact, which places them in detective or corrective categories rather than preventive.

Question 32IT General Controls and Control Frameworks

Which statement best describes the role of COBIT within an IT governance programme?

  1. It prescribes the exact technical configuration baseline for each operating system.
  2. It certifies individual auditors in financial statement sampling techniques.
  3. It provides a framework of governance and management objectives for enterprise IT. Correct answer.
  4. It defines the statutory penalties for data protection breaches.

Explanation

COBIT is a governance framework that organises IT objectives, processes, and practices so management can direct and monitor enterprise IT. It is deliberately technology-neutral, so it does not set operating system baselines, certify auditors, or create legal penalties.

Question 33IT General Controls and Control Frameworks

An organisation separates the duties of initiating a vendor payment, approving it, and releasing it. Which IT general control objective does this segregation primarily support?

  1. Segregation of duties within business process controls Correct answer.
  2. Data backup retention
  3. Capacity management
  4. Network latency monitoring

Explanation

Segregation of duties ensures no single person can initiate, approve, and execute a transaction, reducing the risk of error or fraud. In ITGC terms this is a foundational control over the applications that process transactions, not an infrastructure performance or resilience control.

Question 34IT General Controls and Control Frameworks

What is the primary purpose of maintaining a configuration baseline for servers in scope for ITGC testing?

  1. To document user access requests for audit
  2. To reduce the number of servers that require patching
  3. To replace the need for change management approvals
  4. To provide a reference state against which deviations can be identified and remediated Correct answer.

Explanation

A configuration baseline records the approved settings for a system so that drift or unauthorised alteration can be detected and corrected. It supports change and configuration management but does not eliminate patching, approvals, or access documentation.

Question 35IT General Controls and Control Frameworks

Which document typically authorises a developer to move code into the production environment?

  1. A signed employment contract
  2. An approved change request with testing evidence Correct answer.
  3. A disaster recovery test plan
  4. A service level agreement

Explanation

Production migration should be tied to an approved change record that evidences testing and authorisation by someone other than the developer. Employment contracts, DR plans, and SLAs do not grant per-change authorisation.

Question 36IT General Controls and Control Frameworks

An auditor finds that terminated employees retain active directory accounts for up to 30 days. Which control area is most directly deficient?

  1. Logical access management Correct answer.
  2. Capacity planning
  3. Incident classification
  4. Physical security of the data centre

Explanation

Timely removal of access when employment ends is a core logical access control, usually executed through joiner-mover-leaver provisioning. The finding concerns user entitlements, not physical entry, capacity, or incident handling.

Question 37IT General Controls and Control Frameworks

Which of the following is an example of an IT general control rather than an automated business process control?

  1. A duplicate payment detection rule
  2. A credit limit validation at order entry
  3. A three-way match check on purchase invoices
  4. A periodic review of database administrator accounts Correct answer.

Explanation

IT general controls apply across the technology environment, such as controlling privileged access to databases. The other options are automated business rules embedded in a specific application process.

Question 38IT General Controls and Control Frameworks

What distinguishes a key control from a secondary control in an ITGC framework?

  1. A key control is always automated, while a secondary control is always manual.
  2. A key control is owned by internal audit, while a secondary control is owned by operations.
  3. A key control is relied upon to reduce risk to an acceptable level, while a secondary control provides supporting assurance. Correct answer.
  4. A key control is tested annually, while a secondary control is never tested.

Explanation

Key controls are those management and auditors rely on to mitigate a significant risk, so they receive the most rigorous testing. Secondary or compensating controls add assurance but are not the primary basis for the risk conclusion, and either type may be manual or automated.

Question 39IT General Controls and Control Frameworks

A company's change management policy requires testing in a pre-production environment, but emergency changes bypass testing. How should the auditor evaluate this design?

  1. Assess whether emergency changes require documented retrospective approval and review, and test a sample of them. Correct answer.
  2. Conclude the control is ineffective because any bypass exists.
  3. Accept it, because emergency changes are inherently untestable.
  4. Ignore emergency changes because they are outside the standard population.

Explanation

Emergency change procedures are acceptable when they include compensating steps such as documented post-implementation review and approval by an authorised person. The auditor should evaluate those safeguards and test a sample of emergency changes rather than accepting or rejecting the design outright.

Question 40IT General Controls and Control Frameworks

During testing, an auditor finds 3 of 40 sampled user access reviews were not performed. What is the most appropriate conclusion?

  1. The sample should be discarded and replaced with a larger one until no exceptions appear.
  2. The deviation should be evaluated against the tolerable rate and may indicate the control cannot be relied upon. Correct answer.
  3. The finding should be reported only if a security breach has occurred.
  4. The control is operating effectively because the deviation rate is below 10 percent.

Explanation

Exceptions in an ITGC sample are evaluated against the tolerable deviation rate and the significance of the control. A 7.5 percent deviation in a key control often means reliance cannot be placed on it, triggering expanded testing or a deficiency conclusion.

Question 41IT General Controls and Control Frameworks

An organisation uses a third-party SaaS provider for payroll. Which control is most important for the customer to perform?

  1. Performing a full penetration test of the provider's infrastructure
  2. Reviewing the provider's independent assurance report and complementary user entity controls Correct answer.
  3. Setting the provider's internal password policy
  4. Auditing the provider's source code repository

Explanation

Customers rely on independent assurance reports such as SOC reports and must confirm that complementary user entity controls assigned to them are implemented. Customers generally cannot penetrate, audit source code, or set internal policy at the provider.

Question 42IT General Controls and Control Frameworks

Which evidence provides the strongest support that a batch job completed successfully and completely?

  1. A screenshot of the job status page taken by an operator
  2. The job's presence in the production schedule
  3. Automated job scheduler logs with record counts reconciled to source totals Correct answer.
  4. A developer's email confirming the job ran

Explanation

System-generated scheduler logs combined with reconciliation of processed record counts to source totals provide independent evidence of both execution and completeness. Informal confirmations, screenshots, and schedule listings do not demonstrate that all records were processed.

Question 43IT General Controls and Control Frameworks

An IT steering committee meets quarterly but has no documented charter, decision log, or escalation path. Which governance weakness does this most directly represent?

  1. Inadequate backup restoration testing
  2. Weak physical access logging
  3. Insufficient IT organisational structure and accountability Correct answer.
  4. Poor data quality in the master data domain

Explanation

A governance body without a charter, decision record, or escalation route lacks defined authority and accountability, which is an organisational structure weakness in IT governance. The other options concern operational or data controls rather than the committee's mandate.

Question 44IT General Controls and Control Frameworks

A database administrator has the ability to both modify production data and change audit logging settings. What is the primary risk?

  1. Incompatibility between database versions
  2. Increased storage consumption from log files
  3. The ability to conceal unauthorised changes by disabling or altering audit trails Correct answer.
  4. Slower query performance during peak hours

Explanation

Combining the power to change data with the power to alter logging allows an individual to erase evidence of their actions, defeating the detective value of the logs. This is a classic segregation of duties conflict requiring log integrity controls or separation of roles.

Question 45IT General Controls and Control Frameworks

Which approach best tests the operating effectiveness of an automated three-way match control in an ERP system?

  1. Inspect the configuration and re-perform the matching logic on a sample of transactions Correct answer.
  2. Interview the developer who wrote the matching routine
  3. Rely on the prior year's test results without update
  4. Walk through one transaction with the accounts payable manager

Explanation

For an automated control, the auditor confirms the configuration is as described and then re-performs or independently tests the logic against a sample of transactions. A single walkthrough, prior-year reliance without reassessment, or a developer interview alone does not evidence consistent operation.

Question 46IT General Controls and Control Frameworks

What is the main control purpose of maintaining separate development, test, and production environments?

  1. To prevent untested or unauthorised code from reaching production data and users Correct answer.
  2. To simplify the disaster recovery plan
  3. To eliminate the need for user acceptance testing
  4. To reduce software licence costs across the estate

Explanation

Environment separation restricts developers from directly altering production and ensures code passes through controlled testing and approval. It supports change management integrity rather than cost reduction, recovery planning, or removing acceptance testing.

Question 47IT General Controls and Control Frameworks

An auditor is mapping ITGCs to a financial audit. Why must general controls be assessed before relying on automated application controls?

  1. Application controls are always manual and require no system integrity.
  2. General controls eliminate the need to test any application controls.
  3. Application controls only apply to non-financial systems.
  4. General controls protect the consistent operation of the systems on which application controls depend. Correct answer.

Explanation

Automated application controls operate within systems whose integrity depends on change management, access control, and operations controls. If those general controls are unreliable, the continued functioning of the application control cannot be assumed, so reliance is undermined.

Question 48IT General Controls and Control Frameworks

Which metric best indicates whether the patch management control is operating effectively over time?

  1. Count of change requests raised per quarter
  2. Total number of servers in the estate
  3. Number of patch exceptions approved and the ageing of unpatched critical vulnerabilities Correct answer.
  4. Average helpdesk ticket resolution time

Explanation

Patch effectiveness is demonstrated by how quickly critical vulnerabilities are remediated and whether exceptions are formally approved and tracked. Estate size, helpdesk timeliness, and change volume do not show whether patching actually occurred within policy.

Question 49IT General Controls and Control Frameworks

A company relies on a SOC 1 Type II report for an outsourced service. What does the report's period and scope require the auditor to consider?

  1. Whether the report period covers the entire period of reliance and whether complementary user entity controls are implemented Correct answer.
  2. Whether the service provider's share price has been stable
  3. Whether the provider uses the same ERP vendor as the customer
  4. Whether the report was issued in the customer's local language

Explanation

A SOC report provides assurance only for the period and systems it covers, so the auditor must confirm coverage of the reliance period and that user entity controls assigned in the report are in place. Commercial, vendor, and language factors do not affect the sufficiency of the evidence.

Question 50IT General Controls and Control Frameworks

Which control best mitigates the risk of unauthorised direct data changes in a production database?

  1. Increasing the frequency of full database backups
  2. Removing database audit logs to improve performance
  3. Restricting direct production access to a small group and requiring changes to go through application interfaces with logging Correct answer.
  4. Granting read-only access to all developers

Explanation

Limiting direct access and routing changes through controlled, logged interfaces reduces the chance of unapproved data manipulation. Backups support recovery but not prevention, broad read access expands exposure, and removing logs destroys detective evidence.