I85PREP
⌘ K
III IC-90 study materials
III IC-90 study resources

III IC-90 practice questions

One question at a time. Build your III IC-90 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Unverified - official IC-90 syllabus not available from source

A candidate is preparing for the III IC-90 examination. Which statement best describes how the syllabus for an unverified exam code should be handled during study planning?

  1. Rely solely on third-party summaries of the exam blueprint.
  2. Treat the domain list as provisional and confirm each topic against the exam provider's current materials. Correct answer.
  3. Study only the domains explicitly listed in an official published syllabus.
  4. Assume the domain list is final and identical across all exam administrations.

Explanation

When an exam code cannot be verified against an official syllabus, the domain list must be treated as provisional rather than authoritative. The candidate should cross-check every topic against the exam provider's current published materials before committing study time. Assuming finality or relying on third-party summaries risks studying content that is not actually tested.

Question 2Unverified - official IC-90 syllabus not available from source

During IC-90 preparation, a candidate finds two study sources that describe the same domain differently. What is the most defensible next step?

  1. Prioritize the source that cites the exam provider directly and note the conflict for review. Correct answer.
  2. Choose the source with the longer explanation.
  3. Merge both descriptions into one combined list.
  4. Discard both sources and skip that domain.

Explanation

Conflicting descriptions should be resolved by source authority, not by length or by merging. A source citing the exam provider directly carries more weight than an unattributed summary. Recording the conflict keeps the gap visible so it can be revisited rather than silently ignored.

Question 3Unverified - official IC-90 syllabus not available from source

Which practice best supports retention when studying a provisional IC-90 domain list over several weeks?

  1. Highlighting every line of the source material.
  2. Rereading the same summary document each day.
  3. Spaced retrieval practice with periodic self-testing. Correct answer.
  4. Reading the material once at high speed.

Explanation

Spaced retrieval practice, where the learner recalls material at increasing intervals, consistently outperforms passive review for long-term retention. Rereading and highlighting create familiarity without testing recall. A single fast reading provides no consolidation over weeks.

Question 4Unverified - official IC-90 syllabus not available from source

A candidate wants to build a personal question bank for an unverified IC-90 domain. Which approach avoids copyright problems while still being useful?

  1. Paraphrase commercial questions closely enough to preserve their structure.
  2. Copy questions verbatim from a commercial bank and relabel them.
  3. Write original questions from primary technical references and cite the reference. Correct answer.
  4. Reuse a colleague's purchased question set without modification.

Explanation

Original questions written from primary technical references avoid reproducing protected content while still testing the same underlying knowledge. Verbatim copying, close paraphrasing, and unmodified reuse all reproduce someone else's work. Citing the primary reference also makes the question easier to verify later.

Question 5Unverified - official IC-90 syllabus not available from source

When a candidate cannot confirm a technical fact for an IC-90 topic, what should happen to that item in a study set?

  1. Publish it with a confident tone so it is not questioned.
  2. Replace the fact with a plausible-sounding approximation.
  3. Mark it for review and leave the fact unresolved until verified. Correct answer.
  4. Remove the topic from the study plan permanently.

Explanation

Unverified facts should be flagged rather than asserted, so the learner does not internalize errors. Marking for review preserves the item while signaling that it needs a primary source. Approximating a fact defeats the purpose of accurate study material.

Question 6Unverified - official IC-90 syllabus not available from source

A study plan allocates time across IC-90 domains of unknown weight. Which allocation strategy is most robust to the uncertainty?

  1. Spend all time on the single domain the candidate finds hardest.
  2. Distribute time evenly and ignore relative difficulty.
  3. Study only domains with abundant free online material.
  4. Weight time by estimated exam emphasis and adjust as evidence arrives. Correct answer.

Explanation

Weighting by estimated emphasis and revising as evidence arrives keeps the plan responsive to new information about the blueprint. Even distribution ignores real differences in coverage, while concentrating on one domain leaves others uncovered. Availability of free material is a poor proxy for exam importance.

Question 7Unverified - official IC-90 syllabus not available from source

Which artifact most directly demonstrates that a candidate has covered an IC-90 domain systematically?

  1. A screenshot of the exam registration confirmation.
  2. A checklist mapping each sub-topic to a source and a self-test date. Correct answer.
  3. A count of total hours spent reading.
  4. A list of bookmarks saved in a browser folder.

Explanation

A checklist tying each sub-topic to a source and a self-test date shows both coverage and verification. Registration confirmations and bookmarks do not evidence learning. Hours spent reading measure effort, not systematic coverage.

Question 8Unverified - official IC-90 syllabus not available from source

A candidate reads that an IC-90 domain covers 'data integrity controls'. Which study action best converts that broad label into testable knowledge?

  1. Search for the label in unrelated forums.
  2. Assume the label refers only to encryption.
  3. Break the label into specific control types and learn how each is applied. Correct answer.
  4. Memorize the label exactly as written.

Explanation

Broad domain labels must be decomposed into concrete sub-topics before they can be studied or tested. Breaking 'data integrity controls' into specific control types and their applications produces examinable knowledge. Memorizing the label alone yields no usable understanding.

Question 9Unverified - official IC-90 syllabus not available from source

When constructing original practice items for an unverified IC-90 domain, which quality check matters most for a single-answer item?

  1. Including 'all of the above' as a distractor.
  2. Confirming that exactly one option is defensible and the others are clearly wrong. Correct answer.
  3. Using negative stems to increase difficulty.
  4. Ensuring the correct option is the longest to signal importance.

Explanation

A single-answer item is only valid if exactly one option can be defended and each distractor is clearly incorrect. Making the key the longest leaks the answer through formatting. Negative stems and 'all of the above' introduce ambiguity rather than measuring knowledge.

Question 10Unverified - official IC-90 syllabus not available from source

A candidate builds a spaced-review schedule for IC-90 topics. Which interval pattern best reflects spacing principles?

  1. Review every topic daily for the entire study period.
  2. Review at increasing intervals, shortening intervals for weak topics. Correct answer.
  3. Review only the topics already mastered.
  4. Review each topic once and never revisit it.

Explanation

Spacing works best when intervals expand as memory strengthens, with shorter intervals reserved for weaker material. Daily review of everything wastes time on well-known topics. Single-pass review and reviewing only mastered topics both neglect retention of weaker areas.

Question 11Unverified - official IC-90 syllabus not available from source

Which statement about the reliability of an unverified domain list for IC-90 is most accurate?

  1. An unverified list becomes verified once a candidate studies it.
  2. An unverified list can guide planning if its claims are treated as hypotheses to confirm. Correct answer.
  3. An unverified list cannot be used at all for planning.
  4. An unverified list is reliable if it appears on several websites.

Explanation

An unverified list still has planning value when each claim is treated as a hypothesis to be confirmed against authoritative sources. It is not useless, but it is also not self-verifying. Repetition across websites reflects copying, not independent confirmation.

Question 12Unverified - official IC-90 syllabus not available from source

A candidate notices that a practice item for an IC-90 topic has two options that both seem correct. What is the proper response?

  1. Delete the explanation and keep the item.
  2. Rewrite the item so exactly one option is defensible. Correct answer.
  3. Mark the item as easy to reduce its weight.
  4. Keep the item and accept either answer.

Explanation

An item with two defensible options cannot discriminate between prepared and unprepared candidates, so it must be rewritten. Accepting either answer removes the measurement value. Deleting the explanation or relabeling difficulty does not fix the underlying ambiguity.

Question 13Unverified - official IC-90 syllabus not available from source

Which activity most directly tests whether a candidate can apply IC-90 domain knowledge rather than merely recognize it?

  1. Copying a diagram into notes.
  2. Reading a definition and nodding along.
  3. Solving a short scenario that requires choosing and justifying a control. Correct answer.
  4. Recalling a term from a list of four options.

Explanation

Application is demonstrated when a candidate uses knowledge to resolve a scenario and can justify the choice. Recognition from four options tests recall, not application. Reading and copying are passive activities that do not require decisions.

Question 14Unverified - official IC-90 syllabus not available from source

A candidate is deciding whether to trust a blog post about an IC-90 domain. Which feature most increases the post's credibility?

  1. It uses confident language throughout.
  2. It was published recently and has many shares.
  3. It includes a long personal study narrative.
  4. It cites the exam provider's official documentation for its claims. Correct answer.

Explanation

Credibility rises when claims are traceable to the exam provider's official documentation. Recency and share counts measure popularity, not accuracy. Confident language and personal narratives are not evidence of correctness.

Question 15Unverified - official IC-90 syllabus not available from source

Which practice best prevents a candidate from overestimating readiness for an unverified IC-90 exam?

  1. Using timed, closed-book practice that samples all domains. Correct answer.
  2. Counting the number of pages reviewed.
  3. Studying only the domains the candidate enjoys.
  4. Relying on the feeling of familiarity after rereading notes.

Explanation

Timed, closed-book practice that samples all domains exposes gaps that familiarity hides. The feeling of familiarity after rereading is a well-known illusion of competence. Enjoyment-based selection and page counts do not measure readiness.

Question 16Unverified - official IC-90 syllabus not available from source

A candidate wants to record progress across provisional IC-90 domains. Which record is most useful for later revision?

  1. A single overall percentage of completion.
  2. A folder of downloaded PDFs.
  3. A list of study session durations only.
  4. A per-topic log of source used, confidence level, and last review date. Correct answer.

Explanation

A per-topic log capturing source, confidence, and last review date supports targeted revision and spaced scheduling. A single percentage hides which topics are weak. Session durations and downloaded files do not record what was actually learned.

Question 17Unverified - official IC-90 syllabus not available from source

Which reasoning best justifies treating an unverified IC-90 domain list as a starting framework rather than a final blueprint?

  1. Because final blueprints are never published.
  2. Because frameworks are easier to memorize than blueprints.
  3. Because a framework organizes study while allowing correction as authoritative information appears. Correct answer.
  4. Because unverified lists are always wrong.

Explanation

A provisional framework gives structure to study while remaining open to correction when authoritative information becomes available. Claiming such lists are always wrong overstates the case. Ease of memorization and claims about publication are not the reason.

Question 18Unverified - official IC-90 syllabus not available from source

A candidate has limited time before an IC-90 exam with an unverified blueprint. Which triage rule is most defensible?

  1. Prioritize topics supported by authoritative sources and flag the rest for lighter review. Correct answer.
  2. Study every topic to the same depth regardless of evidence.
  3. Study only topics that appear in practice questions.
  4. Skip all topics mentioned in only one source.

Explanation

Prioritizing topics with authoritative support concentrates effort where accuracy is highest, while flagging the rest preserves awareness of uncertainty. Equal depth ignores evidence quality. Skipping single-source topics and studying only practiced topics both risk missing examinable material.

Question 19Unverified - official IC-90 syllabus not available from source

When writing an explanation for an original IC-90 practice item, which approach best supports learning?

  1. State the governing rule and why each distractor fails. Correct answer.
  2. List several unrelated facts about the topic.
  3. State only which option is correct.
  4. Repeat the question stem in different words.

Explanation

An effective explanation states the rule that determines the answer and then shows why each distractor is wrong, which teaches transferable reasoning. Naming only the correct option gives no reasoning. Restating the stem or listing unrelated facts adds length without insight.

Question 20Unverified - official IC-90 syllabus not available from source

A candidate finds an IC-90 topic described only in secondary sources that disagree. Which conclusion is best supported?

  1. The topic is definitely not on the exam.
  2. The most recent secondary source must be correct.
  3. The topic's exact scope is uncertain and should be verified before heavy investment. Correct answer.
  4. The topic should be studied from memory of the disagreement.

Explanation

Disagreement among secondary sources signals uncertainty about scope, which warrants verification before large time investment. Disagreement does not prove the topic is absent from the exam. Recency alone does not establish correctness, and memorizing a dispute is not studying the topic.

Question 21Unverified - official IC-90 syllabus not available from source

Which scenario best illustrates the risk of relying on an unverified IC-90 domain list without cross-checking?

  1. A candidate writes original practice questions.
  2. A candidate spends weeks on a sub-topic that turns out to be outside the tested scope. Correct answer.
  3. A candidate reviews a topic twice in one week.
  4. A candidate uses a timer during practice.

Explanation

The central risk of an unverified list is misallocated effort on material that is not tested. Reviewing twice, timing practice, and writing original questions are all reasonable study behaviors. Only the first scenario shows wasted effort caused by an unverified scope.

Question 22Unverified - official IC-90 syllabus not available from source

Which statement about the term 'IC-90' as used in this study context is most accurate?

  1. It refers to an exam whose official syllabus could not be verified from the available source. Correct answer.
  2. It is a synonym for a general data-integrity standard.
  3. It is an officially confirmed certification title with a published syllabus.
  4. It is a vendor product name unrelated to certification.

Explanation

In this context IC-90 designates an exam whose official syllabus could not be verified from the available source, so the domain list is provisional. It is not a confirmed certification title with a published syllabus. It is also not a generic standard name or an unrelated product.

Question 23Unverified - official IC-90 syllabus not available from source

A candidate wants to confirm whether a specific control is within IC-90 scope. Which action is most appropriate?

  1. Ask a study group to vote on it.
  2. Include it only if it is difficult to learn.
  3. Check the exam provider's current documentation for the domain description. Correct answer.
  4. Assume any control mentioned online is in scope.

Explanation

Scope should be confirmed against the exam provider's current documentation, which is the authoritative source. Online mentions, group votes, and difficulty are not evidence of scope. Group consensus can be confidently wrong when no one has checked the source.

Question 24Unverified - official IC-90 syllabus not available from source

Which note-taking structure best supports later verification of IC-90 study claims?

  1. A list of topics ranked by personal interest.
  2. A folder of screenshots with no labels.
  3. A table with columns for claim, source, date checked, and confidence. Correct answer.
  4. A single running paragraph of mixed observations.

Explanation

A structured table recording claim, source, date, and confidence makes each assertion traceable and revisitable. A running paragraph mixes claims without attribution. Unlabeled screenshots and interest rankings do not support verification.

Question 25Unverified - official IC-90 syllabus not available from source

A candidate must choose between two study resources for an unverified IC-90 domain. One is comprehensive but unattributed; the other is narrower but cites official documentation. Which choice is better justified?

  1. The narrower resource, because traceable sourcing supports verification and correction. Correct answer.
  2. Neither resource, because the domain is unverified.
  3. The comprehensive resource, because breadth always wins.
  4. Either resource, because sourcing does not affect accuracy.

Explanation

Traceable sourcing lets the candidate verify claims and correct errors, which matters more when the domain itself is uncertain. Breadth without attribution cannot be checked. Sourcing directly affects accuracy, and refusing both resources leaves the domain unprepared.

Question 26Unverified - official IC-90 syllabus not available from source

A candidate studying for IC-90 encounters the term 'control objective'. Which definition best matches how the term is used in governance and compliance contexts?

  1. A statement of the desired outcome a control is designed to achieve Correct answer.
  2. The budget line assigned to a compliance program
  3. A list of software tools approved for use by the IT department
  4. The person accountable for signing off on an audit report

Explanation

A control objective expresses the outcome or condition the organization wants to achieve, such as preventing unauthorized changes. Individual controls are then designed and tested to demonstrate that the objective is met. Confusing the objective with a tool, a budget, or a signatory role misreads the term.

Question 27Unverified - official IC-90 syllabus not available from source

An IC-90 candidate is asked to distinguish 'preventive' from 'detective' controls. Which pairing is correct?

  1. Preventive stops an event before it occurs; detective identifies it after it occurs Correct answer.
  2. Preventive applies only to physical assets; detective applies only to data
  3. Preventive is automated; detective is always manual
  4. Preventive identifies events after the fact; detective stops them in advance

Explanation

Control classification by timing is standard: preventive controls act before an unwanted event (for example, access restrictions), while detective controls identify events that have already happened (for example, log monitoring). The distinction concerns timing, not asset type or degree of automation.

Question 28Unverified - official IC-90 syllabus not available from source

A candidate reads that a control is 'operating effectively'. What does this most directly mean in a compliance assessment?

  1. The control is documented in the policy library
  2. The control was designed by an external auditor
  3. The control has been approved by the board of directors
  4. The control is producing the intended result consistently over the review period Correct answer.

Explanation

Operating effectiveness concerns whether a control actually worked as intended throughout the period, evidenced by testing of its operation. Documentation, authorship, and approval speak to design or governance, not to whether the control performed reliably in practice.

Question 29Unverified - official IC-90 syllabus not available from source

Which item is best described as 'evidence' in a compliance review?

  1. The auditor's personal opinion of management's attitude
  2. The regulation text that the organization must follow
  3. A screenshot of a system configuration taken during the review period Correct answer.
  4. A verbal assurance from a colleague that a task was completed

Explanation

Evidence is verifiable information that supports a conclusion about a control, such as a timestamped configuration screenshot. Opinions, the source regulation, and unsupported verbal assurances do not by themselves substantiate whether a control operated.

Question 30Unverified - official IC-90 syllabus not available from source

A candidate must classify a periodic user-access recertification as a control. Which classification fits best?

  1. A preventive control that blocks new accounts
  2. A compensating control that replaces authentication
  3. A detective control that identifies inappropriate access after the fact Correct answer.
  4. A physical control that secures server rooms

Explanation

Recertification reviews existing access and flags entitlements that should be removed, so it detects problems rather than blocking access at the point of entry. It is a logical, not physical, control and does not replace authentication.

Question 31Unverified - official IC-90 syllabus not available from source

An organization applies a control that is not the primary safeguard but reduces risk because the primary control is impractical. Which term describes this control?

  1. Corrective control
  2. Compensating control Correct answer.
  3. Detective control
  4. Directive control

Explanation

A compensating control provides an alternative safeguard when the primary control cannot be implemented feasibly, aiming to achieve a similar risk reduction. Detective, directive, and corrective describe the control's function or timing, not its role as a substitute.

Question 32Unverified - official IC-90 syllabus not available from source

A candidate is told a control has a 'design gap'. Which situation best illustrates this?

  1. The control was designed correctly but staff skipped the procedure twice last quarter
  2. The control's documentation was updated after the review period
  3. The control as designed cannot address the identified risk even when performed exactly as written Correct answer.
  4. The control owner left the organization during the year

Explanation

A design gap exists when the control, even if performed perfectly, would not adequately mitigate the risk it targets. Skipped procedures indicate an operating deficiency, while documentation timing and staffing changes are contextual issues rather than design flaws.

Question 33Unverified - official IC-90 syllabus not available from source

Which statement best describes the purpose of a risk assessment within a compliance program?

  1. It replaces the need for internal audit testing
  2. It guarantees that no compliance failures will occur
  3. It identifies and prioritizes risks so controls can be targeted appropriately Correct answer.
  4. It documents employee training completion

Explanation

Risk assessment identifies, evaluates, and ranks risks so that limited control resources are directed where they matter most. It informs control selection rather than guaranteeing outcomes, replacing testing, or recording training.

Question 34Unverified - official IC-90 syllabus not available from source

A candidate must decide whether a finding is 'material'. Which factor is most relevant to that judgment?

  1. The potential effect of the issue on the organization's objectives or compliance status Correct answer.
  2. The date the issue was first mentioned in a meeting
  3. The seniority of the person who discovered the issue
  4. The number of pages in the audit report

Explanation

Materiality concerns significance: whether an issue could meaningfully affect objectives, obligations, or reported status. Report length, discoverer seniority, and meeting dates are incidental details that do not determine significance.

Question 35Unverified - official IC-90 syllabus not available from source

A candidate is asked to define 'segregation of duties'. Which description is most accurate?

  1. Rotating staff between departments on a fixed schedule
  2. Dividing tasks so that no single person controls all stages of a sensitive process Correct answer.
  3. Encrypting all data at rest and in transit
  4. Requiring two people to share a single login credential

Explanation

Segregation of duties splits incompatible responsibilities, such as initiating and approving a payment, so that one individual cannot complete a sensitive process alone. Sharing credentials, job rotation, and encryption are distinct practices that do not define the concept.

Question 36Unverified - official IC-90 syllabus not available from source

An auditor samples 40 transactions and finds 3 that lack required approval. Which conclusion is most defensible from this sample alone?

  1. The control should be removed because it does not work
  2. The finding is immaterial because only 3 items failed
  3. The control is perfectly effective because most transactions were approved
  4. The control shows exceptions that warrant further investigation and possible deficiency classification Correct answer.

Explanation

Sampled exceptions indicate the control did not operate as intended for those items, so the auditor investigates causes, extent, and impact before classifying a deficiency. Claiming perfection ignores the failures, and removing the control or declaring immateriality are premature conclusions.

Question 37Unverified - official IC-90 syllabus not available from source

Which activity best demonstrates 'due professional care' by a compliance reviewer?

  1. Applying appropriate testing standards and documenting the basis for conclusions Correct answer.
  2. Relying solely on management's verbal representations
  3. Completing the review as quickly as possible to save cost
  4. Accepting prior-year conclusions without re-testing

Explanation

Due professional care means applying the relevant standards, gathering sufficient evidence, and documenting the reasoning behind conclusions. Relying only on verbal representations, rushing, or carrying forward prior conclusions without testing falls short of that standard.

Question 38Unverified - official IC-90 syllabus not available from source

A candidate encounters a 'key control'. What distinguishes a key control from other controls?

  1. It is a control owned by the finance department
  2. It is the control most recently implemented
  3. It is the cheapest control to operate
  4. It is essential to reducing a significant risk to an acceptable level Correct answer.

Explanation

Key controls are those relied upon to mitigate significant risks; if they fail, the risk exposure becomes unacceptable. Cost, recency, and departmental ownership are not the defining criteria.

Question 39Unverified - official IC-90 syllabus not available from source

An organization cannot implement a required technical safeguard and instead documents an alternative that achieves comparable protection. Which documentation element is most important to justify this approach?

  1. A list of the vendors considered for the original safeguard
  2. The date the requirement was first published
  3. The names of staff who attended training
  4. A statement of the residual risk and rationale for the alternative Correct answer.

Explanation

When substituting an alternative control, the organization must explain why the original is infeasible and demonstrate that residual risk remains acceptable. Vendor lists, training attendance, and publication dates do not establish the adequacy of the substitute.

Question 40Unverified - official IC-90 syllabus not available from source

A candidate reviews a process where the same person can create a vendor, approve an invoice, and release payment. Which risk is most directly created?

  1. Inaccurate network capacity planning
  2. Excessive data retention
  3. Unauthorized or fraudulent payments Correct answer.
  4. Insufficient backup frequency

Explanation

Combining vendor setup, invoice approval, and payment release removes the checks that prevent and detect fraudulent disbursements, so the dominant risk is unauthorized payment. Data retention, capacity planning, and backup frequency are unrelated to this duty combination.

Question 41Unverified - official IC-90 syllabus not available from source

Which statement best characterizes the relationship between a policy and a procedure?

  1. A policy applies only to executives, while a procedure applies only to auditors
  2. A policy states required intent, while a procedure describes how the requirement is carried out Correct answer.
  3. They are identical documents with different titles
  4. A procedure states required intent, while a policy lists the steps

Explanation

Policies set the mandatory intent or rules, and procedures translate those rules into step-by-step instructions for execution. They are distinct document types, and neither is restricted by role in the way described.

Question 42Unverified - official IC-90 syllabus not available from source

A candidate is asked which element most strengthens the reliability of a compliance conclusion. Which choice fits best?

  1. A conclusion reached after reviewing only management's summary
  2. A conclusion supported by a single informal conversation
  3. A conclusion based on the reviewer's prior experience alone
  4. Evidence gathered independently and corroborated across sources Correct answer.

Explanation

Conclusions are more reliable when supported by independent evidence corroborated from multiple sources, reducing reliance on any single representation. Informal conversation, personal experience alone, and management summaries provide weaker, less verifiable support.

Question 43Unverified - official IC-90 syllabus not available from source

A candidate must define 'residual risk'. Which description is correct?

  1. The risk remaining after controls have been implemented Correct answer.
  2. The risk that auditors will disagree with management
  3. The risk that exists before any controls are applied
  4. The risk that a control will be documented incorrectly

Explanation

Residual risk is what remains after controls have been applied, in contrast to inherent risk, which exists before controls. Documentation error and auditor disagreement are not definitions of residual risk.

Question 44Unverified - official IC-90 syllabus not available from source

A candidate is told that a control is 'manual and judgment-based'. Which testing approach is most appropriate?

  1. Test only the system configuration that supports the tool
  2. Interview the performer and inspect a sample of completed instances for consistency Correct answer.
  3. Assume effectiveness because no automated alerts were raised
  4. Rely entirely on automated log analysis with no human review

Explanation

Manual, judgment-based controls require evidence of how people applied the judgment, so interviewing the performer and inspecting completed instances tests consistency. Automated-only methods, absence of alerts, or configuration testing alone cannot demonstrate that human judgment was applied correctly.

Question 45Unverified - official IC-90 syllabus not available from source

Which item is a 'corrective' control?

  1. A log review performed each morning
  2. A firewall rule that blocks unauthorized traffic
  3. A backup restoration process used after data loss Correct answer.
  4. A policy requiring annual training

Explanation

Corrective controls restore normal operations after an event, and backup restoration fits that role. Firewall blocking is preventive, training policy is directive, and log review is detective.

Question 46Unverified - official IC-90 syllabus not available from source

A candidate must explain why 'management override' is a persistent concern in control environments. Which explanation is most accurate?

  1. It applies only to entry-level staff
  2. It eliminates the need for documentation
  3. It allows individuals with authority to bypass controls that would otherwise apply to them Correct answer.
  4. It automatically improves the effectiveness of detective controls

Explanation

Management override occurs when senior individuals use their authority to circumvent established controls, which can defeat otherwise sound processes. It does not remove documentation needs, improve detection, or apply only to junior staff.

Question 47Unverified - official IC-90 syllabus not available from source

Which statement best describes a 'walkthrough' in a compliance review?

  1. A review of the organization's marketing materials
  2. A survey sent to all employees about training
  3. A statistical sample of all transactions in the period
  4. Tracing a single transaction or process end to end to confirm understanding of the flow Correct answer.

Explanation

A walkthrough follows one instance of a process from start to finish to confirm that the documented flow matches reality and to identify where controls sit. It is not a statistical sample, an employee survey, or a marketing review.

Question 48Unverified - official IC-90 syllabus not available from source

A candidate finds that a control operated correctly during testing but the underlying policy no longer reflects current practice. Which conclusion is most appropriate?

  1. The control must be redesigned from scratch
  2. The policy should be deleted without replacement
  3. The control may be effective, but the policy requires updating to align with practice Correct answer.
  4. The control is deficient because the policy is outdated

Explanation

An outdated policy is a documentation and alignment issue; if the control itself operated effectively, the appropriate action is to update the policy to reflect actual practice. Deleting the policy or redesigning a working control overcorrects the problem.

Question 49Unverified - official IC-90 syllabus not available from source

Which scenario best illustrates a 'detective' control failing to operate?

  1. An employee completes required training on time
  2. A firewall blocks a legitimate business connection
  3. A daily reconciliation is skipped for a week, so an error goes unnoticed Correct answer.
  4. A password policy is updated to require longer passwords

Explanation

A reconciliation is a detective control; skipping it means errors that should have been caught go undetected. Blocking a connection is a preventive control side effect, and training completion and password updates are not detection failures.

Question 50Unverified - official IC-90 syllabus not available from source

A candidate must decide how to treat a control that has no documented owner. Which action is most appropriate?

  1. Flag the missing ownership as a governance weakness and assign accountability Correct answer.
  2. Rely on the auditor to own the control
  3. Remove the control to simplify the process
  4. Assume the control is effective because it exists

Explanation

Every control needs clear accountability for operation and monitoring, so absent ownership is a governance gap to remediate by assigning responsibility. Assuming effectiveness, removing the control, or shifting ownership to the auditor does not resolve the gap.