Free Practice Questions for IIA IIA-CIA-Part3 Exam

Comparative advantage states that total output is maximized when each country specializes in producing goods or services for which it has the lowest opportunity cost, then trades with others. The theory does not require a country to have an absolute cost advantage; it focuses on relative efficiency. Option A is incorrect because balanced imports and exports are not the core principle of comparative advantage. Option C is wrong because blocking imports based on balance-of-payments effects can reduce specialization and efficiency. Option D may support trade efficiency, but unrestricted trade is not the definition of comparative advantage. Internal auditors in multinational environments should understand comparative advantage because sourcing, outsourcing, transfer pricing, and global supply-chain decisions may rely on it. Therefore, Option B is correct.

Comprehensive and Detailed In-Depth Explanation:

The discounted payback period is a capital budgeting technique that determines how long it takes for a project to recover its initial investment, accounting for the time value of money.

Option A (Calculates the overall project value) describes Net Present Value (NPV), not the payback period.

Option B (Ignores the time value of money) applies to the simple payback period, but the discounted payback period does account for the time value of money.

Option D (Begins at time zero) is true for all capital budgeting methods, not specific to this one.

Thus, option C is correct because the discounted payback period measures the break-even time while considering the present value of cash flows.

Two-level (or multi-factor) authentication (MFA) is the most efficient and effective security control for authenticating customers when accessing online shopping accounts. It provides an extra layer of security beyond just passwords, making it more difficult for unauthorized users to gain access.

Stronger Authentication – It requires two independent verification methods, such as:

Something you know (password, PIN)

Something you have (one-time code, mobile device, smart card)

Something you are (biometric feature)

Reduces Risk of Credential Theft – Even if hackers obtain a user ' s password, they still need the second factor to gain access.

Meets Regulatory Standards – Many cybersecurity frameworks (NIST, ISO 27001, PCI-DSS) recommend or mandate MFA for customer authentication.

Enhanced Customer Trust – Provides users with better security, reducing risks of fraud or account takeovers.

A. 12-digit password feature – Longer passwords improve security, but they can still be compromised through phishing or brute force attacks.

B. Security question feature – These are often weak because users choose predictable answers (e.g., mother ' s maiden name).

C. Voice recognition feature – Biometric authentication is useful, but voice recognition can be bypassed using deepfake or recorded audio.

IIA’s GTAG (Global Technology Audit Guide) on Information Security Management – Recommends multi-factor authentication for access control.

IIA’s International Professional Practices Framework (IPPF) – Standard 2110.A2 – Highlights the need for strong security controls to protect customer data.

NIST SP 800-63 (Digital Identity Guidelines) – Encourages multi-factor authentication as a best practice for securing user accounts.

Why Two-Level Sign-On (MFA) Is the Best Choice?Why Not the Other Options?IIA References:✅ Final Answer: D. Two-level sign-on feature (Most effective for online customer authentication).

===============

Consideration is a fundamental element of a legally binding contract, referring to something of value exchanged between parties. It ensures that each party receives a benefit or suffers a legal detriment in return for the promise made.

Essential for Contract Enforceability – A contract must involve an exchange of value (e.g., money, services, goods, or a promise to act or refrain from acting).

Legal Reciprocity – Both parties must give and receive something of value to make the contract valid.

Distinguishes Contracts from Gifts – A gift is voluntary and does not require consideration, whereas a contract does.

A. Lawfulness – A contract must be lawful, but lawfulness is a requirement, not something exchanged.

C. Agreement – An agreement is part of a contract, but without consideration, an agreement is not legally binding.

D. Discharge – Discharge refers to ending a contract, not forming one.

IIA’s GTAG on Contract Management Risks – Highlights consideration as a key contract principle.

COSO’s Internal Control Framework – Covers contract law fundamentals in risk management.

Common Law and Uniform Commercial Code (UCC) – Define consideration as an essential element of a contract.

Why Consideration is the Correct Answer?Why Not the Other Options?IIA References:

Economic order quantity balances ordering costs and carrying costs to determine the most cost-efficient order size. Under the EOQ model, the order quantity increases when fixed ordering costs increase because placing each order becomes more expensive. To reduce the number of orders, the organization orders larger quantities at one time. Lower annual unit sales would reduce EOQ because fewer units are needed. Higher carrying costs reduce EOQ because holding inventory becomes more expensive, making smaller orders preferable. A higher purchase price may increase carrying cost if carrying cost is calculated as a percentage of inventory value, which would also tend to reduce EOQ. Internal auditors reviewing inventory management should understand how ordering, holding, demand, and pricing assumptions affect inventory decisions. Therefore, Option B is correct.

Residual income (RI) is a performance measure that considers both profits and the investment base by calculating the excess income generated over a required minimum return on investment (ROI).

(A) Residual income (Correct Answer):

Formula: Residual Income=Operating Income−(Required Rate of Return×Investment Base)\text{Residual Income} = \text{Operating Income} - (\text{Required Rate of Return} \times \text{Investment Base})Residual Income=Operating Income−(Required Rate of Return×Investment Base)

RI evaluates profitability after accounting for the cost of capital, making it a better measure of financial performance than net income alone.

It considers both profits (net operating income) and the investment base (capital employed).

(B) A flexible budget:

A flexible budget adjusts based on changes in activity levels but does not directly include investment base considerations.

(C) Variance analysis:

Variance analysis compares actual vs. budgeted performance but does not consider investment base.

(D) A contribution margin income statement by segment:

The contribution margin shows revenue minus variable costs but does not factor in the investment base.

IIA Practice Guide: Measuring Performance – Recognizes residual income as a key metric for evaluating divisional performance.

COSO ERM Framework – Performance Measurement Component – Emphasizes using metrics that account for both profitability and investment.

IIA Standard 2120 - Risk Management – Highlights the importance of financial metrics in evaluating strategic objectives.

Analysis of Each Option:IIA References:Conclusion:Since Residual Income (RI) considers both profits and investment base, option (A) is the correct answer.

A web browser is the software application that interprets hypertext markup language (HTML), displays web pages, and allows users to access remote web content. Browsers also process related technologies such as scripts, style sheets, cookies, and encrypted web sessions. TCP/IP is a communications protocol suite used to transmit data across networks; it is not the software used to display web pages. An operating system manages hardware and software resources on a device but does not itself translate HTML for normal user browsing. A web server hosts and delivers web pages to users but does not serve as the end-user viewing software. Internal auditors reviewing web applications should distinguish between client-side browsers, servers, protocols, and application controls. Therefore, Option C is correct.

After an initial risk analysis identifies areas of concern, the next appropriate step is risk assessment. Risk assessment evaluates the significance of identified risks by considering likelihood, impact, control effectiveness, vulnerability, and priority. Risk identification has already occurred because several areas of concern were found. Identification of context normally occurs earlier, when the auditor or risk team defines objectives, scope, environment, criteria, and risk appetite. Risk response comes after assessment because management must understand the severity and priority of risks before deciding whether to accept, reduce, avoid, or share them. In internal audit planning, this sequence is critical because audit resources should be focused on higher-risk areas. Therefore, after initial risk analysis, the most appropriate next step is risk assessment, Option D.

Comprehensive and Detailed In-Depth Explanation:

Data privacy laws, such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), emphasize restricting access to personally identifiable information (PII) to only those who require it for business purposes.

Option B (Data backup within 24 hours) is an IT best practice but is not a core requirement of privacy laws.

Option C (Approval for system updates) is a change management policy, unrelated to data privacy.

Option D (Insider trading restrictions) falls under corporate governance and securities regulations, not data privacy laws.

Thus, Option A is correct, as it aligns with legal requirements for protecting sensitive personal data.

Business continuity planning (BCP) requires a recovery strategy that minimizes downtime and ensures that critical operations resume within the organization’s desired recovery time objective (RTO).

Since the organization wants to recover within four to seven days, it does not require an expensive real-time recovery site (hot site).

The best strategy is a warm site: a pre-secured location with configurable hardware and data backups that can be activated within the required timeframe.

(A) Incorrect – A recovery strategy whereby a separate site has not yet been determined, but hardware has been reserved for purchase and data backups.

This is a cold site, requiring time for setup and hardware installation.

It does not meet the four to seven-day recovery timeframe efficiently.

(B) Incorrect – A recovery strategy whereby a separate site has been secured and is ready for use, with fully configured hardware and real-time synchronized data.

This describes a hot site, which allows instant failover with real-time synchronization.

While effective, it is costly and unnecessary for a four-to-seven-day recovery target.

(C) Incorrect – A recovery strategy whereby a separate site has been secured and the necessary funds for hardware and data backups have been reserved.

While a site has been secured, the absence of pre-configured hardware would delay recovery, making it an inefficient choice.

(D) Correct – A recovery strategy whereby a separate site has been secured with configurable hardware and data backups.

This describes a warm site, which is the best balance between cost and recovery efficiency.

Configurable hardware and data backups ensure that operations can resume within four to seven days.

IIA’s GTAG (Global Technology Audit Guide) – Business Continuity and IT Disaster Recovery

Recommends warm sites for recovery within a few days.

ISO 22301 – Business Continuity Management Systems

Defines recovery time objectives (RTOs) and site classifications (hot, warm, cold).

COBIT Framework – IT Risk Management

Guides organizations on cost-effective recovery site selection based on risk tolerance.

Analysis of Answer Choices:IIA References and Internal Auditing Standards:

The described situation is a classic social engineering attack, specifically a phishing or CEO fraud (business email compromise) attempt. Social engineering exploits human psychology rather than technical vulnerabilities. In this case, the attacker attempted to impersonate the CEO and trick the board member into making an unauthorized payment.

(A) Incorrect – A risk of spyware and malware.

Spyware and malware typically involve malicious software installed on a device, which is not the case here.

This attack relied on deception rather than malware to obtain unauthorized funds.

(B) Incorrect – A risk of corporate espionage.

Corporate espionage involves unauthorized data theft, sabotage, or insider threats.

The attacker here attempted financial fraud, not intellectual property theft.

(C) Incorrect – A ransomware attack risk.

Ransomware encrypts files and demands payment for decryption.

There is no mention of system encryption or ransom demands in this case.

(D) Correct – A social engineering risk.

The attacker impersonated the CEO and used urgency to manipulate the board member into processing a fraudulent payment.

This technique is a business email compromise (BEC) scam, a well-known social engineering tactic.

IIA’s GTAG (Global Technology Audit Guide) – Cybersecurity Risks and Controls

Discusses social engineering and its impact on financial fraud.

NIST Cybersecurity Framework – Social Engineering Threats

Defines social engineering tactics, including email impersonation and phishing.

COBIT Framework – Information Security Governance

Recommends controls to mitigate social engineering risks, such as employee training and email authentication mechanisms.

Analysis of Answer Choices:IIA References and Internal Auditing Standards: