Free Practice Questions for IIA IIA-CIA-Part3 Exam

User account lockout is the most effective control listed for mitigating bot-driven repeated login attempts. Bots often attempt credential stuffing, brute-force guessing, or repeated authentication attempts. Account lockout limits the number of failed attempts before temporarily disabling access, forcing additional verification, or triggering security review. Password length improves password strength, but it does not stop continuous attempts by bots. Session timeout controls inactive authenticated sessions, not repeated failed logins. Password aging requires periodic password changes, but it is weak against automated attempts and may even lead to poor password practices. Internal auditors reviewing authentication controls should assess lockout thresholds, monitoring, alerting, multifactor authentication, and exception handling. Therefore, Option C is correct.

Collaborating is the conflict resolution method used when parties seek to solve the problem by openly clarifying differences and attempting to satisfy everyone’s objectives. It is a win-win approach that emphasizes problem-solving, transparency, and shared understanding. Accommodating means one party yields to another, which may preserve harmony but does not necessarily solve the underlying issue. Compromising requires each party to give up something, producing a middle-ground solution rather than full achievement of everyone’s objectives. Competing is a win-lose approach based on power, authority, or assertiveness. Internal auditors frequently manage conflicts over findings, ratings, recommendations, and timelines. Collaboration is most appropriate when the issue is important, relationships matter, and a durable solution is needed. Therefore, Option C is correct.

The most effective way to ensure adherence to updated methodologies is through training that reviews and explains the changes in detail. A recorded training session allows all auditors to learn consistently and revisit the content as needed.

Option A improves accessibility but does not ensure understanding or compliance. Option B documents acknowledgment but does not ensure comprehension. Option D provides awareness but lacks sufficient depth.

Inventory obsolescence risk is driven mainly by whether inventory on hand can be sold before it becomes outdated, unsellable, or requires markdown. Monitoring inventory balances is essential because excessive quantities, slow-moving items, or aging stock indicate potential obsolescence. Monitoring sales trends is equally important because declining sales may show reduced demand, product substitution, seasonal changes, or market rejection. Together, these measures help management identify items requiring discounting, production changes, procurement reduction, or write-down evaluation. Market share forecasts may provide broader strategic insight, but they are less direct for managing existing inventory obsolescence. Sales returns may indicate quality or customer satisfaction problems, but returns alone do not adequately measure whether inventory is becoming obsolete. Therefore, the necessary monitoring items are inventory balances and sales trends, making Option C correct.

Data mining focuses on discovering patterns, correlations, statistical relationships, clusters, trends, and profiles within large data sets. It is commonly used to identify unusual behavior, customer profiles, fraud indicators, exception patterns, and risk relationships that may not be obvious through manual review. Process mining is different; it analyzes event logs to understand how business processes actually flow. Process analysis evaluates process design, controls, bottlenecks, and efficiency. Data analysis is broader and may include summarization, filtering, testing, or reporting, but it does not specifically describe creating profiles from statistical relationships. Internal auditors use data mining when searching for hidden risk patterns, vendor anomalies, duplicate transactions, behavioral indicators, or unusual population characteristics. Therefore, Option C is correct.

The cost principle (historical cost principle) states that assets should be recorded at their original purchase price, regardless of changes in market value.

Correct Answer (B - A Building Purchased Last Year for $1 Million Is Still Reported at $1 Million, Despite an Increase in Value)

Under the cost principle, assets remain recorded at their historical cost, not adjusted for market fluctuations.

The only exception is for certain financial instruments, such as trading securities, which are reported at fair market value.

The IIA Practice Guide: Auditing Financial Reporting and Accounting Estimates states that fixed assets (such as buildings) should be recorded at cost unless an impairment occurs.

Why Other Options Are Incorrect:

Option A (Trading and Investment Securities Reported at Market Cost):

Securities can be reported at market value, but this does not follow the cost principle, which applies to tangible assets.

Option C (Adjusting the Building ' s Value to $1.2 Million):

Violates the cost principle—historical cost does not change due to market appreciation.

Option D (Reporting Assets at Either Historical or Fair Value):

This is not the cost principle; it describes fair value accounting, which is different.

IIA Practice Guide: Auditing Financial Reporting and Accounting Estimates – Defines the cost principle and asset valuation rules.

Generally Accepted Accounting Principles (GAAP) – Requires fixed assets to be recorded at historical cost.

Step-by-Step Explanation:IIA References for Validation:Thus, B is the correct answer because the cost principle requires assets to be recorded at their original purchase price, regardless of market value changes.

Authentication is a key security control that prevents unauthorized users from accessing a smart device’s data or applications. It ensures that only authorized individuals can use the device, reducing risks such as data breaches, identity theft, and cyberattacks.

(A) Anti-malware software.

Incorrect. Anti-malware software protects against malicious programs, but it does not control user access to a device.

(B) Authentication. ✅

Correct. Authentication mechanisms (such as passwords, biometrics, PINs, and two-factor authentication) prevent unauthorized access to a device’s data and applications.

IIA GTAG " Managing and Auditing IT Vulnerabilities " highlights authentication as a primary control for protecting smart devices.

(C) Spyware.

Incorrect. Spyware is a security threat, not a preventive control. It is a type of malicious software that steals data from a device.

(D) Rooting.

Incorrect. Rooting (on Android) or jailbreaking (on iOS) refers to modifying a device to remove security restrictions, which increases security risks rather than preventing unauthorized access.

IIA GTAG – " Managing and Auditing IT Vulnerabilities "

IIA Standard 2120 – Risk Management

NIST Cybersecurity Framework – Identity and Access Management

Analysis of Answer Choices:IIA References:Thus, the correct answer is B, as authentication is the most effective security control for preventing unauthorized access to smart devices.

The failed control is reauthorization. The employee’s job responsibility changed when another accountant became responsible for one of the business units, but the senior payroll accountant’s access rights remained unchanged. A reauthorization or access recertification control should periodically confirm that existing access is still appropriate based on current job duties. Authorization controls are involved when access is initially approved, but this scenario concerns access that should have been reviewed and adjusted after responsibilities changed. Authentication controls verify identity, not whether access remains appropriate. Segregation of duties may be relevant to payroll access design, but the specific failure described is the unchanged access rights attestation. Therefore, Option A is correct.

Overseas production usually has the highest market-entry cost because it may require investment in foreign facilities, equipment, employees, supply chains, local compliance, management infrastructure, tax planning, and operational controls. It also exposes the organization to political, currency, labor, environmental, and regulatory risks. Exporting is generally less costly because products are produced domestically and sold abroad. Licensing usually requires lower investment because the licensee performs production or distribution in exchange for fees or royalties. Joint ventures may involve shared costs and risks with a local partner, making them less costly than wholly owned overseas production in many cases. Internal audit should evaluate whether management’s expansion method is consistent with risk appetite, available resources, and control capability. Therefore, Option D is correct.

A Value-Added Network (VAN) is a third-party network service that securely connects an organization with its trading partners, facilitating secure electronic data interchange (EDI) and business communications.

(A) Value-added network (VAN). (Correct Answer)

A VAN is a private, managed network service that provides secure data transmission between business partners.

It is commonly used for B2B transactions, supply chain management, and EDI.

IIA GTAG 7 – IT Outsourcing recognizes VANs as critical third-party networks for secure business data exchange.

(B) Local area network (LAN).

Incorrect: A LAN connects computers within a limited area (e.g., an office or building), but it is not designed for external trading partner connections.

(C) Metropolitan area network (MAN).

Incorrect: A MAN covers a city or region, but it is not designed for B2B communication.

(D) Wide area network (WAN).

Incorrect: A WAN connects multiple geographic locations, but it is a general networking term, not specific to trading partner communications.

IIA GTAG 7 – IT Outsourcing: Discusses the use of third-party networks like VANs for secure data exchange.

IIA Standard 2110 – Governance: Recommends secure third-party integration for business continuity and security.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (A) Value-Added Network (VAN) because it is specifically designed for secure communication between an organization and its trading partners.

Comprehensive and Detailed In-Depth Explanation:

Partnership contributions should be recorded at their fair market value (FMV) at the time of contribution, ensuring equitable financial representation.

Option A (Original cost of the equipment) – Not appropriate since the asset’s current fair value is relevant, not its historical cost.

Option B (Weighted average approach) – Not applicable; capital accounts should reflect actual contributed value.

Option C (No action necessary) – Incorrect because partners contributed assets of different values, making an equal capital credit unfair.

Since partnership accounting requires fair market value for capital accounts, Option D is correct.

A crisis management program requires clear ownership before detailed planning can be effective. The first stage is to create a crisis management team with defined authority, responsibilities, decision-making protocols, and communication channels. This team then coordinates risk analysis, scenario planning, crisis response procedures, contingency plans, testing, training, and post-incident review. Conducting risk analysis is important, but it is usually performed or directed by the assigned team. Formulating contingency plans comes after risks, critical operations, roles, and response priorities are understood. Practicing the response is a later-stage activity used to validate whether the plan works under simulated crisis conditions. From an internal audit perspective, a crisis program without an accountable team is weak because response actions may be fragmented, delayed, or inconsistent. Therefore, Option C is correct.

When separately operated applications are integrated, a major concern is whether data integrity will be maintained across systems. Integration may introduce mapping errors, inconsistent data definitions, duplicate records, incomplete transfers, synchronization failures, or processing conflicts. The number of users may increase or decrease, but that is not the central database concern. Initial cost may rise, but cost is less important than whether data remain complete, accurate, and consistent. Security protocols may affect productivity, but this is not the primary issue for the database administrator during integration. Internal audit should evaluate interface controls, reconciliations, data mapping, exception handling, master data governance, and access controls. Therefore, Option A is correct.

Comprehensive and Detailed In-Depth Explanation:

File encryption protects the confidentiality and integrity of information during transmission and storage. It ensures that only authorized recipients can access the data by converting it into an unreadable format.

Option A (Firewalls) – Prevents unauthorized access to networks but does not secure data exchange.

Option B (Activity logs) – Tracks actions but does not protect data confidentiality.

Option C (Antivirus software) – Protects against malware but does not encrypt data in transit.

Thus, file encryption (Option D) is the best security control for protecting exchanged information.