CPA — Information Systems & Controls (ISC) [Discipline] practice questions and exam guide

Role-based access provisioning that uses standardized 'access profiles' or 'birthright access' tied to job role is primarily intended to:

1. Grant unrestricted access to every system regardless of the employee's actual job function
2. Streamline and standardize provisioning so new employees receive consistent, role-appropriate access rather than ad-hoc, inconsistent grants
3. Eliminate all need for subsequent access reviews or recertification
4. Apply only to contractors, never to full-time employees

Answer: B — Streamline and standardize provisioning so new employees receive consistent, role-appropriate access rather than ad-hoc, inconsistent grants

A) Unrestricted universal access defeats the purpose of role-based, tailored provisioning. B) Correct — standardized role-based/birthright access profiles ensure consistent, appropriate baseline access aligned to job function, reducing manual errors and inconsistent ad-hoc grants. C) Standardized initial provisioning doesn't eliminate the need for ongoing recertification, since roles and responsibilities can change over time. D) Role-based provisioning concepts apply broadly to both employees and contractors, not exclusively to one group.

In a SaaS deployment, the vendor's responsibility includes:

1. Only the physical data center and network hardware layers
2. Only the guest operating system and database engine on VMs
3. The full application, OS, runtime, and underlying infrastructure
4. Only the development platform, with customer building the app

Answer: C — The full application, OS, runtime, and underlying infrastructure

A) That describes IaaS scope, not SaaS. C) Correct — SaaS vendors run the entire stack; customer manages users, data, config. B) Customer never runs the OS in SaaS — vendor does. D) That describes PaaS scope, not SaaS.

Infrastructure as Code (IaC) is a practice in which infrastructure is:

1. Provisioned only by clicking through a cloud vendor's web management console
2. Documented in spreadsheets that operators reference during manual server builds
3. Purchased as physical appliances and racked in an on-premise data center directly
4. Defined in declarative or scripted files version-controlled and deployed automatically

Answer: D — Defined in declarative or scripted files version-controlled and deployed automatically

A) Console-clicking is the opposite of IaC. B) Manual builds from spreadsheets are not IaC. C) Physical procurement isn't IaC either. D) Correct — IaC is code-defined, version-controlled, automated provisioning.

A 'containerized' approach to BYOD device management (separating a secure corporate 'container' app/workspace from personal apps/data on the same device) is primarily intended to:

1. Physically split the phone into two separate hardware devices
2. Apply only to company-owned devices, never to true BYOD scenarios
3. Eliminate the need for any encryption on the device
4. Logically isolate and protect corporate data and applications from the device's personal side, allowing the organization to manage/wipe only the corporate container without affecting personal data

Answer: D — Logically isolate and protect corporate data and applications from the device's personal side, allowing the organization to manage/wipe only the corporate container without affecting personal data

A) Containerization is a logical/software-based separation, not a physical hardware split of the device. D) Correct — containerization creates a logically isolated, managed workspace for corporate data/apps, allowing the organization to enforce policies and perform actions like a selective wipe of just the corporate container, without touching the employee's personal data and apps. C) Containerized workspaces typically still rely on underlying encryption for the protected data; it doesn't replace that need. B) Containerization is specifically valuable in TRUE BYOD scenarios, precisely because it lets personal and corporate data coexist on the same personally owned device with appropriate separation.

A company evaluating whether to build a formal AI/ML model risk governance program alongside its existing COBIT-based IT governance structure should recognize that:

1. COBIT's governance/management structure (evaluate, direct, monitor / plan, build, run, monitor) can be extended to explicitly cover AI/ML-specific risks like model drift, bias, and explainability, rather than requiring an entirely separate, disconnected governance structure
2. AI/ML models require no governance since they are purely a technical/engineering concern
3. COBIT is incompatible with any technology developed after COBIT's initial publication date
4. Model risk governance and IT governance must always be handled by entirely separate committees with no communication between them

Answer: A — COBIT's governance/management structure (evaluate, direct, monitor / plan, build, run, monitor) can be extended to explicitly cover AI/ML-specific risks like model drift, bias, and explainability, rather than requiring an entirely separate, disconnected governance structure

A) Correct — COBIT's governance/management structure is designed to be extensible to emerging technology risks; an organization can incorporate AI/ML-specific risk considerations (drift, bias, explainability) into its existing governance objectives rather than building an entirely siloed, disconnected framework. B) AI/ML models used in impactful business decisions clearly warrant governance, given the model risk, bias, and explainability concerns discussed throughout this topic area. C) COBIT is a flexible, technology-agnostic governance framework intended to remain applicable as new technologies emerge, not tied to specific technologies existing at its publication. D) Effective governance benefits from integration and communication between IT governance and specialized risk domains like AI/ML, rather than complete organizational silos.

A defining characteristic of symmetric encryption is that:

1. The same secret key encrypts and decrypts the data efficiently at high speed
2. A public key encrypts and a matching private key decrypts messages between parties
3. The output is a fixed-length one-way digest that cannot be reversed at all
4. The sender's private key encrypts a hash that anyone can verify with public key

Answer: A — The same secret key encrypts and decrypts the data efficiently at high speed

A) Correct — symmetric uses one shared secret key (e.g., AES). B) That describes asymmetric encryption. C) That describes hashing. D) That describes a digital signature.

The defense-in-depth strategy secures systems by:

1. Relying on a single strong perimeter firewall as the sole line of network defense
2. Focusing all controls on prevention and eliminating any detective or response controls
3. Layering multiple independent controls so a failure of one does not defeat all defenses
4. Placing every server on a single flat network segment so monitoring is simplified

Answer: C — Layering multiple independent controls so a failure of one does not defeat all defenses

A) Single-perimeter is exactly what defense in depth rejects. B) Defense in depth includes preventive, detective, and corrective controls. C) Correct — layered independent controls define defense in depth. D) Flat networks worsen security posture.

A Kubernetes 'pod security policy' (or its modern successor, Pod Security Admission) is used to:

1. Enforce security-related constraints on how pods can run, such as preventing privileged containers or restricting host access
2. Determine which employees are granted physical building access badges
3. Automatically encrypt all data at rest regardless of pod configuration
4. Replace the need for container image scanning

Answer: A — Enforce security-related constraints on how pods can run, such as preventing privileged containers or restricting host access

A) Correct — pod security policies/admission controls enforce runtime constraints on pods, such as disallowing privileged mode, restricting host namespace access, and controlling capabilities. B) Physical badge access is unrelated to Kubernetes pod-level security controls. C) Pod security policy doesn't itself guarantee encryption at rest; that's typically a separate storage-layer control. D) Pod security policy and image scanning address different stages (runtime vs. pre-deployment) and are complementary, not substitutes for each other.

The most common motivation for a malicious insider threat is:

1. Financial gain or grievance, such as theft of data, sabotage, or fraud
2. Nation-state espionage on behalf of a foreign intelligence service payroll
3. Random destructive vandalism performed without any personal or financial motive
4. Curiosity to test the strength of controls purely for professional development

Answer: A — Financial gain or grievance, such as theft of data, sabotage, or fraud

A) Correct — most malicious insiders act for financial gain or grievance. B) Nation-state placement occurs but is rare compared to financial motivation. C) Random vandalism is rare in insider cases. D) Curiosity is a factor in unintentional insiders, not malicious ones.

A primary use case for asymmetric encryption is:

1. Bulk encryption of terabyte-scale databases at rest for high throughput
2. Producing a fixed-length one-way digest for password storage integrity
3. Securely exchanging a symmetric session key between two parties online
4. Compressing large media files to reduce storage costs across the fleet

Answer: C — Securely exchanging a symmetric session key between two parties online

A) Asymmetric is too slow for bulk encryption — symmetric is used instead. C) Correct — asymmetric is used for key exchange and digital signatures. B) That is hashing, not asymmetric encryption. D) That is compression, not encryption.

The key difference between ETL and ELT is that:

1. ETL loads raw data first; ELT transforms in the source system only
2. ETL is cloud-native only; ELT is used only for on-premise warehouses
3. ETL transforms before loading; ELT loads raw and transforms in target
4. ETL applies no transformations; ELT applies no transformations either

Answer: C — ETL transforms before loading; ELT loads raw and transforms in target

A) That reverses the two — ELT loads raw, then transforms. C) Correct — ETL = transform then load; ELT = load then transform in target. B) ETL is legacy; ELT emerged with cloud warehouses. This reverses it. D) Both apply transformations — just at different stages.

A data residency requirement typically obligates an organization to:

1. Encrypt all personal data with a symmetric key generated on the same day of collection
2. Publish all personal data collected in the past twelve months on a public corporate website daily
3. Anonymize all personal data before storing it in any commercial cloud database service system
4. Store certain data within specific geographic or jurisdictional borders as required by law

Answer: D — Store certain data within specific geographic or jurisdictional borders as required by law

A) Encryption is a separate control from residency. B) Publication violates confidentiality; not residency. C) Anonymization is a separate technique from residency. D) Correct — residency requires data to remain within specific jurisdictions.

A key risk specific to BYOD (as opposed to fully company-owned devices) is that:

1. BYOD devices never connect to any corporate network or resource, eliminating any risk entirely
2. BYOD eliminates the need for any MDM solution
3. BYOD devices are always more secure than company-owned devices by default
4. The organization has reduced visibility and control over a device it doesn't own, complicating consistent security policy enforcement and increasing the risk of data leakage if the device is lost, compromised, or the employee departs

Answer: D — The organization has reduced visibility and control over a device it doesn't own, complicating consistent security policy enforcement and increasing the risk of data leakage if the device is lost, compromised, or the employee departs

A) BYOD devices specifically DO connect to corporate resources — that's the entire premise of BYOD — making this option factually backwards. D) Correct — because the organization doesn't own the device, it typically has less visibility/control than over a company-issued device, complicating consistent policy enforcement and heightening risks around data leakage upon loss, compromise, or employee departure. C) BYOD devices aren't inherently more secure; the reduced organizational control typically makes them a HIGHER relative risk without compensating controls like MDM. B) BYOD environments often specifically NEED MDM (or similar mobile security tooling) to manage the elevated risk of employee-owned devices accessing corporate data.

A company is planning to deploy a new AI-driven system that will perform large-scale, systematic profiling of customer behavior to personalize marketing. Under GDPR, this planning process should include:

1. No special assessment obligation, since AI-driven marketing personalization is exempt from any GDPR risk-assessment requirement
2. A Data Protection Impact Assessment (DPIA), performed BEFORE the processing begins, since large-scale systematic profiling using new technology is precisely the kind of high-risk processing that triggers the DPIA requirement
3. A DPIA only if a data breach has already occurred involving the system
4. A DPIA only if specifically requested by a supervisory authority after the system is already in production

Answer: B — A Data Protection Impact Assessment (DPIA), performed BEFORE the processing begins, since large-scale systematic profiling using new technology is precisely the kind of high-risk processing that triggers the DPIA requirement

A) Incorrect — large-scale systematic profiling is one of the clearest, most commonly cited examples of processing that specifically triggers the DPIA requirement under GDPR; there is no blanket AI exemption. B) Correct — GDPR requires a DPIA to be conducted BEFORE processing begins when it is likely to result in high risk to individuals' rights and freedoms, and large-scale systematic profiling combined with new technology (AI-driven personalization) is a paradigm example of triggering conditions — this is a proactive risk-assessment obligation, not something triggered only after an incident. C) Incorrect — the DPIA obligation is proactive and preventive, not conditioned on a breach having already occurred; waiting for a breach would defeat its entire purpose. D) Incorrect — the obligation to conduct a DPIA arises from the nature of the processing itself, not from a specific request by a supervisory authority after deployment.

A candidate evaluating an exam scenario involving SDLC controls, BIA, key management, API security, MDM, and physical security together should recognize that the AICPA ISC blueprint expects candidates to:

1. Memorize isolated definitions with no expectation of applying them to integrated scenarios
2. Apply judgment connecting these control domains to realistic business scenarios, recognizing how gaps or strengths in one domain affect overall risk alongside the others
3. Treat every topic as entirely siloed with zero expected cross-topic application
4. Focus exclusively on memorizing acronyms with no conceptual understanding required

Answer: B — Apply judgment connecting these control domains to realistic business scenarios, recognizing how gaps or strengths in one domain affect overall risk alongside the others

A) Isolated memorization without application undersells the blueprint's expectation of scenario-based judgment. B) Correct — as demonstrated throughout this Part's synthesis questions, the ISC blueprint expects candidates to apply integrated judgment, connecting SDLC, BIA, cryptographic, API, mobile, and physical security concepts to realistic, often multi-topic business scenarios. C) Complete topic siloing contradicts the pattern of integrated, scenario-based testing emphasized throughout this content area. D) Acronym memorization alone, without conceptual understanding of how these controls function and interact, would leave a candidate unprepared for the scenario-based question style the exam favors.

A SOC 2 report addresses controls at a service organization that are relevant to:

1. User entities' internal control over financial reporting only, following AICPA rules
2. General-use short summaries suitable for public marketing distribution on a website
3. Government regulatory oversight of federal contractors, following NIST standards
4. Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy

Answer: D — Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy

A) That describes SOC 1, not SOC 2. B) That describes SOC 3, not SOC 2. C) SOC 2 is not a federal regulatory report. D) Correct — SOC 2 addresses the Trust Services Criteria.

Common Criteria CC1 (Control Environment) addresses controls related to:

1. Change management for system components including approvals, testing, and rollback
2. Logical access to information assets including authentication and authorization systems
3. Governance, integrity, ethical values, board oversight, and organizational structure
4. System operations including monitoring, incident management, and backup and recovery

Answer: C — Governance, integrity, ethical values, board oversight, and organizational structure

C) Correct — CC1 is Control Environment (tone at the top). B) That describes CC6, not CC1. A) That describes CC8, not CC1. D) That describes CC7, not CC1.

Complementary User Entity Controls (CUECs) are controls that:

1. The service auditor tests directly at the service organization during Type 2 fieldwork
2. The subservice organization must operate for the service organization to succeed
3. The user entity must operate for the service organization's controls to be effective
4. The service organization operates in place of the user entity's own internal controls

Answer: C — The user entity must operate for the service organization's controls to be effective

A) The service auditor tests the service org's controls, not CUECs at user entities. B) That describes CSOCs, not CUECs. C) Correct — CUECs are controls the user entity must operate. D) The service org doesn't substitute for user entity controls.

The CPA ISC Discipline exam is composed of:

1. Only task-based simulations and no multiple-choice questions in the four-hour exam
2. Only multiple-choice questions and no task-based simulations at all in the exam
3. Multiple-choice questions and task-based simulations across roughly a four-hour exam
4. A written communication essay component and a professional ethics attestation section

Answer: C — Multiple-choice questions and task-based simulations across roughly a four-hour exam

A) ISC includes MCQs, not only TBS. B) ISC includes TBS, not only MCQs. C) Correct — ISC uses both MCQs and TBS in a ~4-hour exam. D) The CPA exam eliminated written communication.

SOC 1 control objectives are set by:

1. The service auditor unilaterally without input from the service organization's management
2. The AICPA in a fixed framework identical for every SOC 1 engagement everywhere issued
3. The user entity's independent auditor at the beginning of each SOC 1 engagement
4. The service organization's management, subject to service auditor's suitability review

Answer: D — The service organization's management, subject to service auditor's suitability review

A) Management sets objectives, not the auditor alone. B) SOC 1 objectives are not standardized across engagements. C) The user auditor doesn't set SOC 1 objectives. D) Correct — management sets objectives; auditor evaluates suitability.

A key SDLC control objective regardless of methodology (waterfall or Agile) is to ensure that:

1. Developers can independently move their own code changes directly into production with no review
2. Changes are appropriately tested, reviewed/approved, and documented before being promoted to the production environment
3. No testing is required if the developer is confident the code works
4. Documentation is entirely optional and left to each developer's discretion

Answer: B — Changes are appropriately tested, reviewed/approved, and documented before being promoted to the production environment

A) Allowing developers unilateral production deployment without independent review undermines segregation of duties, a core control objective regardless of methodology. B) Correct — across both waterfall and Agile, a fundamental SDLC control objective is ensuring changes are tested, appropriately reviewed/approved, and documented before reaching production, protecting against errors and unauthorized changes. C) Skipping testing based solely on developer confidence contradicts the standard requirement for independent verification before production deployment. D) Leaving documentation entirely discretionary undermines auditability and knowledge transfer, both important SDLC control considerations.

An organization discovers during an ITGC review that its change management process (a general control) has weaknesses, and a related automated application control (three-way match) has not been retested since a system upgrade. Combining IT audit sampling and ITGC concepts, the auditor should MOST reasonably:

1. Continue relying fully on the automated application control with no further testing, since it worked correctly before the upgrade
2. Recognize that the ITGC weakness (change management) undermines the basis for relying on the automated control without retesting after the upgrade, and extend testing or reduce reliance accordingly
3. Conclude the audit is complete with no further procedures required
4. Assume the system upgrade had no impact on the automated control's continued functioning

Answer: B — Recognize that the ITGC weakness (change management) undermines the basis for relying on the automated control without retesting after the upgrade, and extend testing or reduce reliance accordingly

A) Continuing full reliance without retesting after a system upgrade, especially with a known change management weakness, is unsupported — the upgrade itself is a change that should trigger reassessment. B) Correct — a weak change management ITGC combined with an untested post-upgrade automated control means the auditor can't safely assume continued effectiveness; the appropriate response is to extend testing (retest the control post-upgrade) or reduce reliance and increase substantive procedures accordingly. C) Concluding the audit without addressing this identified gap would leave a material audit risk unaddressed. D) Assuming no impact from the upgrade without evidence directly contradicts the auditor's professional skepticism obligation, especially given the known ITGC weakness.

Application controls are automated controls that are:

1. Applied at the perimeter firewall to filter traffic between external networks and internal ones
2. Applied at the hypervisor layer to isolate one tenant workload from another tenant's workload
3. Applied at the physical badge reader to grant employees entry into the office at various sites
4. Applied within a specific application to ensure processing is complete, accurate, and authorized

Answer: D — Applied within a specific application to ensure processing is complete, accurate, and authorized

A) Firewalls are network controls, not application controls. B) Hypervisor isolation is an infrastructure control, not an application control. C) Badge readers are physical controls, not application controls. D) Correct — application controls target specific app processing objectives.

An organization's IT audit function notes that automated application controls have historically required less extensive sample sizes than manual controls for the same assurance level. This is because:

1. Automated controls are inherently exempt from any audit requirement
2. A properly functioning automated control processes every instance consistently (absent a change), reducing the variability that drives larger sample sizes for human-performed manual controls
3. Automated controls are always less important to financial reporting than manual controls
4. Sample size has no relationship to the type of control being tested

Answer: B — A properly functioning automated control processes every instance consistently (absent a change), reducing the variability that drives larger sample sizes for human-performed manual controls

A) Automated controls still require testing; they aren't exempt from audit procedures. B) Correct — because automated controls apply the same logic consistently to every transaction absent a configuration change, the auditor can gain assurance about the entire population from testing a smaller number of instances (plus IT general controls around changes), unlike manual controls subject to human variability requiring larger samples. C) Automated controls are often HIGHLY significant to financial reporting reliability, not inherently less important than manual controls. D) Sample size approaches specifically DO depend on the nature of the control (automated vs. manual) being tested, contradicting this option.

Encryption at rest vs in transit?

At rest: data stored on disk encrypted. In transit: data moving over network encrypted (TLS).

RBAC vs ABAC?

Role-Based Access Control assigns permissions based on a user's assigned role (simpler, coarser-grained); Attribute-Based Access Control evaluates multiple attributes (user, resource, environment, action) dynamically at access time, enabling finer-grained, context-aware decisions at the cost of greater configuration complexity.

User acceptance testing (UAT)?

End users validate that the system meets business requirements before go-live.

Social engineering?

Manipulating people into divulging info or performing actions. Bypasses technical controls.

Multi-state breach + SOAR-accelerated response — key coordination point?

Technical response (SOAR) and legal/regulatory notification obligations must be coordinated together, not treated as separate workstreams.

Legal hold + forensic imaging relationship?

Forensic imaging preserves a verifiable, unaltered copy of relevant data once a legal hold requires preservation.