Free IIA-CIA-Part3 Practice Test Questions 2026

Explanation

Authentication is the process of verifying that a user is who they claim to be before granting access to systems, applications, or data. It answers the question, "Are you who you say you are?" A smart card is an authentication device. It is something the user possesses, a "something you have" factor, and requiring users to validate their identity with a smart card is a direct example of an authentication control. The smart card, often combined with a PIN or password, verifies the user's identity at the point of login, which is precisely what authentication controls are designed to do.

Why the other options are incorrect:

A. Identity requests are approved in two steps
– This describes an authorization or approval process for granting identities or access, not authentication. Approving identity requests relates to provisioning and authorization, deciding what a user is allowed to do, not to verifying identity at login.

B. Logs are checked for misaligned identities and access rights
– This describes a monitoring or review control, a detective control, that examines logs to identify inconsistencies between identities and access rights. It is not an authentication control, which operates at the point of access to verify identity.

D. Functions can be performed based on access rights
– This describes authorization, which determines what an authenticated user is permitted to do, including their access rights and permissions. Authorization occurs after authentication and defines the scope of access, not the verification of identity itself.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically authentication and authorization controls, identity and access management.

Explanation

In a bring-your-own-device (BYOD) environment, one of the key security features used to confirm that a legitimate employee is accessing organizational applications with their own smart device is to require that only organization-approved devices be used. This is typically implemented through mobile device management (MDM) or similar controls, where devices must be registered, inventoried, and approved by the organization before they are permitted to access organizational systems. Approved devices can be verified by unique device identifiers, certificates, or enrollment in MDM, which helps confirm that the device is authorized and meets security requirements, such as encryption, patching, and screen lock. This gives the organization assurance that access is coming from a legitimate, sanctioned device belonging to an authorized employee.

Why the other options are incorrect:

A. Using a jailbroken or rooted smart device feature
– Jailbreaking or rooting a device removes manufacturer and administrative restrictions, weakening security controls and increasing the risk of malware and unauthorized access. This is a security risk, not a security feature, and would not help verify a legitimate employee. It would undermine security.

C. Obtaining written assurance from the employee that security policies and procedures are followed
– Written assurance is a form of attestation and does not technically verify identity or secure the device. An employee could provide written assurance while still using a compromised or unauthorized device. It is not a technical security feature that identifies a legitimate employee using their own device.

D. Introducing a security question known only by the employee
– A security question is a knowledge-based authentication factor, but it is weak because answers can be guessed or researched, and it does not verify that the device itself is legitimate or authorized. It also does not address device-level security, which is the core concern in BYOD access.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically mobile device management (MDM), BYOD security, and authentication controls.

Explanation

The contracting process generally follows a sequence of phases: initiation, bidding (or solicitation), development, and management. During the development phase, the contract itself is drafted for the proposed business activity. This is the stage where the terms, conditions, scope of work, deliverables, pricing, performance requirements, and legal provisions are put into writing and refined through negotiation between the parties. The development phase follows the bidding or solicitation phase, where proposals or bids are obtained, and precedes the management phase, where the contract is administered and monitored. Drafting the contract is a core activity of the development phase, making it the correct answer.

Why the other options are incorrect:

A. Initiation phase
– The initiation phase is the earliest stage, where the need for a business activity or procurement is identified, requirements are defined, and the decision to proceed is made. Contracts are not drafted at this stage; the focus is on defining the need and obtaining authorization.

B. Bidding phase
– The bidding, or solicitation, phase involves requesting proposals or bids from potential vendors or contractors, evaluating responses, and selecting a preferred provider. While contract terms may be discussed, the actual drafting of the contract occurs in the subsequent development phase.

D. Management phase
– The management phase occurs after the contract has been awarded and signed. It involves administering the contract, monitoring performance, managing changes, and ensuring compliance with the agreed terms. Contract drafting has already been completed by this stage.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Procurement and Contract Management — Specifically the phases of the contracting process, including initiation, bidding, development, and management.

Explanation

When executive compensation is tied to the organization's financial results, executives have a strong personal financial incentive to achieve those results, sometimes at any cost. This can encourage behavior that is inconsistent with the interests of relevant stakeholders, such as shareholders, employees, customers, and the public. For example, executives may manipulate earnings, take excessive risks, cut corners on quality or safety, delay necessary investments, or engage in other short-term actions designed to boost reported financial results and increase their compensation. These actions may benefit executives personally in the short term while harming the long-term interests of stakeholders. This misalignment between executive incentives and stakeholder interests is a well-recognized governance risk, making this the most likely situation to arise.

Why the other options are incorrect:

A. The organization reports inappropriate estimates and accruals due to poor accounting controls
– While compensation tied to financial results can create incentives to manipulate estimates and accruals, the cause described here is poor accounting controls, not the compensation structure itself. The question asks what is most likely to arise from executive compensation being based on financial results, and the broader and more direct consequence is dysfunctional behavior inconsistent with stakeholder interests. Poor controls are a separate control weakness, not an inherent result of the compensation design.

B. The organization uses an unreliable process for gathering and reporting executive compensation data
– An unreliable process for gathering compensation data is an operational or control deficiency in the compensation system, not a likely consequence of tying compensation to financial results. The incentive structure itself does not cause the data-gathering process to become unreliable.

C. The organization experiences increasing discontent of employees, if executives are eligible for compensation amounts that are deemed unreasonable
– While employee discontent over perceived excessive executive pay is possible, it is conditional and not the most direct or likely result of linking compensation to financial results. The more fundamental risk is that executives will pursue financial results in ways that harm stakeholder interests, which is option D.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Governance and Executive Compensation — Specifically incentive structures, agency theory, and the alignment of executive interests with stakeholder interests.

Explanation

Vertical analysis is a financial statement analysis technique in which each line item on a financial statement is expressed as a percentage of a base figure within the same statement, typically revenue on the income statement or total assets on the balance sheet. In this scenario, the internal auditor expressed electricity and depreciation expenses as a percentage of revenue, 10% and 7% respectively, which is exactly how vertical analysis works on the income statement. By converting each expense to a percentage of revenue, the auditor can evaluate the relative size and composition of expenses and compare them across periods or against industry benchmarks, independent of changes in absolute dollar amounts.

Why the other options are incorrect:

A. Horizontal analysis
– Horizontal analysis compares financial statement line items across two or more periods to identify changes over time, such as year-over-year percentage changes in revenue or expenses. It focuses on trends over time, not on expressing individual line items as a percentage of a base figure within a single period, so it does not describe this calculation.

C. Ratio analysis
– Ratio analysis involves calculating financial ratios that express relationships between different financial statement items, such as the current ratio, debt-to-equity ratio, or return on assets. While expressing expenses as a percentage of revenue could loosely be considered a ratio, this specific technique, each line item as a percentage of a base figure within the same statement, is properly classified as vertical analysis, also called common-size analysis.

D. Trend analysis
– Trend analysis examines financial data over multiple periods to identify patterns, direction, and rates of change, such as revenue growth trends or expense trends. It looks at changes over time rather than expressing line items as percentages of a base within a single period, so it is not the technique used here.

Reference:

IIA-CIA-Part3 content area on Financial Management — Specifically financial statement analysis techniques, including vertical (common-size) analysis, horizontal analysis, ratio analysis, and trend analysis.

Explanation

A router is a networking device that connects different networks together, for example, connecting a local area network (LAN) to a wide area network (WAN) or the internet. Routers operate at Layer 3 (the network layer) of the OSI model and use IP addresses to determine the best path for forwarding data packets between networks. A switch, by contrast, connects devices within the same network, typically a LAN. Switches operate primarily at Layer 2 (the data link layer) and use MAC addresses to forward data frames to the correct device within the network. The essential distinction is that routers connect networks to each other, while switches connect devices within a single network. This makes option C the correct statement.

Why the other options are incorrect:

A. A router operates at layer two, while a switch operates at layer three of the open systems interconnection model
– This statement reverses the layers. A router operates primarily at Layer 3 (network layer) of the OSI model, while a switch operates primarily at Layer 2 (data link layer). The statement is therefore incorrect.

B. A router transmits data through frames, while a switch sends data through packets
– This statement also reverses the terminology. Routers forward data in the form of packets (Layer 3 protocol data units), while switches forward data in the form of frames (Layer 2 protocol data units). The statement is therefore incorrect.

D. A router uses a media access control address during the transmission of data, while a switch uses an internet protocol address
– This statement reverses the addressing mechanisms. Routers use IP addresses (Layer 3) to route packets between networks, while switches use MAC addresses (Layer 2) to forward frames within a network. The statement is therefore incorrect.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically network components, including routers, switches, and the OSI model.

Explanation

Remote wipe is a security feature that allows an organization to remotely erase data and restore a smart device to its default settings when the device is lost, stolen, or compromised. However, remote wipe has a significant limitation: it cannot guarantee that all data is completely removed from the device. Data may remain in residual form in unallocated storage areas, hidden partitions, system caches, or areas not covered by the wipe command. In addition, if the device is offline when the remote wipe command is issued, the wipe will not execute until the device reconnects. If the device is powered off, factory reset, or has its connectivity disabled, the wipe may never occur. Furthermore, data backed up to the cloud, synced to other devices, or stored on removable media is outside the scope of the remote wipe. For these reasons, complete removal of all data cannot be assured, making this the correct limitation.

Why the other options are incorrect:

A. Encrypted data cannot be locked to prevent further access
– This is incorrect. Remote wipe can lock encrypted data to prevent further access, typically by deleting the encryption keys or triggering a device lock. Locking encrypted data is actually one of the capabilities of remote wipe, not a limitation.

B. Default settings cannot be restored on the device
– This is incorrect. Restoring default, or factory, settings is a core function of remote wipe. When a remote wipe is executed successfully, the device is reset to its factory default configuration, so this is not a limitation.

D. Mobile device management software is required for successful remote wipe
– This is not a limitation of remote wipe itself but rather a deployment consideration. Many devices support remote wipe through built-in features, such as Find My Device or Exchange ActiveSync policies, without requiring full MDM software. While MDM enhances and centralizes remote wipe capabilities, it is not a strict requirement for remote wipe to function, so this is not the best description of its limitation.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically mobile device security, remote wipe capabilities, and limitations of mobile security controls.

Explanation

The primary role of an independent witness to the signing of a contract is to attest that the signatures on the contract were genuinely made by the parties named, that is, to validate that the promisor and promisee actually signed the document. By being physically present when the parties sign, the witness can later confirm, if necessary, that the signatures are authentic and were made by the persons whose names appear on the contract. This provides evidentiary support for the authenticity of the signatures and helps prevent disputes over whether a party actually signed the agreement. This is the fundamental purpose of having a witness to a contract signing.

Why the other options are incorrect:

A. A witness verifies the quantities of the copies signed
– The witness's role is not to verify how many copies of the contract are signed. While the number of copies may be documented administratively, counting copies is not the witness's primary function, which is to attest to the authenticity of the signatures.

B. A witness verifies that the contract was signed with the free consent of the promisor and promisee
– While free consent is a legal requirement for a valid contract, the witness is not primarily responsible for verifying that consent was freely given. The witness attests to the act of signing and the identity of the signatories, not to the internal state of mind or voluntariness of the parties. Issues of duress or undue influence would be addressed through other legal means.

C. A witness ensures the completeness of the contract between the promisor and promisee
– Ensuring the completeness of the contract, such as confirming that all pages and terms are present, is typically the responsibility of the parties and their legal counsel, not the witness. The witness's role is focused on the signing event and the authenticity of the signatures, not on verifying that the contract document is complete in all respects.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Contract Law and Procurement — Specifically the role of witnesses in contract execution and the requirements for valid contract signatures.

Explanation

Relevant costs are the costs that will be affected by a specific management decision, that is, the future costs that differ between alternatives. The concept of relevant cost helps management with behavioral analysis by focusing attention on only those costs that change as a result of a decision, while ignoring costs that do not differ, such as sunk costs or unavoidable fixed costs. This enables management to make better business decisions because it clarifies exactly what costs will be incurred for a given course of action and allows managers to compare alternatives on a like-for-like basis. By concentrating on relevant costs, management can avoid being misled by irrelevant or historical costs and can more accurately evaluate the financial consequences of its choices, which directly supports sound decision-making behavior.

Why the other options are incorrect:

A. It explains the assumption that both costs and revenues are linear through the relevant range
– This describes the concept of the relevant range and linear cost behavior assumptions used in cost-volume-profit analysis, not the concept of relevant cost. Relevant cost is about which costs matter for a specific decision, not about linearity assumptions.

B. It enables management to calculate a minimum number of units to produce and sell without having to incur a loss
– This describes break-even analysis, which determines the break-even point, the level of sales at which total revenues equal total costs. While relevant costs may be used in break-even analysis, the concept of relevant cost itself is not defined by calculating a minimum number of units to avoid a loss.

C. It enables management to predict how costs such as the depreciation of equipment will be affected by a change in business decisions
– This is partially related but not accurate as stated. Depreciation of existing equipment is often a sunk cost and therefore not relevant to a decision. Relevant cost focuses on future costs that differ between alternatives, not on predicting how all costs, including sunk costs like depreciation, will be affected. The statement mischaracterizes the concept.

Reference:

IIA-CIA-Part3 content area on Financial Management / Managerial Accounting — Specifically relevant costing, differential costs, and decision-making.

Explanation

In this scenario, the attack began with a phishing email that appeared to come from a legitimate vendor and contained a malicious Excel attachment. The cybercriminal gained access only after the manager opened the spreadsheet, which means the attack succeeded because a human being was deceived. The most effective control to prevent this type of attack is therefore employee education and awareness training, specifically training employees to recognize phishing attacks. When employees are trained to identify suspicious emails, verify sender addresses, avoid opening unexpected attachments, and report suspected phishing attempts, they become the first line of defense against social engineering attacks. Because the attack vector relies on human error rather than a purely technical vulnerability, no technical control can fully compensate for an untrained user who opens a malicious attachment, making employee education the most effective preventive control in this situation.

Why the other options are incorrect:

A. Monitoring network traffic
– Monitoring network traffic is a detective control that can help identify malicious activity after it occurs, but it does not prevent an employee from opening a malicious attachment in the first place. It may detect the attack in progress, but it is not the most effective control for preventing the initial compromise, which occurred through a phishing email.

B. Using whitelists and blacklists to manage network traffic
– Whitelists and blacklists are preventive controls that restrict network traffic to or from known good or bad addresses. While they can block some malicious traffic, they are not effective against phishing emails that come from spoofed or compromised legitimate vendor addresses, and they do not prevent a user from opening a malicious attachment.

C. Restricting access and blocking unauthorized access to the network
– Restricting network access and blocking unauthorized access are important preventive controls, but they do not prevent a user from opening a malicious attachment on an authorized device. Once the malware executes, the attacker may appear to be an authorized user, so this control alone would not have prevented the attack from succeeding.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically cybersecurity risks, phishing, social engineering, and security awareness training.

Explanation

Privacy principles generally require that personal information be retained only for as long as necessary to fulfill the purpose for which it was collected, or as required by law or regulation. Retaining customers' personal information indefinitely violates this principle because it goes beyond the legitimate business or legal need, increases the risk of unauthorized access, misuse, or data breach, and denies customers the ability to have their information properly disposed of when it is no longer needed. This practice is inconsistent with widely accepted privacy principles such as purpose limitation, data minimization, storage limitation, and disposal.

Why the other options are incorrect:

A. Customers can access and update personal information when needed
– This supports privacy principles because it gives customers control over their own information and helps ensure data accuracy. Allowing access and correction is consistent with individual participation and data quality principles, not a violation.

C. Customers reserve the right to reject sharing personal information with third parties
– This is consistent with privacy principles because it gives customers control over the use and disclosure of their personal information. Honoring customer choice regarding third-party sharing aligns with the principle of consent and use limitation, so it does not violate privacy principles.

D. The organization performs regular maintenance on customers' personal information
– Regular maintenance helps ensure that personal information is accurate, current, and complete. This supports the data quality principle of privacy, rather than violating it, so it is not a privacy violation.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically privacy principles, data protection, and personal information management.

Explanation

A one-time password (OTP) is a password that is valid for only one login session or transaction and is typically generated dynamically by a hardware device or software application. A key fob is a common hardware token device used to generate one-time passwords. It produces a new, time-synchronized or event-based code each time the employee needs to authenticate. The OTP generated by the key fob is used once and then becomes invalid, providing strong authentication because the password cannot be reused by an attacker even if it is intercepted. This makes the use of a key fob to produce a token the most likely situation in which a one-time password would be generated.

Why the other options are incorrect:

A. When an employee accesses an online digital certificate
– A digital certificate is an electronic credential used to verify identity and enable secure communications, such as SSL/TLS. Accessing a digital certificate does not generate a one-time password. Certificates use public key infrastructure (PKI) for authentication and encryption, not OTPs.

B. When an employee's biometrics have been accepted
– Biometric authentication verifies identity using physical or behavioral characteristics such as fingerprints, iris patterns, or facial recognition. When biometrics are accepted, the authentication is based on the biometric factor itself. No one-time password is generated as part of the biometric verification process.

C. When an employee creates a unique digital signature
– A digital signature is created using a private key to sign a document or message electronically, providing authentication, integrity, and non-repudiation. Creating a digital signature does not involve generating a one-time password. It uses cryptographic keys, not OTPs.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically authentication methods, including one-time passwords, hardware tokens, and multi-factor authentication.