Free IIA-CIA-Part3 Practice Test Questions 2026

An internal auditor considers the financial statement of an organization as part of a financial assurance engagement. The auditor expresses the organization's electricity and depreciation expenses as a percentage of revenue to be 10% and 7% respectively. Which of the following techniques was used by the internal auditor In this calculation?

A. Horizontal analysis

B. Vertical analysis

C. Ratio analysis

D. Trend analysis

Which of the following statements distinguishes a router from a typical switch?

A. A router operates at layer two. while a switch operates at layer three of the open systems interconnection model.

B. A router transmits data through frames, while a switch sends data through packets.

C. A router connects networks, while a switch connects devices within a network.

D. A router uses a media access control address during the transmission of data, whie a switch uses an internet protocol address.

At one organization, the specific terms of a contract require both the promisor end promise to sign the contract in the presence of an independent witness.
What is the primary role to the witness to these signatures?

A. A witness verifies the quantities of the copies signed.

B. A witness verifies that the contract was signed with the free consent of the promisor and promise.

C. A witness ensures the completeness of the contract between the promisor and promise.

D. A witness validates that the signatures on the contract were signed by tire promisor and promise.

Which of the following is a limitation of the remote wipe for a smart device?

A. Encrypted data cannot be locked to prevent further access

B. Default settings cannot be restored on the device.

C. All data, cannot be completely removed from the device

D. Mobile device management software is required for successful remote wipe

At one organization, the specific terms of a contract require both the promisor and promisee to sign the contract in the presence of an independent witness. What is the primary role to the witness to these signatures?

A. A witness verifies the quantities of the copies signed.

B. A witness verifies that the contract was signed with the free consent of the promisor and promisee.

C. A witness ensures the completeness of the contract between the promisor and promisee.

D. A witness validates that the signatures on the contract were signed by the promisor and promisee.

How can the concept of relevant cost help management with behavioral analyses?

A. It explains the assumption mat both costs and revenues are linear through the relevant range

B. It enables management to calculate a minimum number of units to produce and sell without having to incur a loss.

C. It enables management to predict how costs such as the depreciation of equipment will be affected by a change in business decisions

D. It enables management to make business decisions, as it explains the cost that will be incurred for a given course of action

A manager at a publishing company received an email that appeared to be from one of her vendors with an attachment that contained malware embedded in an Excel spreadsheet . When the spreadsheet was opened, the cybercriminal was able to attack the company's network and gain access to an unpublished and highly anticipated book. Which of the following controls would be most effective to prevent such an attack?

A. Monitoring network traffic.

B. Using whitelists and blacklists to manage network traffic.

C. Restricting access and blocking unauthorized access to the network

D. Educating employees throughout the company to recognize phishing attacks.

An organization prepares a statement of privacy to protect customers' personal information. Which of the following might violate the privacy principles?

A. Customers can access and update personal information when needed.

B. The organization retains customers' personal information indefinitely.

C. Customers reserve the right to reject sharing personal information with third parties.

D. The organization performs regular maintenance on customers' personal information.

A one-time password would most likely be generated in which of the following situations?

A. When an employee accesses an online digital certificate

B. When an employee's biometrics have been accepted.

C. When an employee creates a unique digital signature,

D. When an employee uses a key fob to produce a token.

Which of the following is considered a physical security control?

A. Transaction logs are maintained to capture a history of system processing.

B. System security settings require the use of strong passwords and access controls.

C. Failed system login attempts are recorded and analyzed to identify potential security incidents.

D. System servers are secured by locking mechanisms with access granted to specific individuals.

Which of the following information security controls has the primary function of preventing unauthorized outside users from accessing an organization's data through the organization's network?

A. Firewall.

B. Encryption.

C. Antivirus.

D. Biometrics.

Which of the following is true of matrix organizations?

A. A unity-of-command concept requires employees to report technically, functionally, and administratively to the same manager.

B. A combination of product and functional departments allows management to utilize personnel from various Junctions.

C. Authority, responsibility and accountability of the units Involved may vary based on the project's life, or the organization's culture

D. It is best suited for firms with scattered locations or for multi-line, Large-scale firms.