Free IIA IIA-CIA-Part3 Practice Exam with Questions & Answers | Set: 16

Understanding Copyright Issues and Smart Devices:

Copyright laws protect software, firmware, and intellectual property embedded in smart devices.

Jailbreaking refers to modifying a device’s software to remove manufacturer-imposed restrictions, often to install unauthorized third-party apps.

This violates software licensing agreements and may infringe on copyright protections under laws like the Digital Millennium Copyright Act (DMCA).

Why Option B (Jailbreaking) Is Correct?

Jailbreaking allows users to bypass manufacturer restrictions, potentially leading to unauthorized software distribution and copyright violations.

Manufacturers implement Digital Rights Management (DRM) to protect copyrighted firmware and software, which jailbreaking circumvents.

IIA Standard 2110 – Governance includes evaluating intellectual property risks and compliance in IT audits.

Why Other Options Are Incorrect?

Option A (Session hijacking):

This is a cybersecurity attack where a hacker takes control of a user session. It does not impact copyright laws.

Option C (Eavesdropping):

Eavesdropping refers to unauthorized network surveillance, which is a privacy issue, not a copyright issue.

Option D (Authentication):

Authentication is a security mechanism to verify user identity and has no direct relation to copyright concerns.

Jailbreaking bypasses copyright protections and violates software licensing agreements, making it the best answer.

IIA Standard 2110 emphasizes the importance of IT governance and compliance with intellectual property laws.

Final Justification:IIA References:

IPPF Standard 2110 – Governance (Intellectual Property & IT Compliance)

ISO 27001 – IT Security & Digital Rights Protection

Digital Millennium Copyright Act (DMCA) – Copyright Protection for Software

Transfer pricing regulations aim to prevent tax evasion and ensure that intercompany transactions reflect fair market value, preventing profit shifting to low-tax jurisdictions. Selling inventory at fair value (arm’s length price) aligns with regulatory requirements, reducing the risk of non-compliance.

(A) Correct – The organization sells inventory to an overseas subsidiary at fair value.

Ensuring that transactions reflect fair market value prevents regulatory violations.

Adhering to the arm’s length principle minimizes transfer pricing risks and potential tax penalties.

(B) Incorrect – The local subsidiary purchases inventory at a discounted price.

A discounted price could be seen as an attempt to shift profits between entities, increasing regulatory scrutiny.

(C) Incorrect – The organization sells inventory to an overseas subsidiary at the original cost.

Selling at the original cost does not account for market conditions, potential markup, and fair valuation.

Regulators may view this as non-compliance with the arm’s length principle.

(D) Incorrect – The local subsidiary purchases inventory at the depreciated cost.

Depreciated cost may not represent fair market value and could be interpreted as a tax avoidance mechanism.

IIA’s Global Internal Audit Standards – Compliance with Tax and Transfer Pricing Regulations

Emphasizes fair pricing in intercompany transactions to prevent regulatory violations.

OECD Transfer Pricing Guidelines

Reinforces the arm’s length principle as the standard for pricing related-party transactions.

COSO’s ERM Framework – Compliance Risk Management

Highlights the need for adherence to tax laws and fair-value pricing in financial transactions.

Analysis of Answer Choices:IIA References and Internal Auditing Standards:

Authorization controls ensure that users have appropriate access levels based on their roles and responsibilities. The primary concern arises when all users have uniform access, as it violates the principle of least privilege (PoLP) and increases the risk of unauthorized access and data breaches.

(A) Users can only see certain screens in the system.

Incorrect. This is a good security practice, as it limits user access based on job roles, preventing unauthorized access to sensitive information.

(B) Users are making frequent password change requests.

Incorrect. Frequent password resets might indicate poor password management but are not directly related to authorization controls.

(C) Users input incorrect passwords and get denied system access.

Incorrect. This indicates authentication issues, not an authorization control concern. If users are denied access due to incorrect passwords, the system’s authentication mechanisms are working correctly.

(D) Users are all permitted uniform access to the system. ✅

Correct. Authorization should be role-based, meaning different users should have different levels of access depending on their responsibilities. Uniform access violates security best practices and increases the risk of fraud, data misuse, and compliance violations.

IIA GTAG " Identity and Access Management " emphasizes that authorization controls should be based on job functions to prevent unnecessary exposure to sensitive data.

IIA Standard 2120 – Risk Management highlights the importance of access control policies to mitigate cybersecurity risks.

IIA GTAG – " Identity and Access Management "

IIA Standard 2120 – Risk Management

COBIT Framework – Access Control and Identity Management

Analysis of Answer Choices:IIA References:Thus, the correct answer is D, as uniform access across all users is a major security concern in authorization control.

Effectiveness means achieving stated objectives. Efficiency means achieving results with optimal use of resources. The organization achieved its market share goal, so it was effective in reaching that objective. However, it failed to achieve the desired return on investment and output per labor hour, both of which indicate poor efficiency or resource productivity. Option A and B incorrectly frame the issue as a choice between capital investment and marketing. Option C is incorrect because the organization is not demonstrating efficiency; the poor output per labor hour shows the opposite. Internal audit should distinguish effectiveness from efficiency when evaluating performance. A process can achieve its goal while still using too many resources or generating weak returns. Therefore, Option D is correct.

When examining risk management, internal audit must evaluate risk exposures relating to governance, operations, and information systems. Governance risks concern oversight, ethics, accountability, and decision-making. Operational risks concern efficiency, effectiveness, asset protection, and achievement of business objectives. Information systems risks concern confidentiality, integrity, availability, reliability, and security of information. Organizational structure may influence risk ownership and control accountability, but it is not listed here as one of the main required exposure categories in the same way as governance, operations, and information systems. Internal audit planning should therefore assess whether key risk exposures across governance, operations, and technology are identified, assessed, and managed within risk appetite. The correct combination is items 1, 2, and 3 only. Therefore, Option C is correct.

Security awareness training is the most effective option listed for preventing phishing attacks from impacting business systems because phishing relies heavily on deceiving users. Employees must be able to recognize suspicious links, spoofed domains, unusual payment requests, fake login pages, malicious attachments, and social engineering indicators. Monitoring system usage may detect suspicious activity after exposure. Malware detection is useful but may not prevent credential theft or fraudulent instructions if the user is deceived. Blocking user accounts is a response action, not a broad preventive control. Internal audit should evaluate whether phishing training is recurring, practical, tested through simulations, and supported by reporting channels. Since user behavior is central to phishing defense, Option A is correct.

Treasury stock transactions are equity transactions, not income statement transactions. The organization originally acquired the treasury shares at $10 per share, so the treasury stock cost is $10,000. When it sells 1,000 shares at $15 per share, it receives cash of $15,000 and removes treasury stock at its $10,000 cost. The excess of $5,000 is credited to additional paid-in capital from treasury stock transactions. It is not recorded as a gain because treasury stock transactions do not create income. Option B is incorrect because treasury stock should be credited, not debited, when reissued. Option D is also incorrect. Therefore, Option C is correct.

The existing control relies mainly on the license plate number, which may be stolen, duplicated, misread, or attached to a different vehicle. Adding physical characteristics of the vehicle to the system strengthens authorization by allowing the security guard or automated system to compare the plate with the expected vehicle type, color, make, model, or other identifying features. Questioning the driver only when the guard has doubts is inconsistent and subjective. Sending each request to administrative personnel would be inefficient and may delay operations. Video surveillance provides evidence but is primarily detective unless actively integrated into the authorization decision. Internal audit should evaluate whether physical access controls verify both credentials and the asset being admitted. Therefore, Option B is correct.

The Internet of Things connects sensors, machines, devices, and systems so operational data can be captured and transmitted continuously. In a manufacturing plant, the primary benefit is real-time monitoring of production equipment, output, temperature, vibration, downtime, quality indicators, and maintenance conditions. This allows management to detect production issues quickly, reduce downtime, improve preventive maintenance, and optimize throughput. IoT may introduce cybersecurity and data-integrity concerns, but securing sensitive data and detecting cyberattacks are not its main production-process benefit. Data integrity also requires additional controls over devices, transmission, storage, and analytics. Internal auditors should evaluate IoT governance, access control, device security, monitoring, and operational reliance. Therefore, Option A is correct.