IIA Updated IIA-CIA-Part3 Exam Questions and Answers by tara

Preventive security controls proactively stop unauthorized access before it occurs. The most effective method is strict access management, where new or additional access rights require formal validation before being granted.

Prevents Unauthorized Entry – Ensures that only approved personnel have access to the power plant.

Implements Segregation of Duties (SoD) – Supervisors validate access requests, reducing insider threats.

Aligns with Least Privilege Principle – Employees get only the minimum access necessary for their role.

Prevents Security Risks Before They Happen – Unlike detective or corrective controls, this method stops unauthorized access before it occurs.

A. Offboarding procedure (monthly review) – This is a detective control, identifying issues after access is granted, not preventing them.

B. Smart lock anomaly scanning – Also detective, as it identifies suspicious behavior after access has been used.

D. Automatic notifications for after-hours entry – A corrective control, responding to potential violations instead of preventing them.

IIA’s GTAG on Identity and Access Management – Recommends pre-approval processes for sensitive locations.

ISO 27001 Annex A.9 (Access Control) – Requires role-based access management for critical infrastructures.

NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems) – Defines supervisor approval as a key preventive measure.

Why Approval-Based Access Control is the Best Preventive Measure?Why Not the Other Options?IIA References:

User-Developed Applications (UDAs) are software tools, typically spreadsheets or small databases, created by business users rather than IT professionals. These applications often lack formal security, documentation, and control measures, increasing the risk of data errors, unauthorized access, and compliance failures.

UDAs are often created quickly to meet immediate business needs, without following IT governance, security controls, or development standards.

Unlike traditional IT applications, UDAs lack structured testing, change management, and formal documentation.

The IIA’s GTAG 14 – Auditing User-Developed Applications states that UDAs present higher risks because they are not subject to the same controls as IT-managed applications.

A. UDAs and traditional IT applications typically follow a similar development life cycle → Incorrect. Traditional IT applications follow a formal Software Development Life Cycle (SDLC), whereas UDAs are developed informally by end-users.

B. A UDA usually includes system documentation to illustrate its functions, and IT-developed applications typically do not require such documentation. → Incorrect. IT applications require extensive documentation, whereas UDAs often lack documentation entirely.

D. IT testing personnel usually review both types of applications thoroughly to ensure they were developed properly. → Incorrect. IT applications undergo rigorous testing and quality assurance, while UDAs often bypass IT reviews altogether.

IIA GTAG 14 – Auditing User-Developed Applications highlights the risks of UDAs and emphasizes the need for internal controls.

COBIT Framework (Control Objectives for Information and Related Technologies) recommends IT governance measures for all business-critical applications.

ISO 27001 (Information Security Management System) warns against uncontrolled user-developed applications due to security risks.

Why Option C is Correct?Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is C. Unlike traditional IT applications, UDAs typically are developed with little consideration of controls.

The ability of user-developed spreadsheets to meet user needs is generally a benefit, not a concern. Spreadsheets are often created because they are flexible, fast, and tailored to specific business requirements. However, reliance on user-developed spreadsheets creates risks when they become increasingly complex, interface with corporate systems without proper controls, or contain hidden columns, formulas, worksheets, or undocumented logic. These risks can lead to errors, unauthorized changes, incomplete data, and unreliable reporting. Internal audit should evaluate spreadsheet governance, access protection, version control, formula integrity, review procedures, change tracking, and backup. Since meeting user needs is the positive reason spreadsheets are used, not a concern, Option C is correct.