IIA Updated IIA-CIA-Part3 Exam Questions and Answers by ariyan

Biometric access controls use unique physical or behavioral characteristics for identification and security. Among the listed options, retinal print comparison is the most unique and secure, as it relies on the intricate patterns of blood vessels in the retina, which are nearly impossible to replicate or alter.

(A) Facial comparison using photo identification.

Incorrect: Facial recognition is widely used but less unique than retinal scanning because it can be affected by lighting, aging, or facial hair.

IIA GTAG 9 – Identity and Access Management mentions facial recognition as a medium-security method.

(B) Signature comparison.

Incorrect: Signatures can be forged or changed over time, making this a low-security biometric method.

(C) Voice comparison.

Incorrect: Voice patterns are unique but can be affected by illness, background noise, or recording quality, reducing reliability.

(D) Retinal print comparison. (Correct Answer)

Retinal patterns are highly unique, more than fingerprints, and do not change over time.

Difficult to forge, making it the most secure biometric authentication method.

IIA GTAG 9 – Identity and Access Management ranks retinal scanning among the highest security biometric controls.

IIA GTAG 9 – Identity and Access Management: Discusses biometric authentication and ranks retinal scanning as one of the most secure options.

IIA Standard 2120 – Risk Management: Emphasizes strong authentication controls for access security.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (D) Retinal print comparison because it is the most unique, secure, and reliable biometric characteristic for authentication.

A disaster recovery plan (DRP) outlines how an organization will restore IT operations after a disruption. The type of recovery site determines how quickly systems can be brought back online.

Why a Warm Site Recovery Plan is Correct?A warm site is a partially configured backup location with some hardware and software ready, but it requires additional configuration before it can fully support production operations.

Faster than a Cold Site – Unlike a cold site, a warm site has pre-installed infrastructure, reducing downtime.

Requires Some Setup – Unlike a hot site, which is fully operational, a warm site needs configuration and software setup before use.

Balances Cost and Readiness – Less expensive than a hot site while offering faster recovery than a cold site.

B. Hot site recovery plan – A hot site is fully operational and can immediately take over in case of failure.

C. Cool site recovery plan – This is not a standard industry term in disaster recovery.

D. Cold site recovery plan – A cold site has only basic infrastructure (e.g., power and space) and lacks pre-installed hardware/software, requiring much more setup time.

IIA’s GTAG on Business Continuity Management – Defines recovery site options based on operational risk.

ISO 22301 (Business Continuity Management System) – Specifies warm sites as an intermediate recovery solution.

NIST SP 800-34 (Contingency Planning Guide for IT Systems) – Describes warm sites as partially pre-configured recovery environments.

Why Not the Other Options?IIA References:

Social engineering is a psychological manipulation technique used by attackers to trick individuals into divulging sensitive information. Instead of exploiting technical vulnerabilities, it targets human weaknesses such as trust, fear, or urgency.

Manipulates Human Behavior – The attacker impersonates a trusted entity (a bank representative) to deceive the employee.

Leads to Unauthorized Information Disclosure – The employee unknowingly provides sensitive financial data.

Results in Fraud – The stolen information is misused, causing financial loss.

A. Shoulder Surfing – This occurs when an attacker physically observes someone entering sensitive data (e.g., watching a person type a password).

B. Pharming – This involves redirecting users to a fraudulent website to steal their credentials, not direct impersonation.

C. Phishing – This is a broad category of social engineering that typically involves emails or fake websites, whereas this scenario describes a direct impersonation attack.

IIA’s GTAG on Cybersecurity – Discusses social engineering as a key risk for organizations.

NIST SP 800-61 (Incident Handling Guide) – Identifies social engineering as a common attack vector.

COBIT 2019 (IT Governance Framework) – Highlights human-related cybersecurity risks.

Why Social Engineering is the Correct Answer?Why Not the Other Options?IIA References:

When performing data analytics, the process typically follows a structured approach. Once the internal auditor has determined the expected value from the review, the next logical step is to obtain the data. Without acquiring the necessary datasets, further actions such as normalization, risk identification, and analysis cannot be effectively carried out.

(A) Incorrect – Normalize the data.

Normalization is a preprocessing step that occurs after data has been obtained.

Before normalizing, the auditor must first access and collect relevant data sources.

(B) Correct – Obtain the data.

Data acquisition is a critical step in data analytics.

The auditor must gather relevant and reliable data from internal and external sources before proceeding with further steps such as cleansing, normalization, and analysis.

(C) Incorrect – Identify the risks.

Risk identification is an essential part of the audit process but typically comes after obtaining and reviewing data patterns.

Without data, identifying risks would be speculative rather than evidence-based.

(D) Incorrect – Analyze the data.

Data analysis comes after obtaining, cleaning, and structuring the data.

Jumping straight to analysis without ensuring data quality would lead to inaccurate conclusions.

IIA’s GTAG (Global Technology Audit Guide) – Data Analytics

Recommends obtaining data as the initial step in data-driven audits.

IIA’s Global Internal Audit Standards – Use of Data Analytics in Auditing

Stresses the importance of data acquisition before proceeding with normalization and analysis.

COSO’s ERM Framework – Data-Driven Decision Making

Highlights the importance of securing data for risk identification and mitigation.

Analysis of Answer Choices:IIA References and Internal Auditing Standards: