IIA Updated IIA-CIA-Part3 Exam Questions and Answers by rahma

Multi-report summaries are designed to provide senior management and the board with aggregated results across multiple audit engagements. To make them effective, internal audit functions typically rate findings (e.g., high, medium, low) so results can be compared and summarized efficiently.

Option A is incomplete because summaries are not just about describing audit work but about presenting meaningful insights. Option B (tables) refers to presentation style, not the key principle. Option C is incorrect because even if boards review individual reports, summaries provide strategic insights across engagements.

Thus, the correct answer is Option D.

Big data is characterized by the 4 Vs:

Volume – Large amounts of data.

Velocity – Data is generated rapidly and continuously changing.

Variety – Data comes in multiple formats (structured, unstructured, multimedia, etc.).

Veracity – Ensuring data quality and reliability.

Among these, constant change (velocity) is a defining characteristic of big data.

(A) Incorrect – Big data is being generated slowly due to volume.

Big data is generated at high speed (velocity), not slowly.

(B) Incorrect – Big data must be relevant for the purposes of organizations.

While relevance is important, it is not a defining characteristic of big data.

(C) Incorrect – Big data comes from a single type of format.

Big data consists of multiple formats, including text, images, videos, and unstructured data.

(D) Correct – Big data is always changing.

Big data is dynamic and constantly updated in real-time.

This high velocity and continuous flow of information is a key characteristic.

IIA’s GTAG (Global Technology Audit Guide) – Big Data and Analytics

Describes how big data is constantly evolving.

NIST Big Data Framework – Key Characteristics

Defines volume, velocity, variety, and veracity as essential traits.

COBIT Framework – IT Governance and Data Management

Emphasizes the need for organizations to manage rapidly changing data.

Analysis of Answer Choices:IIA References and Internal Auditing Standards:

The issue described suggests a systemic authorization flaw, where users gain unrestricted access once logged in. This points to an improperly configured authorization system, which should enforce role-based or least-privilege access to restrict users based on their job responsibilities.

(A) Incorrect – The authentication process relies on a simple password only, which is a weak method of authorization.

While weak authentication is a security risk, the issue described relates to excessive access permissions, not weak login credentials.

(B) Correct – The system authorization of the user does not correctly reflect the access rights intended.

The problem is that users have access to all functionality, which indicates an authorization issue, not an authentication flaw.

Proper role-based access controls (RBAC) should limit user permissions based on job functions.

(C) Incorrect – There was no periodic review to validate access rights.

While periodic reviews are important for detecting unauthorized access, the issue here is a system-level authorization design flaw rather than a failure in periodic reviews.

(D) Incorrect – The application owner apparently did not approve the access request during the provisioning process.

Even if an access request was approved incorrectly, the broader issue remains that all users have unrestricted access, which suggests a system misconfiguration rather than a single provisioning error.

IIA’s GTAG (Global Technology Audit Guide) – Access Control and Authorization

Emphasizes the need for role-based access control (RBAC) to prevent unauthorized access.

COBIT Framework – IT Security Governance

Discusses proper authorization mechanisms to align system access with business needs.

NIST Cybersecurity Framework – Access Management Controls

Recommends restricting access rights based on the principle of least privilege (PoLP).

Analysis of Answer Choices:IIA References and Internal Auditing Standards:

Two-level (or multi-factor) authentication (MFA) is the most efficient and effective security control for authenticating customers when accessing online shopping accounts. It provides an extra layer of security beyond just passwords, making it more difficult for unauthorized users to gain access.

Stronger Authentication – It requires two independent verification methods, such as:

Something you know (password, PIN)

Something you have (one-time code, mobile device, smart card)

Something you are (biometric feature)

Reduces Risk of Credential Theft – Even if hackers obtain a user's password, they still need the second factor to gain access.

Meets Regulatory Standards – Many cybersecurity frameworks (NIST, ISO 27001, PCI-DSS) recommend or mandate MFA for customer authentication.

Enhanced Customer Trust – Provides users with better security, reducing risks of fraud or account takeovers.

A. 12-digit password feature – Longer passwords improve security, but they can still be compromised through phishing or brute force attacks.

B. Security question feature – These are often weak because users choose predictable answers (e.g., mother's maiden name).

C. Voice recognition feature – Biometric authentication is useful, but voice recognition can be bypassed using deepfake or recorded audio.

IIA’s GTAG (Global Technology Audit Guide) on Information Security Management – Recommends multi-factor authentication for access control.

IIA’s International Professional Practices Framework (IPPF) – Standard 2110.A2 – Highlights the need for strong security controls to protect customer data.

NIST SP 800-63 (Digital Identity Guidelines) – Encourages multi-factor authentication as a best practice for securing user accounts.

Why Two-Level Sign-On (MFA) Is the Best Choice?Why Not the Other Options?IIA References:✅ Final Answer: D. Two-level sign-on feature (Most effective for online customer authentication).

===============