IIA Updated IIA-CIA-Part3 Exam Questions and Answers by kaiden

The shortest completion time for a project network is determined by identifying the critical path, which is the longest path through the network. The project cannot be completed faster than the time required to complete all activities on that path because any delay on the critical path delays the entire project. From the exhibit, the possible paths are A plus E, B plus D, and A plus C plus D. Their durations are 10 + 12 = 22 days, 12 + 9 = 21 days, and 10 + 8 + 9 = 27 days. The longest path is A-C-D, totaling 27 days. Although the question asks for the shortest project completion time, that time equals the critical path duration. Therefore, the project can be completed in 27 days, making Option C correct.

Comprehensive and Detailed In-Depth Explanation:

File encryption protects the confidentiality and integrity of information during transmission and storage. It ensures that only authorized recipients can access the data by converting it into an unreadable format.

Option A (Firewalls) – Prevents unauthorized access to networks but does not secure data exchange.

Option B (Activity logs) – Tracks actions but does not protect data confidentiality.

Option C (Antivirus software) – Protects against malware but does not encrypt data in transit.

Thus, file encryption (Option D) is the best security control for protecting exchanged information.

The main objective of risk-based assurance is to demonstrate that audit observations are directly connected to organizational risks. By measuring the percentage of audit observations that can be tied to significant risks, the internal audit function shows that it is focusing on areas of importance to governance and risk management.

Options A, C, and D are useful performance metrics, but they do not measure the ability of internal audit to deliver risk-based assurance as directly as Option B.

Capacity overbuilding is most likely when management is production-focused. Production-oriented managers may emphasize scale, output, plant utilization, and operational expansion, sometimes without sufficient demand analysis. This can result in excess facilities, idle capacity, high fixed costs, inventory buildup, and reduced profitability. A marketing focus would normally begin with customer demand and market opportunity. A finance focus would emphasize return on investment, capital discipline, and cash flow. Diversification may create strategic risk, but it does not directly drive overbuilding in the same way as production orientation. Internal audit should evaluate whether capacity investments are supported by reliable forecasts, approved capital budgeting, sensitivity analysis, and post-implementation reviews. Therefore, Option C is correct.