ExpertCPA®
CPA ISC Practice Exam 5
82 free questions · No sign-up required to browse
Comprehensive practice exam for the CPA Information Systems and Controls (ISC) discipline. This exam covers Information Systems and Data Management, Security, Confidentiality and Privacy, and SOC Engagements based on the 2026 AICPA Blueprint.
82
Questions
Hard
Difficulty
75%
Pass mark
Difficulty breakdown
Easy(18)
Medium(45)
Hard(19)
Topics covered
Browse all topics →Area I: Information SystemsArea I: Information SystemsArea I: Information SystemsArea I: Information SystemsArea I: Information SystemsArea I: Information SystemsArea I: Information SystemsArea I: Information SystemsArea II: SecurityArea II: SecurityArea II: SecurityArea II: SecurityArea II: SecurityArea II: SecurityArea III: SOC EngagementsArea III: SOC EngagementsArea III: SOC EngagementsArea III: SOC Engagements
Sample questions
Q01Medium1 mark
A service organization provides a cloud-based payroll processing application to its user entities. The user entities access the software via a web browser, but the service organization manages the underlying infrastructure, operating system, and application updates. Which cloud service model is the service organization providing?
Q02Hard1 mark
An auditor is reviewing the shared responsibility model for a client using an Infrastructure as a Service (IaaS) provider. Which of the following responsibilities typically remains with the client (user entity) rather than the cloud provider?
Q03Medium1 mark
A financial institution requires a cloud deployment model that offers the highest level of control and isolation for its sensitive data, even if it requires higher costs and maintenance. Which deployment model is most appropriate?
Q04Medium1 mark
During an IT audit, you observe that a company uses a 'Hybrid Cloud' architecture. Which scenario best describes this architecture?
Q05Easy1 mark
Which component of IT architecture is primarily responsible for translating domain names (like www.aicpa.org) into IP addresses that computers use to communicate?
Ready to Practice the full exam?
All 82 questions with worked answers, mark schemes, and AI tutoring.
All questions (82)
Free to browse · no sign-up requiredQ01A service organization provides a cloud-based payroll processing application to its user entities. The user entities ...MediumQ02An auditor is reviewing the shared responsibility model for a client using an Infrastructure as a Service (IaaS) prov...HardQ03A financial institution requires a cloud deployment model that offers the highest level of control and isolation for ...MediumQ04During an IT audit, you observe that a company uses a 'Hybrid Cloud' architecture. Which scenario best describes this...MediumQ05Which component of IT architecture is primarily responsible for translating domain names (like www.aicpa.org) into IP...EasyQ06In the context of COSO Enterprise Risk Management, which principle is most relevant when an organization evaluates th...MediumQ07An auditor is reviewing the 'Order-to-Cash' process. The documented flowchart indicates that a credit check is perfor...HardQ08A company uses a private blockchain to record supply chain transactions. Which of the following is a unique risk asso...HardQ09An auditor is testing processing integrity controls for a payroll system. The auditor inputs a test transaction with ...MediumQ10Which of the following best describes the 'Three-Way Match' control in a procurement process?MediumQ11A company is implementing an ERP system. Which of the following represents a 'Segregation of Duties' conflict that sh...HardQ12In a batch processing system for utility billing, which control would best detect if a transaction file was processed...MediumQ13A company has a Recovery Point Objective (RPO) of 4 hours. They currently perform a full backup every Sunday at midni...HardQ14Which disaster recovery site option provides the fastest recovery time (lowest RTO) but incurs the highest cost?EasyQ15A database administrator implements 'disk mirroring' (RAID 1). Which availability risk does this primarily mitigate?MediumQ16What is the primary difference between a Differential Backup and an Incremental Backup?MediumQ17During a SOC 2 engagement, you observe that the organization tests its Disaster Recovery Plan (DRP) annually using a ...EasyQ18Which of the following metrics would be most critical to review when assessing the effectiveness of an organization's...MediumQ19An auditor observes that a developer has 'write' access to the production environment to fix urgent bugs. The develop...MediumQ20In a formal change management process, which testing stage is performed by the end-users to verify the system meets b...EasyQ21A company uses a 'Continuous Integration/Continuous Deployment' (CI/CD) pipeline. An auditor notes that code is autom...HardQ22Which document should be updated immediately following an emergency change to the production system?EasyQ23An auditor is reviewing a population of changes. They select a sample of changes and trace them back to the Change Re...HardQ24Which environment is used to combine individual software modules and test their interaction before UAT?MediumQ25An auditor wants to extract all customers from the 'Sales' table who live in 'NY' and spent more than $1,000. Which S...EasyQ26Review the following SQL query:<br/>SELECT CustomerID, SUM(OrderAmount)<br/>FROM Orders<br/>GROUP BY CustomerID<br/>H...HardQ27Which data storage concept refers to a vast pool of raw, undefined data (structured and unstructured) stored for futu...MediumQ28In the ETL (Extract, Transform, Load) process, at which stage is data cleaned, deduplicated, and converted into a con...EasyQ29An auditor is validating the completeness of a data migration from a legacy system to a new ERP. Which procedure is m...MediumQ30Which SQL command is used to combine rows from two or more tables based on a related column between them?MediumQ31Under the HIPAA Security Rule, which of the following is a 'Covered Entity'?MediumQ32A European customer requests that a US-based company delete all their personal data. Under GDPR, this is known as:EasyQ33Which PCI DSS requirement falls under the goal of 'Protect Cardholder Data'?HardQ34The NIST Cybersecurity Framework (CSF) is organized into five core functions. Which function involves developing and ...MediumQ35Which component of COBIT 2019 describes the 'Governance System'?HardQ36According to the CIS Controls v8, what is Control 1 (the most foundational control)?MediumQ37NIST Special Publication 800-53 is primarily designed for:MediumQ38Which part of the NIST Privacy Framework helps organizations determine their current privacy posture and their target...HardQ39An employee receives an email appearing to be from the CEO asking for an urgent wire transfer. The email address is s...EasyQ40A web application allows users to input text into a comment field. A malicious user enters a script that executes in ...MediumQ41Which stage of the 'Cyber Kill Chain' involves the attacker installing a backdoor or remote access trojan (RAT) to ma...MediumQ42What is the primary purpose of a Distributed Denial of Service (DDoS) attack?EasyQ43Which of the following is a characteristic of an 'Advanced Persistent Threat' (APT)?MediumQ44An organization implements a 'Zero Trust' architecture. Which principle is central to this approach?MediumQ45Which authentication factor is represented by a fingerprint scan?EasyQ46A network administrator separates the Finance department's network traffic from the Engineering department's traffic ...MediumQ47Which security device is primarily designed to detect and block malicious traffic patterns or signatures in real-time?MediumQ48In an Identity and Access Management (IAM) system, 'Role-Based Access Control' (RBAC) assigns permissions based on:EasyQ49Which cryptographic concept ensures that a message has not been altered in transit?MediumQ50An auditor is reviewing the results of a penetration test. The report identifies a 'Critical' vulnerability involving...MediumQ51What is the primary difference between Vulnerability Scanning and Penetration Testing?MediumQ52During a security walkthrough, an auditor notices that employees are writing passwords on sticky notes attached to th...EasyQ53Which type of security test involves the tester having full knowledge of the system (network diagrams, source code, I...EasyQ54A company replaces sensitive credit card numbers in their database with a random string of characters that has no mat...MediumQ55Which encryption type uses a public key to encrypt and a private key to decrypt?MediumQ56Data Loss Prevention (DLP) tools are primarily designed to:MediumQ57What is the difference between Confidentiality and Privacy?HardQ58Which phase of the data lifecycle involves securely removing data when it is no longer needed?EasyQ59In Incident Response, what is the primary goal of the 'Containment' phase?MediumQ60A company purchases cyber insurance. Which risk management strategy is this?EasyQ61What is the difference between an 'Event' and an 'Incident' in cybersecurity?MediumQ62After a ransomware attack is resolved, the team holds a 'Lessons Learned' meeting. What is the primary output of this...MediumQ63A service organization's clients need assurance regarding the controls over financial reporting. Which SOC report is ...MediumQ64Which of the following is NOT one of the five Trust Services Criteria categories used in SOC 2 engagements?HardQ65A service organization wants a report to display on their website for potential customers to prove they are secure. T...MediumQ66What is the primary difference between a Type I and a Type II SOC report?MediumQ67In a SOC 2 engagement, which criteria is MANDATORY for every report?MediumQ68A service organization uses a subservice organization for data center hosting. The service organization's auditor dec...HardQ69When using the 'Inclusive' method for a subservice organization, what is the service auditor's responsibility?HardQ70What are 'Complementary User Entity Controls' (CUECs)?MediumQ71In planning a SOC 2 engagement, the auditor must assess 'Materiality'. How is materiality typically viewed in a SOC 2...HardQ72Which section of a SOC 2 report contains the Management's Assertion?MediumQ73During a SOC 2 Type II engagement, an auditor finds that a daily backup failed 3 times out of 365 days. The backups w...HardQ74Which testing procedure provides the highest level of assurance for operating effectiveness?MediumQ75An auditor is testing a control that states 'All new hires must undergo a background check'. The auditor selects a sa...EasyQ76In a SOC engagement, what is the purpose of the 'System Description'?MediumQ77If an auditor discovers a 'Subsequent Event' (after the period end but before the report date) that significantly aff...HardQ78Which opinion type is issued when the system description is fairly presented and controls are effective, EXCEPT for o...MediumQ79What constitutes an 'Adverse Opinion' in a SOC report?MediumQ80In a SOC 2 report, where would a user find the auditor's detailed tests and the results of those tests?EasyQ81A service organization refuses to provide a written assertion (Section II). What must the auditor do?HardQ82Which of the following statements is TRUE regarding the use of a SOC 2 report?Medium