CBA Information Technology Audits 2 — Questions and Answers
Question 1: During an IT audit, an auditor finds that a bank's privileged user accounts are shared among multiple administrators. What is the PRIMARY concern?
- Increased licensing costs
- Inability to establish individual accountability (Correct answer)
- Slower system performance
- Difficulty in password rotation
Correct answer: Inability to establish individual accountability
Shared privileged accounts eliminate individual accountability, making it impossible to attribute specific actions to a particular user during investigations.
Question 2: Which framework is MOST commonly used by bank IT auditors to evaluate IT governance and management practices?
- ITIL
- COBIT (Correct answer)
- Six Sigma
- PMBoK
Correct answer: COBIT
COBIT (Control Objectives for Information and Related Technologies) is the primary framework used to evaluate IT governance and management in banking environments.
Question 3: A bank's core banking system processes transactions without maintaining a complete audit log. Which risk does this PRIMARILY create?
- Increased system downtime
- Inability to detect and investigate unauthorized transactions (Correct answer)
- Higher storage costs
- Slower transaction processing
Correct answer: Inability to detect and investigate unauthorized transactions
Without complete audit logs, the bank cannot detect unauthorized transactions, investigate fraud, or demonstrate regulatory compliance.
Question 4: When auditing a bank's patch management process, what should an auditor verify FIRST?
- The cost of patch deployment tools
- The number of IT staff responsible for patching
- The existence of a formal policy defining patch testing and deployment timelines (Correct answer)
- The vendor support contracts for all systems
Correct answer: The existence of a formal policy defining patch testing and deployment timelines
A formal patch management policy establishing testing requirements and deployment timelines is the foundational control that all other patch management activities depend on.
Question 5: An IT auditor is reviewing a bank's data encryption practices. Which finding would be MOST critical to report?
- Encryption keys are rotated annually instead of quarterly
- Customer PII is transmitted over internal networks without encryption (Correct answer)
- Encryption documentation is stored in a shared drive
- The encryption algorithm documentation is not updated
Correct answer: Customer PII is transmitted over internal networks without encryption
Transmitting customer PII without encryption exposes sensitive data to interception and violates regulatory requirements, representing an immediate critical risk.
Question 6: During an IT audit, an auditor discovers that a bank's firewall rules have not been reviewed in 36 months. What is the PRIMARY risk?
- Increased firewall hardware costs
- Outdated rules may permit unauthorized access or retain unnecessary open ports (Correct answer)
- Slower network performance due to rule bloat
- Difficulty obtaining firewall vendor support
Correct answer: Outdated rules may permit unauthorized access or retain unnecessary open ports
Stale firewall rules may allow traffic that should be blocked or retain rules for decommissioned systems, creating unauthorized network access vulnerabilities.
Question 7: Which control BEST mitigates the risk of SQL injection attacks against a bank's web-based customer portal?
- Implementing multi-factor authentication
- Using parameterized queries and input validation (Correct answer)
- Increasing web server memory allocation
- Requiring HTTPS for all connections
Correct answer: Using parameterized queries and input validation
Parameterized queries prevent malicious SQL code from being executed by treating user input as data rather than executable code.
