CBA Information Technology Auditing Questions and Answers — Questions and Answers
Question 1: An IT auditor is evaluating a bank's use of a public cloud service provider (CSP) for hosting its mobile banking application. Under the shared responsibility model, which of the following controls is MOST likely the bank's responsibility to implement and audit?
- Physical security of the data center facilities.
- Configuration of the virtual machine operating systems and security groups. (Correct answer)
- Security of the underlying network infrastructure.
- Maintenance of the hypervisor that manages virtual resources.
Correct answer: Configuration of the virtual machine operating systems and security groups.
In a cloud computing environment, the shared responsibility model dictates the security obligations of the cloud service provider and the customer. While the CSP is responsible for the security 'of' the cloud (e.g., physical data centers, underlying hardware, and network), the customer (the bank) is responsible for security 'in' the cloud. This includes correctly configuring their own resources, such as virtual machine operating systems, user access controls, and network security groups (firewalls).
Question 2: During a review of a bank's Business Continuity Plan (BCP), an auditor notes that the plan has not been updated in over three years. The Business Impact Analysis (BIA) is also outdated. Which of the following is the GREATEST risk associated with this finding?
- The plan may not be compliant with archival and record retention policies.
- The recovery strategies may no longer be effective for current critical business operations. (Correct answer)
- The cost of executing the plan may have increased beyond the allocated budget.
- The contact information for key personnel listed in the plan may be incorrect.
Correct answer: The recovery strategies may no longer be effective for current critical business operations.
The primary risk of an outdated BCP and BIA is that the bank's operations, critical systems, and processes may have changed significantly. Therefore, the recovery strategies documented in the plan may no longer be relevant or effective for restoring essential services within their required timeframes (Recovery Time Objectives), potentially leading to significant financial and reputational damage during a disruption.
Question 3: Which of the following IT governance frameworks provides a comprehensive model that bridges the gap between technical issues, business risks, and control requirements, making it highly suitable for auditors in the banking sector?
- ITIL (Information Technology Infrastructure Library)
- ISO/IEC 27001
- COBIT (Control Objectives for Information and Related Technologies) (Correct answer)
- Scrum
Correct answer: COBIT (Control Objectives for Information and Related Technologies)
COBIT is a leading framework for the governance and management of enterprise IT. It is specifically designed to align IT with business goals, manage risks, and ensure regulatory compliance, which are all critical in the banking industry. Unlike ITIL, which focuses on IT service management, or ISO 27001, which is centered on the information security management system, COBIT provides an overarching governance structure that helps auditors evaluate the entire IT control environment in the context of business objectives.
Question 4: A bank's IT auditor is performing a review of Information Technology General Controls (ITGCs). Which of the following areas is considered one of the four core domains of an ITGC audit?
- Application-level transaction validation.
- Change management processes. (Correct answer)
- End-user satisfaction surveys.
- IT project portfolio management.
Correct answer: Change management processes.
IT General Controls (ITGCs) are the foundational controls for the IT environment. Audits of ITGCs typically focus on four main domains: Access Management, Change Management, IT Operations, and Data/System Backup and Recovery. Change management ensures that modifications to systems are properly authorized, tested, and implemented, which is crucial for maintaining the integrity of financial reporting systems.
Question 5: In an audit of a bank's data governance program, which of the following findings would represent the MOST significant weakness?
- The data classification policy has not been reviewed by the legal department.
- A complete data lineage for a non-critical marketing report cannot be produced.
- There is a lack of clearly defined ownership and stewardship for critical data elements. (Correct answer)
- The bank has not yet adopted the latest version of its data analytics software.
Correct answer: There is a lack of clearly defined ownership and stewardship for critical data elements.
A fundamental principle of effective data governance is accountability, which is established through clear ownership and stewardship roles. Without defined owners for critical data elements (e.g., customer information, transaction records), there is no clear responsibility for data quality, integrity, and security, leading to increased risk of data breaches, poor decision-making, and regulatory non-compliance.
Question 6: An IT auditor is tasked with assessing the effectiveness of a bank's cybersecurity controls. Which audit procedure would provide the MOST assurance regarding the bank's ability to detect and respond to real-world threats?
- Reviewing the bank's incident response plan and related policy documents.
- Interviewing key IT security personnel about their roles and responsibilities.
- Performing a vulnerability scan of the external-facing network.
- Conducting a controlled penetration test and simulating an attack scenario. (Correct answer)
Correct answer: Conducting a controlled penetration test and simulating an attack scenario.
While reviewing documents, interviewing staff, and vulnerability scanning are all valuable audit procedures, a penetration test provides the most direct and practical evidence of a bank's defensive capabilities. By simulating a real-world attack, it actively tests the effectiveness of security controls, the monitoring systems' ability to detect intrusions, and the incident response team's capacity to react appropriately.
CBA Information Technology Auditing Questions and Answers
An IT auditor is evaluating a bank's use of a public cloud service provider (CSP) for hosting its mobile banking application.
Under the shared responsibility model, which of the following controls is MOST likely the bank's responsibility to implement and audit?