CPCA Compliance and Auditing 2 — Questions and Answers
Question 1: During a compliance audit, an auditor discovers that an employee has been granted access to systems beyond what their job role requires. What principle has been violated?
- Separation of duties
- Least privilege (Correct answer)
- Need to know
- Defense in depth
Correct answer: Least privilege
The least privilege principle requires that users be granted only the minimum access necessary to perform their job functions.
Question 2: Which of the following best describes a compliance gap analysis?
- A review of all financial transactions over a fiscal year
- A comparison between current security controls and required standards (Correct answer)
- An investigation into a specific security incident
- A vulnerability scan of all networked systems
Correct answer: A comparison between current security controls and required standards
A gap analysis compares an organization's current state against required compliance standards to identify areas needing remediation.
Question 3: A CPCA is reviewing audit logs and notices that log entries have timestamps that are inconsistent with each other. What is the most likely root cause?
- A denial-of-service attack on the logging server
- Lack of time synchronization across systems using NTP (Correct answer)
- An insider threat attempting to cover their tracks
- Misconfigured firewall blocking log transmission
Correct answer: Lack of time synchronization across systems using NTP
Inconsistent timestamps across systems are typically caused by lack of synchronized clocks, which is addressed by implementing NTP (Network Time Protocol).
Question 4: Under SOC 2 auditing, which of the following Trust Service Criteria (TSC) is considered mandatory for all SOC 2 reports?
- Availability
- Confidentiality
- Security (Common Criteria) (Correct answer)
- Processing Integrity
Correct answer: Security (Common Criteria)
The Security (Common Criteria) category is the only mandatory TSC in a SOC 2 report; all other criteria are optional and selected based on business needs.
Question 5: An organization wants to demonstrate compliance with payment card industry requirements. Which standard should they audit against?
- HIPAA Security Rule
- PCI DSS (Correct answer)
- NIST SP 800-53
- ISO/IEC 27701
Correct answer: PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) is the framework specifically designed for organizations that handle cardholder data.
Question 6: What is the primary purpose of an audit trail in a compliance program?
- To automatically remediate security vulnerabilities
- To provide a chronological record of system activities for accountability (Correct answer)
- To encrypt sensitive data at rest and in transit
- To block unauthorized access attempts in real time
Correct answer: To provide a chronological record of system activities for accountability
An audit trail provides a sequential record of events and activities, enabling accountability and forensic investigation when needed.
Question 7: Which type of audit involves an independent third party evaluating an organization's controls against a defined standard?
- Internal audit
- First-party audit
- External audit (Correct answer)
- Peer review
Correct answer: External audit
An external audit is conducted by an independent third party to provide an objective assessment of an organization's compliance posture.
CPCA Compliance and Auditing 2
During a compliance audit, an auditor discovers that an employee has been granted access to systems beyond what their job role requires.
What principle has been violated?