IIA-CIA-Part3 Exam Dumps : Business Knowledge for Internal Auditing

Automated attacks that attempt to exploit weak or leaked passwords—such as credential stuffing, brute force attacks, and dictionary attacks—pose a significant cybersecurity risk. Implementing two-step verification (also known as multi-factor authentication, or MFA) is one of the most effective measures to mitigate these threats.

Why Two-Step Verification is Effective (B - Correct Answer)

Multi-factor authentication (MFA) adds an additional security layer beyond a password, requiring a second factor such as a one-time code sent to a mobile device, biometric authentication, or a security key.

Even if an attacker obtains a password, they cannot access the account without the second authentication factor.

The IIA Global Technology Audit Guide (GTAG) 1: Information Security Management emphasizes the use of multi-factor authentication to prevent unauthorized access.

Why Other Options Are Less Effective:

Option A: Changing passwords every two years

Ineffective because attackers often use compromised credentials that may be recent. Best practices recommend regular password updates but coupled with MFA.

The IIA's GTAG 16: Identity and Access Management highlights that password rotation alone does not fully protect against automated attacks.

Option C: Using a VPN when out of the office

Irrelevant to password attacks. A VPN encrypts data and secures network connections but does not prevent brute force or credential stuffing attacks.

The IIA GTAG 17: Auditing Network Security discusses VPNs for secure remote access but does not consider them a solution for password-based attacks.

Option D: Using antivirus and security tools

While important for overall security, these tools cannot prevent attacks that exploit stolen or weak passwords.

The IIA GTAG 15: Information Security Governance states that security tools should be combined with authentication controls like MFA for best protection.

GTAG 1: Information Security Management – Recommends multi-factor authentication to prevent unauthorized system access.

GTAG 16: Identity and Access Management – Highlights the limitations of password-only security and supports multi-factor authentication.

GTAG 17: Auditing Network Security – Covers VPN usage but does not consider it a solution for password attacks.

GTAG 15: Information Security Governance – Discusses the role of security tools and authentication in securing user accounts.

Step-by-Step Explanation:IIA References for Validation:Thus, requiring two-step verification (B) is the most effective control against automated password attacks.

A database administrator (DBA) should not perform duties that compromise segregation of duties (SoD). A conflict arises when a DBA has both design and security responsibilities, as this creates a risk of unauthorized changes, fraud, or data breaches.

(A) Designing and maintaining the database.

Incorrect: These tasks are related but do not create a major conflict, as maintenance follows the design phase.

(B) Preparing input data and maintaining the database.

Incorrect: While data preparation is typically a business function, maintaining the database does not create a direct security risk.

(C) Maintaining the database and providing its security.

Incorrect: Maintenance involves technical upkeep, and while security controls are crucial, they do not inherently conflict.

(D) Designing the database and providing its security. (Correct Answer)

A DBA responsible for both design and security could create backdoors or override security settings, leading to potential data manipulation or fraud.

IIA Standard 2120 – Risk Management requires proper control segregation to prevent fraud and security risks.

IIA GTAG 4 – Management of IT Auditing recommends separation of design, security, and administration functions to minimize risks.

IIA Standard 2120 – Risk Management: Encourages proper separation of duties to mitigate risks.

IIA GTAG 4 – Management of IT Auditing: Recommends strict control over database access and security roles.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (D) because combining database design and security responsibilities creates a significant conflict of interest, increasing security risks.

When an internal auditor calculates the mean (average), median (middle value), and range (difference between highest and lowest values) of a data population, the primary purpose is to assess the distribution of data and detect anomalies. Let’s analyze the answer choices:

Option A: To inform the classification of the data population.

Incorrect. Classification typically involves categorizing data into specific groups, which requires different statistical or analytical techniques like clustering or decision trees. Mean, median, and range are more useful for identifying distribution patterns.

Option B: To determine the completeness and accuracy of the data.

Incorrect. While summary statistics can highlight extreme values, completeness and accuracy are usually assessed through data reconciliation, validation checks, and comparison with source records.

Option C: To identify whether the population contains outliers.

Correct.

The range (difference between the largest and smallest values) helps to detect extreme values.

The mean and median can show whether the data is symmetrical or skewed (which may indicate outliers).

If the mean is significantly different from the median, it suggests potential outliers pulling the average in one direction.

IIA Reference: Internal auditors use data analytics to detect anomalies and potential fraud by identifying outliers. (IIA GTAG: Auditing with Data Analytics)

Option D: To determine whether duplicates in the data inflate the range.

Incorrect. Duplicates may affect the data set, but range calculations alone do not determine whether duplicates exist. Duplicate identification usually involves checking for repeated entries, not just extreme values.