IT Auditor

Correct answer: A

The file demonstrates only commercial due diligence: reference checks, cost scoring, negotiation notes, and a standard confidentiality agreement. None of these test the security-specific dimensions of supply chain risk that matter for RTU firmware and a monitoring platform touching grid operations, such as a bill of materials disclosing embedded and third-party components, a questionnaire covering Kestrel's development and patching practices, contractual rights to audit or demand remediation, and visibility into Kestrel's own subcontractors. The finding should identify this gap and recommend it be closed before signing. Option B is wrong because reference checks speak to customer satisfaction and functionality in operation, not to security engineering practices or component provenance; peer utilities using the equipment without incident say nothing about whether Kestrel's development and patching practices are sound, so operational reputation cannot substitute for the missing security-specific evidence. Option C is wrong because a non-disclosure agreement protects confidential information exchanged during the deal; it creates no affirmative obligation for Kestrel to disclose vulnerabilities, and it does nothing to establish audit rights or remediation obligations, so it cannot be read as making a separate questionnaire or audit clause redundant. Option D correctly identifies that procurement has not sufficiently addressed supply chain risk, but draws the wrong conclusion from that gap: the absence of a security questionnaire in the RFP file is evidence of a hole in what procurement required, not evidence about Kestrel's actual development practices, since Kestrel was never asked to provide that information. Recommending disqualification and a full re-competition treats an unproven inference about the vendor as if it were established fact, and it is disproportionate to what the evidence supports; the defensible recommendation is to require the missing controls, such as a bill of materials, questionnaire, and audit rights, before the contract is signed, and to evaluate Kestrel's responses before any decision to reject the vendor.

This question measures: T1344: Determine if procurement activities sufficiently address supply chain risks

Correct answer: C

Option C is correct because supply chain risk management requires visibility into every party that touches the data in the chain, including fourth parties, and the standard mechanism for extending security and privacy obligations beyond the direct vendor is a contractual flow-down requirement; the integration should not proceed until that gap is closed. Option A is wrong because prime-contract data protection clauses do not automatically bind undisclosed subcontractors; they only extend to a fourth party if the contract's flow-down provisions explicitly say so, which was never confirmed here. Option B is wrong because deferring a material, currently active exposure to the next annual review cycle ignores that the risk is live now, while the integration is being built. Option D is wrong because it treats any use of a subprocessor as automatically disqualifying; supply chain risk management is about gaining visibility and imposing appropriate controls, not banning all subcontracting outright, so this overcorrects instead of solving the actual gap.

This question measures: K0803: Knowledge of supply chain risk management principles and practices

Correct answer: C

SOX 404 reliance on a service organization requires evidence that controls relevant to internal control over financial reporting (ICFR) operated effectively throughout the period under audit, not merely that they were suitably designed at a point in time. A SOC 1 Type II report is the only document offered that satisfies both conditions: it is scoped to controls over payroll processing (ICFR-relevant) and it tests operating effectiveness across a period, which is what ITGC testing under SOX 404 requires. The SOC 2 Type II report also covers a period, but its criteria are security and availability, not ICFR-relevant financial reporting controls, so a period-of-time report on the wrong criteria still cannot support 404 reliance. The SOC 1 Type I report has the correct criteria, controls over payroll processing, but only opines on whether those controls were suitably designed as of a single date; it provides no evidence they operated effectively over the year, which is the specific gap SOX 404 ITGC testing is meant to close. The bridge letter addresses the correct subject matter but is a representation from NimbusPay's own staff that nothing changed, not independent testing of operating effectiveness for the current period; on its own it cannot substitute for a tested Type II report, though it can supplement one to cover a short gap period.

This question measures: AUDIT-K01: Knowledge of IT audit standards and frameworks including SOC 1 and SOC 2, COBIT, the IIA IPPF, and SOX 404 ITGC scoping