A cookie is a small text file or data object stored by a browser for a website or web application. Cookies often include expiration dates that determine how long they remain valid. Poorly designed cookies may contain sensitive information, session identifiers, or even stored clear text passwords, which creates confidentiality and authentication risk. A URL may expose parameters, but it is not normally described as having an expiration date in the same way. HTTP is a communication protocol, not stored credential data. A browser stores and processes web content, but the specific item with expiration and stored text values is the cookie.
Internal auditors should evaluate secure cookie attributes, encryption, session management, and password storage controls. Therefore, Option A is correct.

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predefined security rules. It is the primary control for preventing unauthorized external access to an organization's network, making it the best answer.
* A. Firewall (Correct Answer) - Firewalls prevent unauthorized access by filtering traffic, blocking malicious connections, and securing the network perimeter.
* B. Encryption - While encryption protects data confidentiality, it does not actively prevent unauthorized access to a network.
* C. Antivirus - Antivirus software protects against malware and viruses but does not prevent unauthorized network access.
* D. Biometrics - Biometrics controls physical or logical access (e.g., fingerprint authentication) but does not secure a network from external threats.
* IIA GTAG 15 - Information Security Governance highlights firewalls as a critical security control for network protection.
* IIA IPPF Standard 2110 - Governance emphasizes the need for network security policies that include firewalls.
* NIST SP 800-41 Rev. 1 - Guidelines on Firewalls and Firewall Policy states that firewalls are the first line of defense in securing organizational networks.
Explanation of Each Option:IIA References:

A debenture bond is an unsecured bond that is not backed by specific assets or collateral. Instead, it is backed only by the issuer's creditworthiness and general reputation. Since the organization in this scenario has a stable rating from international rating agencies and guarantees interest and principal payments, it aligns perfectly with the definition of a debenture bond.
A). A sinking fund bond - A bond that has a special account (sinking fund) where money is set aside to pay off bondholders over time. This is not mentioned in the scenario.
B). A secured bond - This type of bond is backed by specific assets or collateral to reduce investor risk.
However, the scenario states that the bond is not backed by assets or collateral, eliminating this choice.
C). A junk bond - These are high-risk, high-yield bonds issued by companies with low credit ratings. The scenario specifies that the company has a stable rating, making this incorrect.
D). A debenture bond (Correct Answer) - Since this bond is unsecured and relies solely on the organization's financial health, it matches the definition of a debenture bond.
IIA IPPF Standard 2120 - Risk Management discusses financial risk management, including bond issuance.
COSO ERM Framework - Financial Risk Management emphasizes evaluating creditworthiness before issuing debt.
IFRS 9 - Financial Instruments provides accounting guidance on different bond types.
Explanation of Each Option:IIA References:

The CAE must communicate the results of the QAIP to the board and senior management. This includes results from ongoing monitoring, periodic self-assessments, and external assessments.
Option A (board oversight) is part of governance but not a QAIP requirement. Option B is incorrect because conformance is assessed for the activity overall, not per engagement. Option C is incorrect because self- assessments are ongoing, while external assessments are required at least once every five years.
Thus, the essential QAIP requirement for conformance is reporting results to the board (Option D).
Reference:
IIA Standards - Standard 1320: Reporting on the Quality Assurance and Improvement Program.

The internal audit plan must remain dynamic and responsive to changes in circumstances. If a key project is postponed, the CAE should amend the audit plan, reallocate resources appropriately, and inform the board and senior management for review and approval. This ensures transparency and continued alignment with organizational risks.
Option A improperly shifts audit resources under management's direction. Option B may be considered but requires board and management approval through an amended plan. Option D leaves resources idle, which is inefficient.
Reference:
IIA Standards - Standard 2020: Communication and Approval.