Reference: IIA Business Knowledge for Internal Auditing, BYOD Compliance Risks section.

A product-oriented definition describes the business by what it makes or sells. A market-oriented definition describes the customer need being satisfied. "We make movies" focuses on the product itself, so it is product- oriented. By contrast, "we are a people-and-goods mover" defines the customer need for transportation. "We supply energy" describes a broader market need rather than a single product. "We provide climate control in the home" focuses on the customer benefit, not merely the product. Internal auditors involved in strategy, planning, or operational reviews should understand this distinction because product-oriented thinking can create strategic risk if management ignores changing customer needs, substitute products, or market disruption. A market-oriented definition is usually more flexible and customer-focused. Therefore, Option C is correct.

Indexing a progressive tax system to inflation requires adjusting tax brackets, deductions, and exemptions.
Without inflation indexing, nominal income may rise even though real purchasing power has not increased, pushing taxpayers into higher tax brackets. This is known as bracket creep. Adjusting brackets prevents inflation alone from increasing tax burden. Adjusting deductions and exemptions also preserves their real value. Tax filings are administrative documents and are not indexed. Tax payments and nominal tax receipts are outcomes, not structural tax-system elements. Internal auditors reviewing payroll, tax, or compensation controls should understand inflation indexing because it affects withholding, tax planning, and compliance calculations. Therefore, Option B is correct.

The correct technical answer is token ring network. In a ring topology, devices are connected in a circular path, and data travels around the ring. If one device or connection in the ring fails and no bypass or redundancy exists, communication around the ring can be disrupted. A star network is usually affected only if the central hub or switch fails; one endpoint device failure normally does not bring down the whole network.
A mesh network is the most resilient because multiple paths exist. A bus network is vulnerable to backbone cable failure, but the question specifically says one device fails, not the main cable. Internal auditors reviewing network resilience should understand topology-related single points of failure. Therefore, Option C is correct.

Business continuity planning (BCP) requires a recovery strategy that minimizes downtime and ensures that critical operations resume within the organization's desired recovery time objective (RTO).
Since the organization wants to recover within four to seven days, it does not require an expensive real-time recovery site (hot site).
The best strategy is a warm site: a pre-secured location with configurable hardware and data backups that can be activated within the required timeframe.
(A) Incorrect - A recovery strategy whereby a separate site has not yet been determined, but hardware has been reserved for purchase and data backups.
This is a cold site, requiring time for setup and hardware installation.
It does not meet the four to seven-day recovery timeframe efficiently.
(B) Incorrect - A recovery strategy whereby a separate site has been secured and is ready for use, with fully configured hardware and real-time synchronized data.
This describes a hot site, which allows instant failover with real-time synchronization.
While effective, it is costly and unnecessary for a four-to-seven-day recovery target.
(C) Incorrect - A recovery strategy whereby a separate site has been secured and the necessary funds for hardware and data backups have been reserved.
While a site has been secured, the absence of pre-configured hardware would delay recovery, making it an inefficient choice.
(D) Correct - A recovery strategy whereby a separate site has been secured with configurable hardware and data backups.
This describes a warm site, which is the best balance between cost and recovery efficiency.
Configurable hardware and data backups ensure that operations can resume within four to seven days.
IIA's GTAG (Global Technology Audit Guide) - Business Continuity and IT Disaster Recovery Recommends warm sites for recovery within a few days.
ISO 22301 - Business Continuity Management Systems
Defines recovery time objectives (RTOs) and site classifications (hot, warm, cold).
COBIT Framework - IT Risk Management
Guides organizations on cost-effective recovery site selection based on risk tolerance.
Analysis of Answer Choices:IIA References and Internal Auditing Standards: