Compliance Audit Vocabulary Quiz
Practice compliance audit vocabulary: audit evidence, control objectives, remediation plan, risk accepted, audit findings vs. observations, management response, and audit trail.
0 / 45 completed
1 / 45
What is 'audit evidence' in a compliance context?
Audit evidence is the information — such as logs, screenshots, policies, access reports, and test results — that auditors examine to determine whether controls are operating effectively and whether the organization is compliant.
2 / 45
An auditor issues an 'audit finding' versus an 'observation.' What is the key difference?
An audit finding typically signals a deficiency — a control is missing, ineffective, or non-compliant. An observation is a lower-severity note flagging a potential risk or area for improvement that may not rise to the level of a formal finding.
3 / 45
What is a 'remediation plan' in an audit context?
A remediation plan is the auditee's documented response to audit findings, specifying the corrective actions to be taken, the responsible owner, and the target completion date. Auditors review remediation plans during follow-up assessments.
4 / 45
What does it mean when a risk is 'risk accepted' in a compliance process?
'Risk accepted' is a formal decision where management acknowledges a known risk and chooses to accept it rather than remediate — often because the cost of mitigation exceeds the risk's impact. It must be documented and approved.
5 / 45
What is an 'audit trail' and why is it important?
An audit trail is a time-stamped, tamper-evident record of system and user activity. It is essential for forensic investigation, demonstrating compliance, and proving that controls were operating correctly during an audit period.
6 / 45
Sarah: "Hey team, I've flagged a potential issue in the `user_authentication` module. The API is returning a 403 error for users with roles 'admin' and 'moderator' during peak hours. We need to investigate whether this is a legitimate security restriction or an unexpected performance bottleneck."Option B is correct because '403 forbidden' errors often represent a performance issue rather than a direct security breach. While user roles are important for compliance, the immediate concern here is whether the API is responding quickly enough under load – this requires investigation and monitoring to determine if it's a valid restriction or a bottleneck. Options A and C misinterpret the error code; a 403 doesn't automatically imply privilege violations, and Option D introduces irrelevant regulations.
7 / 45
git diff --cached
Insufficient – John's comment isn't about the *quality* of the code itself (option A), or a technical issue like API versions (option C). He is specifically raising a concern about potential compliance violations—the KYC check bypass. This highlights the need to verify that the change adheres to regulations and is properly documented, demonstrating an understanding of AML policy and documentation requirements which are core aspects of a compliance audit.
8 / 45
git diff --cached During a code review, Mark is examining a proposed change to the `shipping_calculations` module. He sees that the new code directly uses an external API endpoint for calculating shipping costs without any rate limiting or retry mechanisms. His comment reads: 'This direct call lacks robust error handling and could expose us to service disruptions. We need to add circuit breakers and implement exponential backoff to mitigate this risk.' Which of the following best describes Mark's concern regarding this change?Insufficient describes a lack of resources or capabilities. Mark's concern isn't about complexity or coding style; it's specifically about risk – the potential for service disruptions and the absence of resilience in handling failures from an external API. He is highlighting the need to implement safeguards like circuit breakers, demonstrating a focus on operational risk management, not just code efficiency. This aligns with compliance requirements around system availability and data integrity.
9 / 45
git diff --cached During a code review, David highlights a change in the `data_export` module. He writes: 'The script now directly accesses the database without using parameterized queries. This represents a significant SQL injection vulnerability and could allow unauthorized data access if not properly sanitized.' Which of the following best describes David's concern regarding this change?
David's concern focuses on a security risk. Using direct SQL queries without parameterization is a well-known vulnerability that allows attackers to inject malicious code and potentially compromise the database. The other options represent valid concerns in software development, but they don't directly address the immediate threat of a SQL injection attack. It's crucial to understand these risks when reviewing changes to data access logic.
10 / 45
git diff --cached During a code review, Maria is examining a proposed change in the `order_management` module. The PR description states: 'This update simplifies the process for handling large orders by directly writing data to the database instead of using our existing queuing system.' Her colleague, Alex, replies with: 'I'm concerned about potential performance issues and data consistency if we bypass the queue. It's crucial that we maintain transactional integrity and consider the impact on overall system load. Can we discuss adding a robust queuing mechanism before merging this?' Which of the following best describes Alex's primary concern regarding Maria's change?Alex's concern is centered around performance and potential bottlenecks. The queuing system was designed to manage order volume and ensure transactional integrity; bypassing it introduces a significant risk of overloading the database server. While data corruption and regulatory non-compliance are potential risks associated with poorly designed systems, Alex's immediate focus is on the practical impact – system load and processing speed – which aligns directly with performance considerations within a compliance context. Choosing 'data corruption' misinterprets the core issue as a direct consequence of the change.
11 / 45
Sarah: "Hey team, I've flagged a potential issue in the `user_authentication` module. The API is returning a 403 error for users with roles 'admin' and 'moderator' during peak hours. We need to investigate whether this is a legitimate security restriction or an unexpected performance bottleneck."Option B is correct because '403 forbidden' errors often represent a performance issue rather than a direct security breach. While user roles are important for compliance, the immediate concern here is whether the API is responding quickly enough under load – this requires investigation and monitoring to determine if it's a valid restriction or a bottleneck. Options A and C misinterpret the error code; a 403 doesn't automatically imply privilege violations, and Option D introduces irrelevant regulations.
12 / 45
git diff --cached
Insufficient – John's comment isn't about the *quality* of the code itself (option A), or a technical issue like API versions (option C). He is specifically raising a concern about potential compliance violations—the KYC check bypass. This highlights the need to verify that the change adheres to regulations and is properly documented, demonstrating an understanding of AML policy and documentation requirements which are core aspects of a compliance audit.
13 / 45
git diff --cached During a code review, Mark is examining a proposed change to the `shipping_calculations` module. He sees that the new code directly uses an external API endpoint for calculating shipping costs without any rate limiting or retry mechanisms. His comment reads: 'This direct call lacks robust error handling and could expose us to service disruptions. We need to add circuit breakers and implement exponential backoff to mitigate this risk.' Which of the following best describes Mark's concern regarding this change?Insufficient describes a lack of resources or capabilities. Mark's concern isn't about complexity or coding style; it's specifically about risk – the potential for service disruptions and the absence of resilience in handling failures from an external API. He is highlighting the need to implement safeguards like circuit breakers, demonstrating a focus on operational risk management, not just code efficiency. This aligns with compliance requirements around system availability and data integrity.
14 / 45
git diff --cached During a code review, David highlights a change in the `data_export` module. He writes: 'The script now directly accesses the database without using parameterized queries. This represents a significant SQL injection vulnerability and could allow unauthorized data access if not properly sanitized.' Which of the following best describes David's concern regarding this change?
David's concern focuses on a security risk. Using direct SQL queries without parameterization is a well-known vulnerability that allows attackers to inject malicious code and potentially compromise the database. The other options represent valid concerns in software development, but they don't directly address the immediate threat of a SQL injection attack. It's crucial to understand these risks when reviewing changes to data access logic.
15 / 45
git diff --cached During a code review, Maria is examining a proposed change in the `order_management` module. The PR description states: 'This update simplifies the process for handling large orders by directly writing data to the database instead of using our existing queuing system.' Her colleague, Alex, replies with: 'I'm concerned about potential performance issues and data consistency if we bypass the queue. It's crucial that we maintain transactional integrity and consider the impact on overall system load. Can we discuss adding a robust queuing mechanism before merging this?' Which of the following best describes Alex's primary concern regarding Maria's change?Alex's concern is centered around performance and potential bottlenecks. The queuing system was designed to manage order volume and ensure transactional integrity; bypassing it introduces a significant risk of overloading the database server. While data corruption and regulatory non-compliance are potential risks associated with poorly designed systems, Alex's immediate focus is on the practical impact – system load and processing speed – which aligns directly with performance considerations within a compliance context. Choosing 'data corruption' misinterprets the core issue as a direct consequence of the change.
16 / 45
Sarah: "Hey team, I've flagged a potential issue in the `user_authentication` module. The API is returning a 403 error for users with roles 'admin' and 'moderator' during peak hours. We need to investigate whether this is a legitimate security restriction or an unexpected performance bottleneck."Option B is correct because '403 forbidden' errors often represent a performance issue rather than a direct security breach. While user roles are important for compliance, the immediate concern here is whether the API is responding quickly enough under load – this requires investigation and monitoring to determine if it's a valid restriction or a bottleneck. Options A and C misinterpret the error code; a 403 doesn't automatically imply privilege violations, and Option D introduces irrelevant regulations.
17 / 45
git diff --cached
Insufficient – John's comment isn't about the *quality* of the code itself (option A), or a technical issue like API versions (option C). He is specifically raising a concern about potential compliance violations—the KYC check bypass. This highlights the need to verify that the change adheres to regulations and is properly documented, demonstrating an understanding of AML policy and documentation requirements which are core aspects of a compliance audit.
18 / 45
git diff --cached During a code review, Mark is examining a proposed change to the `shipping_calculations` module. He sees that the new code directly uses an external API endpoint for calculating shipping costs without any rate limiting or retry mechanisms. His comment reads: 'This direct call lacks robust error handling and could expose us to service disruptions. We need to add circuit breakers and implement exponential backoff to mitigate this risk.' Which of the following best describes Mark's concern regarding this change?Insufficient describes a lack of resources or capabilities. Mark's concern isn't about complexity or coding style; it's specifically about risk – the potential for service disruptions and the absence of resilience in handling failures from an external API. He is highlighting the need to implement safeguards like circuit breakers, demonstrating a focus on operational risk management, not just code efficiency. This aligns with compliance requirements around system availability and data integrity.
19 / 45
git diff --cached During a code review, David highlights a change in the `data_export` module. He writes: 'The script now directly accesses the database without using parameterized queries. This represents a significant SQL injection vulnerability and could allow unauthorized data access if not properly sanitized.' Which of the following best describes David's concern regarding this change?
David's concern focuses on a security risk. Using direct SQL queries without parameterization is a well-known vulnerability that allows attackers to inject malicious code and potentially compromise the database. The other options represent valid concerns in software development, but they don't directly address the immediate threat of a SQL injection attack. It's crucial to understand these risks when reviewing changes to data access logic.
20 / 45
git diff --cached During a code review, Maria is examining a proposed change in the `order_management` module. The PR description states: 'This update simplifies the process for handling large orders by directly writing data to the database instead of using our existing queuing system.' Her colleague, Alex, replies with: 'I'm concerned about potential performance issues and data consistency if we bypass the queue. It's crucial that we maintain transactional integrity and consider the impact on overall system load. Can we discuss adding a robust queuing mechanism before merging this?' Which of the following best describes Alex's primary concern regarding Maria's change?Alex's concern is centered around performance and potential bottlenecks. The queuing system was designed to manage order volume and ensure transactional integrity; bypassing it introduces a significant risk of overloading the database server. While data corruption and regulatory non-compliance are potential risks associated with poorly designed systems, Alex's immediate focus is on the practical impact – system load and processing speed – which aligns directly with performance considerations within a compliance context. Choosing 'data corruption' misinterprets the core issue as a direct consequence of the change.
21 / 45
Sarah: "Hey team, I've flagged a potential issue in the `user_authentication` module. The API is returning a 403 error for users with roles 'admin' and 'moderator' during peak hours. We need to investigate whether this is a legitimate security restriction or an unexpected performance bottleneck."Option B is correct because '403 forbidden' errors often represent a performance issue rather than a direct security breach. While user roles are important for compliance, the immediate concern here is whether the API is responding quickly enough under load – this requires investigation and monitoring to determine if it's a valid restriction or a bottleneck. Options A and C misinterpret the error code; a 403 doesn't automatically imply privilege violations, and Option D introduces irrelevant regulations.
22 / 45
git diff --cached
Insufficient – John's comment isn't about the *quality* of the code itself (option A), or a technical issue like API versions (option C). He is specifically raising a concern about potential compliance violations—the KYC check bypass. This highlights the need to verify that the change adheres to regulations and is properly documented, demonstrating an understanding of AML policy and documentation requirements which are core aspects of a compliance audit.
23 / 45
git diff --cached During a code review, Mark is examining a proposed change to the `shipping_calculations` module. He sees that the new code directly uses an external API endpoint for calculating shipping costs without any rate limiting or retry mechanisms. His comment reads: 'This direct call lacks robust error handling and could expose us to service disruptions. We need to add circuit breakers and implement exponential backoff to mitigate this risk.' Which of the following best describes Mark's concern regarding this change?Insufficient describes a lack of resources or capabilities. Mark's concern isn't about complexity or coding style; it's specifically about risk – the potential for service disruptions and the absence of resilience in handling failures from an external API. He is highlighting the need to implement safeguards like circuit breakers, demonstrating a focus on operational risk management, not just code efficiency. This aligns with compliance requirements around system availability and data integrity.
24 / 45
git diff --cached During a code review, David highlights a change in the `data_export` module. He writes: 'The script now directly accesses the database without using parameterized queries. This represents a significant SQL injection vulnerability and could allow unauthorized data access if not properly sanitized.' Which of the following best describes David's concern regarding this change?
David's concern focuses on a security risk. Using direct SQL queries without parameterization is a well-known vulnerability that allows attackers to inject malicious code and potentially compromise the database. The other options represent valid concerns in software development, but they don't directly address the immediate threat of a SQL injection attack. It's crucial to understand these risks when reviewing changes to data access logic.
25 / 45
git diff --cached During a code review, Maria is examining a proposed change in the `order_management` module. The PR description states: 'This update simplifies the process for handling large orders by directly writing data to the database instead of using our existing queuing system.' Her colleague, Alex, replies with: 'I'm concerned about potential performance issues and data consistency if we bypass the queue. It's crucial that we maintain transactional integrity and consider the impact on overall system load. Can we discuss adding a robust queuing mechanism before merging this?' Which of the following best describes Alex's primary concern regarding Maria's change?Alex's concern is centered around performance and potential bottlenecks. The queuing system was designed to manage order volume and ensure transactional integrity; bypassing it introduces a significant risk of overloading the database server. While data corruption and regulatory non-compliance are potential risks associated with poorly designed systems, Alex's immediate focus is on the practical impact – system load and processing speed – which aligns directly with performance considerations within a compliance context. Choosing 'data corruption' misinterprets the core issue as a direct consequence of the change.
26 / 45
Sarah: "Hey team, I've flagged a potential issue in the `user_authentication` module. The API is returning a 403 error for users with roles 'admin' and 'moderator' during peak hours. We need to investigate whether this is a legitimate security restriction or an unexpected performance bottleneck."Option B is correct because '403 forbidden' errors often represent a performance issue rather than a direct security breach. While user roles are important for compliance, the immediate concern here is whether the API is responding quickly enough under load – this requires investigation and monitoring to determine if it's a valid restriction or a bottleneck. Options A and C misinterpret the error code; a 403 doesn't automatically imply privilege violations, and Option D introduces irrelevant regulations.
27 / 45
git diff --cached
Insufficient – John's comment isn't about the *quality* of the code itself (option A), or a technical issue like API versions (option C). He is specifically raising a concern about potential compliance violations—the KYC check bypass. This highlights the need to verify that the change adheres to regulations and is properly documented, demonstrating an understanding of AML policy and documentation requirements which are core aspects of a compliance audit.
28 / 45
git diff --cached During a code review, Mark is examining a proposed change to the `shipping_calculations` module. He sees that the new code directly uses an external API endpoint for calculating shipping costs without any rate limiting or retry mechanisms. His comment reads: 'This direct call lacks robust error handling and could expose us to service disruptions. We need to add circuit breakers and implement exponential backoff to mitigate this risk.' Which of the following best describes Mark's concern regarding this change?Insufficient describes a lack of resources or capabilities. Mark's concern isn't about complexity or coding style; it's specifically about risk – the potential for service disruptions and the absence of resilience in handling failures from an external API. He is highlighting the need to implement safeguards like circuit breakers, demonstrating a focus on operational risk management, not just code efficiency. This aligns with compliance requirements around system availability and data integrity.
29 / 45
git diff --cached During a code review, David highlights a change in the `data_export` module. He writes: 'The script now directly accesses the database without using parameterized queries. This represents a significant SQL injection vulnerability and could allow unauthorized data access if not properly sanitized.' Which of the following best describes David's concern regarding this change?
David's concern focuses on a security risk. Using direct SQL queries without parameterization is a well-known vulnerability that allows attackers to inject malicious code and potentially compromise the database. The other options represent valid concerns in software development, but they don't directly address the immediate threat of a SQL injection attack. It's crucial to understand these risks when reviewing changes to data access logic.
30 / 45
git diff --cached During a code review, Maria is examining a proposed change in the `order_management` module. The PR description states: 'This update simplifies the process for handling large orders by directly writing data to the database instead of using our existing queuing system.' Her colleague, Alex, replies with: 'I'm concerned about potential performance issues and data consistency if we bypass the queue. It's crucial that we maintain transactional integrity and consider the impact on overall system load. Can we discuss adding a robust queuing mechanism before merging this?' Which of the following best describes Alex's primary concern regarding Maria's change?Alex's concern is centered around performance and potential bottlenecks. The queuing system was designed to manage order volume and ensure transactional integrity; bypassing it introduces a significant risk of overloading the database server. While data corruption and regulatory non-compliance are potential risks associated with poorly designed systems, Alex's immediate focus is on the practical impact – system load and processing speed – which aligns directly with performance considerations within a compliance context. Choosing 'data corruption' misinterprets the core issue as a direct consequence of the change.
31 / 45
Sarah: "Hey team, I've flagged a potential issue in the `user_authentication` module. The API is returning a 403 error for users with roles 'admin' and 'moderator' during peak hours. We need to investigate whether this is a legitimate security restriction or an unexpected performance bottleneck."Option B is correct because '403 forbidden' errors often represent a performance issue rather than a direct security breach. While user roles are important for compliance, the immediate concern here is whether the API is responding quickly enough under load – this requires investigation and monitoring to determine if it's a valid restriction or a bottleneck. Options A and C misinterpret the error code; a 403 doesn't automatically imply privilege violations, and Option D introduces irrelevant regulations.
32 / 45
git diff --cached
Insufficient – John's comment isn't about the *quality* of the code itself (option A), or a technical issue like API versions (option C). He is specifically raising a concern about potential compliance violations—the KYC check bypass. This highlights the need to verify that the change adheres to regulations and is properly documented, demonstrating an understanding of AML policy and documentation requirements which are core aspects of a compliance audit.
33 / 45
git diff --cached During a code review, Mark is examining a proposed change to the `shipping_calculations` module. He sees that the new code directly uses an external API endpoint for calculating shipping costs without any rate limiting or retry mechanisms. His comment reads: 'This direct call lacks robust error handling and could expose us to service disruptions. We need to add circuit breakers and implement exponential backoff to mitigate this risk.' Which of the following best describes Mark's concern regarding this change?Insufficient describes a lack of resources or capabilities. Mark's concern isn't about complexity or coding style; it's specifically about risk – the potential for service disruptions and the absence of resilience in handling failures from an external API. He is highlighting the need to implement safeguards like circuit breakers, demonstrating a focus on operational risk management, not just code efficiency. This aligns with compliance requirements around system availability and data integrity.
34 / 45
git diff --cached During a code review, David highlights a change in the `data_export` module. He writes: 'The script now directly accesses the database without using parameterized queries. This represents a significant SQL injection vulnerability and could allow unauthorized data access if not properly sanitized.' Which of the following best describes David's concern regarding this change?
David's concern focuses on a security risk. Using direct SQL queries without parameterization is a well-known vulnerability that allows attackers to inject malicious code and potentially compromise the database. The other options represent valid concerns in software development, but they don't directly address the immediate threat of a SQL injection attack. It's crucial to understand these risks when reviewing changes to data access logic.
35 / 45
git diff --cached During a code review, Maria is examining a proposed change in the `order_management` module. The PR description states: 'This update simplifies the process for handling large orders by directly writing data to the database instead of using our existing queuing system.' Her colleague, Alex, replies with: 'I'm concerned about potential performance issues and data consistency if we bypass the queue. It's crucial that we maintain transactional integrity and consider the impact on overall system load. Can we discuss adding a robust queuing mechanism before merging this?' Which of the following best describes Alex's primary concern regarding Maria's change?Alex's concern is centered around performance and potential bottlenecks. The queuing system was designed to manage order volume and ensure transactional integrity; bypassing it introduces a significant risk of overloading the database server. While data corruption and regulatory non-compliance are potential risks associated with poorly designed systems, Alex's immediate focus is on the practical impact – system load and processing speed – which aligns directly with performance considerations within a compliance context. Choosing 'data corruption' misinterprets the core issue as a direct consequence of the change.
36 / 45
Sarah: "Hey team, I've flagged a potential issue in the `user_authentication` module. The API is returning a 403 error for users with roles 'admin' and 'moderator' during peak hours. We need to investigate whether this is a legitimate security restriction or an unexpected performance bottleneck."Option B is correct because '403 forbidden' errors often represent a performance issue rather than a direct security breach. While user roles are important for compliance, the immediate concern here is whether the API is responding quickly enough under load – this requires investigation and monitoring to determine if it's a valid restriction or a bottleneck. Options A and C misinterpret the error code; a 403 doesn't automatically imply privilege violations, and Option D introduces irrelevant regulations.
37 / 45
git diff --cached
Insufficient – John's comment isn't about the *quality* of the code itself (option A), or a technical issue like API versions (option C). He is specifically raising a concern about potential compliance violations—the KYC check bypass. This highlights the need to verify that the change adheres to regulations and is properly documented, demonstrating an understanding of AML policy and documentation requirements which are core aspects of a compliance audit.
38 / 45
git diff --cached During a code review, Mark is examining a proposed change to the `shipping_calculations` module. He sees that the new code directly uses an external API endpoint for calculating shipping costs without any rate limiting or retry mechanisms. His comment reads: 'This direct call lacks robust error handling and could expose us to service disruptions. We need to add circuit breakers and implement exponential backoff to mitigate this risk.' Which of the following best describes Mark's concern regarding this change?Insufficient describes a lack of resources or capabilities. Mark's concern isn't about complexity or coding style; it's specifically about risk – the potential for service disruptions and the absence of resilience in handling failures from an external API. He is highlighting the need to implement safeguards like circuit breakers, demonstrating a focus on operational risk management, not just code efficiency. This aligns with compliance requirements around system availability and data integrity.
39 / 45
git diff --cached During a code review, David highlights a change in the `data_export` module. He writes: 'The script now directly accesses the database without using parameterized queries. This represents a significant SQL injection vulnerability and could allow unauthorized data access if not properly sanitized.' Which of the following best describes David's concern regarding this change?
David's concern focuses on a security risk. Using direct SQL queries without parameterization is a well-known vulnerability that allows attackers to inject malicious code and potentially compromise the database. The other options represent valid concerns in software development, but they don't directly address the immediate threat of a SQL injection attack. It's crucial to understand these risks when reviewing changes to data access logic.
40 / 45
git diff --cached During a code review, Maria is examining a proposed change in the `order_management` module. The PR description states: 'This update simplifies the process for handling large orders by directly writing data to the database instead of using our existing queuing system.' Her colleague, Alex, replies with: 'I'm concerned about potential performance issues and data consistency if we bypass the queue. It's crucial that we maintain transactional integrity and consider the impact on overall system load. Can we discuss adding a robust queuing mechanism before merging this?' Which of the following best describes Alex's primary concern regarding Maria's change?Alex's concern is centered around performance and potential bottlenecks. The queuing system was designed to manage order volume and ensure transactional integrity; bypassing it introduces a significant risk of overloading the database server. While data corruption and regulatory non-compliance are potential risks associated with poorly designed systems, Alex's immediate focus is on the practical impact – system load and processing speed – which aligns directly with performance considerations within a compliance context. Choosing 'data corruption' misinterprets the core issue as a direct consequence of the change.
41 / 45
Sarah: "Hey team, I've flagged a potential issue in the `user_authentication` module. The API is returning a 403 error for users with roles 'admin' and 'moderator' during peak hours. We need to investigate whether this is a legitimate security restriction or an unexpected performance bottleneck."Option B is correct because '403 forbidden' errors often represent a performance issue rather than a direct security breach. While user roles are important for compliance, the immediate concern here is whether the API is responding quickly enough under load – this requires investigation and monitoring to determine if it's a valid restriction or a bottleneck. Options A and C misinterpret the error code; a 403 doesn't automatically imply privilege violations, and Option D introduces irrelevant regulations.
42 / 45
git diff --cached
Insufficient – John's comment isn't about the *quality* of the code itself (option A), or a technical issue like API versions (option C). He is specifically raising a concern about potential compliance violations—the KYC check bypass. This highlights the need to verify that the change adheres to regulations and is properly documented, demonstrating an understanding of AML policy and documentation requirements which are core aspects of a compliance audit.
43 / 45
git diff --cached During a code review, Mark is examining a proposed change to the `shipping_calculations` module. He sees that the new code directly uses an external API endpoint for calculating shipping costs without any rate limiting or retry mechanisms. His comment reads: 'This direct call lacks robust error handling and could expose us to service disruptions. We need to add circuit breakers and implement exponential backoff to mitigate this risk.' Which of the following best describes Mark's concern regarding this change?Insufficient describes a lack of resources or capabilities. Mark's concern isn't about complexity or coding style; it's specifically about risk – the potential for service disruptions and the absence of resilience in handling failures from an external API. He is highlighting the need to implement safeguards like circuit breakers, demonstrating a focus on operational risk management, not just code efficiency. This aligns with compliance requirements around system availability and data integrity.
44 / 45
git diff --cached During a code review, David highlights a change in the `data_export` module. He writes: 'The script now directly accesses the database without using parameterized queries. This represents a significant SQL injection vulnerability and could allow unauthorized data access if not properly sanitized.' Which of the following best describes David's concern regarding this change?
David's concern focuses on a security risk. Using direct SQL queries without parameterization is a well-known vulnerability that allows attackers to inject malicious code and potentially compromise the database. The other options represent valid concerns in software development, but they don't directly address the immediate threat of a SQL injection attack. It's crucial to understand these risks when reviewing changes to data access logic.
45 / 45
git diff --cached During a code review, Maria is examining a proposed change in the `order_management` module. The PR description states: 'This update simplifies the process for handling large orders by directly writing data to the database instead of using our existing queuing system.' Her colleague, Alex, replies with: 'I'm concerned about potential performance issues and data consistency if we bypass the queue. It's crucial that we maintain transactional integrity and consider the impact on overall system load. Can we discuss adding a robust queuing mechanism before merging this?' Which of the following best describes Alex's primary concern regarding Maria's change?Alex's concern is centered around performance and potential bottlenecks. The queuing system was designed to manage order volume and ensure transactional integrity; bypassing it introduces a significant risk of overloading the database server. While data corruption and regulatory non-compliance are potential risks associated with poorly designed systems, Alex's immediate focus is on the practical impact – system load and processing speed – which aligns directly with performance considerations within a compliance context. Choosing 'data corruption' misinterprets the core issue as a direct consequence of the change.
Frequently Asked Questions
What does the "Compliance Audit Vocabulary Quiz" exercise practise?
Practice compliance audit vocabulary: audit evidence, control objectives, remediation plan, risk accepted, audit findings vs. observations, management response, and audit trail.
How many questions are in this exercise?
This exercise has 45 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Intermediate. If the vocabulary feels difficult, browse the Compliance Security category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "Compliance Audit Vocabulary Quiz" part of a larger series?
Yes — it's one exercise in the Compliance Security category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Compliance Security category page for related exercises, or browse the main Exercises hub for other IT English topics.