Assessment And Audit

During a control assessment, you use the 'examine, interview, and test' methods. Which of these is classified as an 'objective' evidence gathering technique?

When conducting an assessment using the SCAP protocol, what is the primary purpose of the OVAL component?

You are preparing a NIST SP 800-53A security control assessment. Which methodology step is performed immediately after the 'Prepare for Assessment' phase?

Which document serves as the primary agreement between an assessor and the target organization outlining the scope of an audit?

You are assessing an organization's compliance with SOC 2. The auditor requests evidence of 'Trust Services Criteria'. Which evidence is most relevant for the Availability criterion?

During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?

A security auditor needs to verify that the principle of least privilege is applied to a Linux server. Which audit activity is most appropriate?

An organization is moving to a cloud-native infrastructure. What is the most significant change in the assessment of 'inherited' controls?

Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?

When an assessment report indicates a 'High' risk finding, what is the primary responsibility of the system owner regarding the POA&M?

You are performing a gap analysis. What is the correct order of operations for a professional assessment?

Which standard provides the framework for conducting information security audits?

During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?

What is the primary goal of the 'Assessment Reporting' phase?

You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?

When conducting an audit, what is 'sampling'?

What is the purpose of a 'pre-assessment' meeting?

Which TWO methods are commonly used to gather assessment evidence?

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

Which document defines the specific security controls that an organization must implement based on its risk assessment?

What is the primary function of an assessor's 'working papers'?

You are auditing a backup solution. Which metric is most critical for the Availability audit?

Which TWO elements are required to be included in a Plan of Action and Milestones (POA&M)?

Which technique is best to detect 'false negatives' during a security control assessment?

Which TWO of the following are primary components of an effective security control assessment report?

Which TWO types of controls are specifically examined during an audit?

Which TWO factors contribute to the 'scope' of an information security audit?

Which THREE activities are part of the 'Assessment Execution' phase?

Which THREE items are critical when verifying an organization's Compliance with NIST SP 800-53?

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

Which THREE roles are typically involved in a security assessment?

Which THREE types of findings might appear in an audit report?