CGRC Assessment And Audit Practice Test 2 — 15 Questions

Question 1

When conducting an audit, what is 'sampling'?

Accepted Answer

Selecting a representative subset for testing. Sampling is the process of selecting a subset of data (e.g., user accounts) to represent the entire population to make an inference about the effectiveness of a control.

Answer

Randomly selecting records without criteria

Answer

Testing only the most recent data

Answer

Testing every single record in a database

Question 2

What is the purpose of a 'pre-assessment' meeting?

Accepted Answer

To set expectations and coordinate logistics. A pre-assessment or kickoff meeting ensures alignment on scope, timeline, logistics, and points of contact between the auditor and the client.

Answer

To conduct penetration testing

Answer

To finalize the POA&M

Answer

To perform hardware inventory

Question 3

Which TWO methods are commonly used to gather assessment evidence?

Accepted Answer

Interview. Assessment methods commonly include observing processes and interviewing personnel to understand implementation.

Answer

Budget approval

Answer

Marketing collateral review

Answer

System retirement

Question 4

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

Accepted Answer

Configure audit logging for administrative actions. A clear, actionable recommendation would be to implement and configure centralized logging (like Syslog or SIEM) for all administrative accounts.

Answer

Increase complexity of passwords

Answer

Change the audit team

Answer

Remove administrative access

Question 5

Which document defines the specific security controls that an organization must implement based on its risk assessment?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) describes the system and the controls that have been selected (tailored) to meet security requirements.

Answer

Incident Response Plan

Answer

Risk Management Plan

Answer

Security Assessment Report (SAR)

Question 6

What is the primary function of an assessor's 'working papers'?

Accepted Answer

To document evidence and support the findings. Working papers document the evidence gathered, testing performed, and observations made, which serve as the foundation for the final assessment report.

Answer

To list the audit team members

Answer

To submit to the regulator

Answer

To replace the need for an audit

Question 7

You are auditing a backup solution. Which metric is most critical for the Availability audit?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) dictates how quickly a system must be available after an outage, which is the primary metric for availability testing.

Answer

Encryption key rotation

Answer

Tape rotation schedule

Answer

Backup storage capacity

Question 8

Which TWO elements are required to be included in a Plan of Action and Milestones (POA&M)?

Accepted Answer

Target completion date. A POA&M must define the vulnerability/weakness and the specific milestone/date for remediation.

Answer

Personnel salary data

Answer

Historical audit logs

Answer

Software licensing keys

Question 9

Which technique is best to detect 'false negatives' during a security control assessment?

Accepted Answer

Reviewing security log correlation. Correlation of logs from multiple sources (e.g., firewall, IPS, host logs) allows an auditor to see if a threat was missed by a single control.

Answer

Interviewing developers

Answer

Checking server physical locks

Answer

Single tool vulnerability scanning

Question 10

Which TWO of the following are primary components of an effective security control assessment report?

Accepted Answer

Detailed Findings and Supporting Evidence. An assessment report must detail the findings/weaknesses and the evidence that supports those findings.

Answer

Employee performance reviews

Answer

List of all vendor contracts

Answer

Company financial statements

Question 11

Which TWO types of controls are specifically examined during an audit?

Accepted Answer

Administrative controls. Audits assess both technical controls (logical) and administrative controls (policies/procedures).

Answer

Physical building aesthetics

Answer

HR hiring policies

Answer

Marketing controls

Question 12

Which TWO factors contribute to the 'scope' of an information security audit?

Accepted Answer

Network boundaries. The audit scope is driven by the physical and logical boundaries of the system being reviewed.

Answer

External stock prices

Answer

Competitor market analysis

Answer

Employee home addresses

Question 13

Which THREE activities are part of the 'Assessment Execution' phase?

Accepted Answer

Reviewing system documentation. Execution involves interviewing staff, reviewing documentation, and testing technical configuration settings.

Answer

Developing the final risk strategy

Answer

Purchasing new hardware

Question 14

Which THREE items are critical when verifying an organization's Compliance with NIST SP 800-53?

Accepted Answer

System Security Plan (SSP). NIST compliance requires a review of the SSP, the assessment of the controls, and the documentation of any deficiencies in a POA&M.

Answer

Annual report of stock performance

Answer

Internal marketing strategy

Question 15

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

Accepted Answer

Chain of custody documentation. Evidence must be protected from unauthorized changes, be verifiable, and be stored securely to maintain its chain of custody.

Answer

Publishing evidence to the company website

Answer

Printing all evidence on paper