Assessment And Audit

What is the primary function of an assessor's 'working papers'?

During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?

A security assessor is reviewing audit logs from a critical server. The logs show that a user account with administrative privileges was used to access sensitive files outside of normal business hours. The assessor needs to determine whether this activity was authorized. Which type of evidence would BEST support this determination?

You are assessing an organization's compliance with the Payment Card Industry Data Security Standard (PCI DSS). As part of the assessment, you need to verify that the organization has implemented proper access control measures for its cardholder data environment (CDE). Which of the following assessment activities would best provide objective evidence of compliance with PCI DSS Requirement 7 (Restrict access to cardholder data by business need to know)?

You are the lead auditor for a CGRC assessment of a government agency's financial system. The system owner claims that a new access control mechanism has been implemented and is operating effectively. You need to gather sufficient appropriate evidence to support your conclusion. Which evidence-gathering technique provides the MOST reliable evidence regarding the operating effectiveness of this control?

As an ISC2 CGRC candidate, you are asked to distinguish between different types of audits. Which type of audit is characterized by an independent external party evaluating an organization's security controls to provide assurance to stakeholders?

A security assessor is evaluating an organization's continuous monitoring program as part of a NIST SP 800-137 assessment. The assessor must verify that the program includes the essential elements required for effective ongoing situational awareness. Which TWO elements are essential components of a continuous monitoring program? (Choose two.)

Which THREE activities are part of the 'Assessment Execution' phase?

Which THREE types of findings might appear in an audit report?

Which TWO factors contribute to the 'scope' of an information security audit?

You are auditing a backup solution. Which metric is most critical for the Availability audit?

You are assessing an organization's compliance with SOC 2. The auditor requests evidence of 'Trust Services Criteria'. Which evidence is most relevant for the Availability criterion?

You are leading a security assessment team using the NIST Risk Management Framework (RMF). During the 'Assess' step, your team must determine the overall effectiveness of the security controls implemented in a new system. The system owner asks which activities are essential to complete this assessment step. (Choose two.)

When conducting an audit, what is 'sampling'?

Which technique is best to detect 'false negatives' during a security control assessment?

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

You are an assessor for a cloud service provider (CSP) undergoing a FedRAMP Moderate baseline assessment. During the assessment, you discover that a required control (AC-2 Account Management) is not fully implemented. According to the FedRAMP assessment process, what is the next step you must take?

You are reviewing the audit documentation of a junior assessor who tested a contingency planning control. The assessor noted that the control was 'effective' based on a tabletop exercise conducted six months ago. The system has undergone a major architecture change since then. According to CGRC assessment principles, what is the MOST significant deficiency in the assessor's conclusion?

Which TWO methods are commonly used to gather assessment evidence?

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

During a security control assessment of a U.S. federal information system, the assessment team must verify that the system's boundary protection controls meet the requirements of NIST SP 800-53 Rev. 5. The team has already collected the system security plan and the most recent security assessment report. Which action should the team take NEXT to obtain independent evidence of the implemented controls?

Which THREE items are critical when verifying an organization's Compliance with NIST SP 800-53?

You are an ISSO preparing for an upcoming CGRC assessment of a major information system. The auditor has requested a kickoff meeting to discuss the scope, objectives, and logistics of the assessment. What is the PRIMARY purpose of this kickoff meeting?

A security auditor needs to verify that the principle of least privilege is applied to a Linux server. Which audit activity is most appropriate?

Which THREE roles are typically involved in a security assessment?

An organization is preparing for a compliance audit against ISO/IEC 27001. The internal audit team needs to gather evidence that the information security management system (ISMS) is operating effectively. Which activity is MOST appropriate for the team to perform?

Which TWO elements are required to be included in a Plan of Action and Milestones (POA&M)?

You are an internal auditor tasked with assessing the effectiveness of your organization's security controls. You have full access to internal documentation and personnel. Which type of audit are you performing?

A security assessor is evaluating an organization's access control policy. The assessor needs to verify that the policy includes all required elements for compliance with a specific framework. Which of the following would be the MOST reliable source of evidence to confirm the policy's content?

You are conducting an assessment of a cloud service provider's (CSP) compliance with the FedRAMP Moderate baseline. The CSP has provided a system security plan (SSP) and a set of assessment procedures. You notice that the SSP indicates that a particular control is inherited from the underlying IaaS provider. What is the most appropriate action to verify the effectiveness of this inherited control?

You are conducting a security assessment of a government agency's network. During evidence collection, you must ensure the integrity and authenticity of the evidence. Which TWO of the following actions are most critical to maintain the integrity of audit evidence? (Choose two.)

You are conducting an audit of a cloud service provider's continuous monitoring program. The provider claims to follow NIST SP 800-137 guidelines. You need to verify that the organization's continuous monitoring strategy includes the required elements for ongoing assessment of security controls. Which TWO elements are essential components of an effective continuous monitoring program according to NIST SP 800-137? (Choose two.)

You are preparing a NIST SP 800-53A security control assessment. Which methodology step is performed immediately after the 'Prepare for Assessment' phase?

An organization is moving to a cloud-native infrastructure. What is the most significant change in the assessment of 'inherited' controls?

A security assessment team is planning to assess an organization's incident response capability. The team lead must ensure that the assessment covers the necessary components to evaluate the effectiveness of the incident response process. Which TWO of the following should be included in the assessment scope? (Choose two.)

Which document defines the specific security controls that an organization must implement based on its risk assessment?

What is the purpose of a 'pre-assessment' meeting?

Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?

Which document serves as the primary agreement between an assessor and the target organization outlining the scope of an audit?

An organization is undergoing a periodic security assessment of its production environment. The assessment team lead needs to ensure that the assessment scope is formally agreed upon and that all relevant stakeholders understand the boundaries. Which document should the team lead produce FIRST to establish this shared understanding?

You are conducting a security assessment of a cloud service provider's environment. The provider claims that its system meets the FedRAMP Moderate baseline. As part of your assessment, you need to verify that the provider has implemented the required continuous monitoring activities. Which document should you review to find the provider's continuous monitoring strategy and deliverables?

When an assessment report indicates a 'High' risk finding, what is the primary responsibility of the system owner regarding the POA&M?

An organization is preparing for an independent security assessment of its cloud-hosted customer relationship management (CRM) system. The assessment will evaluate compliance with the organization's security policies and applicable regulations. Which document should the assessor request FIRST to understand the system's boundary, components, and data flows?

You are leading a security assessment for a federal agency using NIST SP 800-53A. During the 'Develop Assessment Procedures' step, your team must tailor the assessment procedures to the system's specific environment. Which action should you take FIRST to ensure the procedures are appropriately scoped?

What is the primary goal of the 'Assessment Reporting' phase?

When conducting an assessment using the SCAP protocol, what is the primary purpose of the OVAL component?

During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?

Which standard provides the framework for conducting information security audits?

You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?

During an assessment of a federal information system, you are evaluating the implementation of the access control policy. You discover that the system administrator has granted temporary elevated privileges to a user for a critical maintenance task, but the privileges were not revoked after the task was completed. According to NIST SP 800-53A, which assessment method would best verify the effectiveness of the account management control?

You are an auditor evaluating the results of a security assessment. The assessment team identified a high-risk finding related to inadequate logging and monitoring. The system owner disagrees with the finding and argues that compensating controls mitigate the risk. As the auditor, what should you do NEXT to resolve this disagreement?