32 questions · Assessment And Audit · All types, answers revealed
What is the primary function of an assessor's 'working papers'?
They provide traceability for audit conclusions.
Why this answer
Working papers document the evidence gathered, testing performed, and observations made, which serve as the foundation for the final assessment report.
During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?
Lifecycle includes onboarding, maintenance, and offboarding/disabling.
Why this answer
Disabled account management is a critical detective and preventive control to ensure that only authorized, active users have access.
Which THREE activities are part of the 'Assessment Execution' phase?
Method of assessment.
Why this answer
Execution involves interviewing staff, reviewing documentation, and testing technical configuration settings.
Which THREE types of findings might appear in an audit report?
Informational findings.
Why this answer
Findings range from critical (immediate risk), to moderate (needs attention), to minor (observational), all of which appear in the report.
Which TWO factors contribute to the 'scope' of an information security audit?
Defines where the audit stops.
Why this answer
The audit scope is driven by the physical and logical boundaries of the system being reviewed.
You are auditing a backup solution. Which metric is most critical for the Availability audit?
RTO measures availability requirements.
Why this answer
Recovery Time Objective (RTO) dictates how quickly a system must be available after an outage, which is the primary metric for availability testing.
You are assessing an organization's compliance with SOC 2. The auditor requests evidence of 'Trust Services Criteria'. Which evidence is most relevant for the Availability criterion?
DR tests demonstrate that systems can be recovered.
Why this answer
Availability requires that systems be available for operation as agreed. Business continuity and disaster recovery testing provide evidence of this.
When conducting an audit, what is 'sampling'?
Sampling makes auditing scalable.
Why this answer
Sampling is the process of selecting a subset of data (e.g., user accounts) to represent the entire population to make an inference about the effectiveness of a control.
Which technique is best to detect 'false negatives' during a security control assessment?
Cross-log analysis reveals missed threats.
Why this answer
Correlation of logs from multiple sources (e.g., firewall, IPS, host logs) allows an auditor to see if a threat was missed by a single control.
During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?
This addresses the specific control gap.
Why this answer
A clear, actionable recommendation would be to implement and configure centralized logging (like Syslog or SIEM) for all administrative accounts.
Which TWO methods are commonly used to gather assessment evidence?
Gathering expert input.
Why this answer
Assessment methods commonly include observing processes and interviewing personnel to understand implementation.
Which TWO types of controls are specifically examined during an audit?
Verified via documentation review.
Why this answer
Audits assess both technical controls (logical) and administrative controls (policies/procedures).
Which THREE actions are essential for maintaining 'integrity' of audit evidence?
Proves the evidence hasn't been altered.
Why this answer
Evidence must be protected from unauthorized changes, be verifiable, and be stored securely to maintain its chain of custody.
Which THREE items are critical when verifying an organization's Compliance with NIST SP 800-53?
Baseline requirement.
Why this answer
NIST compliance requires a review of the SSP, the assessment of the controls, and the documentation of any deficiencies in a POA&M.
A security auditor needs to verify that the principle of least privilege is applied to a Linux server. Which audit activity is most appropriate?
This directly maps access to roles.
Why this answer
Reviewing /etc/passwd and /etc/group files and comparing user permissions against assigned roles is a direct method to verify least privilege.
Which THREE roles are typically involved in a security assessment?
Performs the evaluation.
Why this answer
The assessor (auditor), the system owner (responsible party), and the security officer (compliance expert) are key participants.
Which TWO elements are required to be included in a Plan of Action and Milestones (POA&M)?
The 'Milestones' part of POA&M.
Why this answer
A POA&M must define the vulnerability/weakness and the specific milestone/date for remediation.
You are performing a gap analysis. What is the correct order of operations for a professional assessment?
The target must be established before measuring the current state.
Why this answer
You must define the target (what good looks like), determine the current state (as-is), and then identify the delta (gap).
You are preparing a NIST SP 800-53A security control assessment. Which methodology step is performed immediately after the 'Prepare for Assessment' phase?
The assessment phase follows preparation.
Why this answer
According to NIST SP 800-53A, the assessment process is a linear flow where the 'Prepare for Assessment' phase leads directly into the 'Assess Security Controls' phase to execute the test procedures.
An organization is moving to a cloud-native infrastructure. What is the most significant change in the assessment of 'inherited' controls?
The assessor relies on the provider's third-party attestations.
Why this answer
In a cloud environment, the provider manages the physical and infrastructure controls (inherited), meaning the assessor focuses on verifying the provider's attestations (like SOC 2 reports).
Which document defines the specific security controls that an organization must implement based on its risk assessment?
The SSP identifies applied controls.
Why this answer
The System Security Plan (SSP) describes the system and the controls that have been selected (tailored) to meet security requirements.
What is the purpose of a 'pre-assessment' meeting?
Logistics are vital for assessment success.
Why this answer
A pre-assessment or kickoff meeting ensures alignment on scope, timeline, logistics, and points of contact between the auditor and the client.
Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?
Self-assessments are internal exercises.
Why this answer
Internal audits are conducted by the organization's own staff to improve internal processes and compliance before formal external audits occur.
Which document serves as the primary agreement between an assessor and the target organization outlining the scope of an audit?
ROE serves as the governance agreement.
Why this answer
The Rules of Engagement (ROE) define the boundaries, scope, and procedures for an assessment, ensuring both parties understand the limitations.
When an assessment report indicates a 'High' risk finding, what is the primary responsibility of the system owner regarding the POA&M?
High findings require immediate planning and tracking.
Why this answer
The system owner is responsible for prioritizing the remediation of high-risk items and ensuring the POA&M reflects the timeline and resource allocation for fixing them.
Which TWO of the following are primary components of an effective security control assessment report?
This is a standard section.
Why this answer
An assessment report must detail the findings/weaknesses and the evidence that supports those findings.
During a control assessment, you use the 'examine, interview, and test' methods. Which of these is classified as an 'objective' evidence gathering technique?
Testing provides verifiable technical evidence.
Why this answer
Testing is considered objective because it involves hands-on verification of a system's configuration or behavior, rather than relying on subjective human input (interview).
What is the primary goal of the 'Assessment Reporting' phase?
Reporting is the communication phase.
Why this answer
Reporting provides stakeholders with an accurate picture of the security posture, identified risks, and the evidence supporting the findings.
When conducting an assessment using the SCAP protocol, what is the primary purpose of the OVAL component?
OVAL defines checks to identify configuration issues.
Why this answer
OVAL (Open Vulnerability and Assessment Language) is used to verify the state of a system's security configuration, such as registry keys or file permissions.
During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?
POA&M is the standard artifact for tracking identified gaps.
Why this answer
FedRAMP requires that all open vulnerabilities and control weaknesses identified during an assessment be documented in a POA&M for tracking and remediation.
Which standard provides the framework for conducting information security audits?
This is the specific standard for ISMS auditing.
Why this answer
ISO/IEC 27007 provides guidance on managing an information security management system (ISMS) audit program.
You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?
This is the industry standard for proof of compliance.
Why this answer
A NIST Cryptographic Module Validation Program (CMVP) certificate provides formal verification that a product has met the FIPS 140 requirements.
Ready to test yourself?
Try a timed practice session using only Assessment And Audit questions.