CCNA Assessment And Audit Questions

Working papers record the evidence gathered, tests performed and conclusions reached during assessment, forming the audit trail that substantiates every reported finding. They satisfy the assessor's need to demonstrate that conclusions rest on verifiable evidence, enabling independent review and defending findings if challenged.

Account management lifecycle controls govern provisioning, review, and timely deprovisioning of identities. Disabling inactive accounts is a deprovisioning activity within that lifecycle, so failing to disable dormant accounts means the lifecycle control is not operating effectively, directly satisfying the stem's inactive-account constraint.

A signed change request or maintenance window approval provides documentary evidence that the after-hours access was planned and authorized. This type of evidence directly addresses the question of authorization, linking the activity to a legitimate business need. It is the most reliable way to confirm that the administrative access was not malicious or unauthorized.

This is a test of the access control mechanism. By attempting unauthorized access, you directly verify that the control is effective. PCI DSS assessment procedures often require testing to ensure that access is actually restricted. This provides objective evidence because the result is observable and not dependent on interviews or documentation. It is a key method for validating Requirement 7.

Observation and reperformance are direct, objective evidence-gathering techniques. Observing the actual provisioning task confirms the control is performed as described, and reperforming the access review independently verifies the outcome. These techniques provide strong evidence of operating effectiveness because they involve the auditor directly witnessing or executing the control, reducing reliance on management assertions.

A third-party audit is conducted by an independent external auditor who has no direct interest in the organization. This independence ensures objectivity and provides stakeholders with a high level of assurance regarding the organization's security controls. Common examples include SOC 2 examinations and ISO/IEC 27001 certification audits, which are widely recognized for their credibility and impartiality.

Ongoing security control assessments and reporting to authorizing officials are core to continuous monitoring. NIST SP 800-137 requires that organizations assess controls at a frequency sufficient to make risk-based decisions and report the security status to authorizing officials. This process ensures that control effectiveness is continually evaluated and that decision-makers have current information to accept or mitigate risk.

Assessment Execution requires examining artefacts to verify that documented controls exist and are current. Reviewing system documentation supplies documentary evidence of policies, procedures and configurations, satisfying the phase's need to assess design adequacy before testing whether controls actually operate as described.

Operational observations are findings where processes or practices deviate from expected performance without necessarily breaching a control, such as inconsistent log review. They belong in audit reports alongside control deficiencies and compliance violations, capturing issues affecting effectiveness that fall short of outright non-compliance.

Network boundaries define the perimeter across which audit evidence is gathered, directly shaping scope by fixing which systems, segments and interconnections fall inside the review. They satisfy the stem's scope constraint because audit coverage cannot extend beyond the defined boundary, making it a structural determinant of what the assessment examines.

RTO defines the maximum tolerable downtime before availability is deemed unacceptable, directly quantifying the recovery speed the backup solution must deliver. Auditing against RTO verifies the solution meets the business's stated availability constraint, unlike RPO, which addresses only data loss tolerance.

The Availability criterion measures whether systems remain operable and recoverable. Disaster recovery plan test results directly evidence recovery capability and uptime commitments, unlike confidentiality or processing integrity artefacts, making them the most relevant proof for that criterion.

A security assessment plan (SAP) is a key document produced during the Assess step. It defines the scope of the assessment, the specific controls and control enhancements to be assessed, the assessment methods (examine, interview, test), and the procedures to be used. Without a SAP, the assessment lacks structure and may miss critical controls, making it impossible to determine overall effectiveness accurately.

Sampling selects a representative subset of a population for testing, letting auditors draw conclusions about the whole without examining every item. This satisfies the audit constraint of gaining sufficient evidence efficiently when full-population testing is impractical.

Reviewing security log correlation exposes attacks that controls failed to stop, revealing false negatives. Correlating events across sources surfaces activity that individual controls missed, directly satisfying the stem's requirement to detect gaps where threats slipped through undetected. This mechanism identifies control failures rather than confirming successful prevention.

Absent audit logging for administrative actions removes accountability and traceability for privileged changes. Enabling audit logging captures who did what and when, restoring the detective control the organisation currently lacks and satisfying the assessment's requirement for monitoring privileged access.

In FedRAMP, when a control is not fully implemented, the assessor documents it as a finding in the SAR. The CSP then has the opportunity to address the finding through a POA&M, which outlines remediation actions, timelines, and responsible parties. This is a standard part of the assessment process, allowing for continuous monitoring and improvement. The AO considers the SAR and POA&M when making authorization decisions.

The major architecture change invalidates the relevance of the six-month-old tabletop exercise. Evidence must be sufficient and appropriate for the period under review, and a significant change can alter the effectiveness of contingency planning. The assessor should have obtained updated evidence, such as a recent exercise or test, that reflects the new architecture. Relying on stale evidence is a critical deficiency.

Interviews elicit qualitative evidence directly from personnel, capturing governance, risk and control practices that documentation alone cannot reveal. As a common assessment method, they satisfy the need to corroborate artefacts and observe how controls operate in practise, complementing techniques such as observation and document review.

Chain of custody documentation records every transfer, handler and storage event for evidence, preserving an unbroken, auditable trail. This directly satisfies the integrity requirement by demonstrating that audit evidence has not been altered, substituted or tampered with between collection and presentation.

Examining the actual firewall rule sets, router configurations, and architecture diagrams provides independent, technical evidence of the implemented boundary protection controls. This aligns with the NIST SP 800-53A assessment methods of examine and test, allowing the assessor to confirm that the controls are in place and operating as intended rather than merely documented.

The SSP describes the system boundary, control implementation and inherited controls, forming the baseline against which NIST SP 800-53 compliance is assessed. Without it, assessors cannot determine which controls apply, so it is essential for verifying compliance.

The primary purpose of a kickoff meeting is to align all parties on the assessment's scope, objectives, timeline, and responsibilities. It ensures that the auditor and the organization have a shared understanding of what will be assessed, how evidence will be collected, and who the points of contact are. This alignment reduces misunderstandings and helps the assessment proceed efficiently.

Least privilege means each account holds only the rights its role requires. Reviewing user account permissions and group assignments reveals excessive sudo, group or file access, directly satisfying the stem's requirement to verify least privilege on the Linux server.

The assessor or auditor performs the independent evaluation, examining evidence and testing controls against criteria. This role supplies the objective judgement the assessment process depends on, satisfying the requirement for a party who evaluates rather than operates the system.

Reviewing the ISMS scope statement and security policy is a fundamental audit activity to verify that the organization has defined the boundaries of its ISMS and established a security policy. These documents are core requirements of ISO/IEC 27001 and provide evidence of the ISMS's foundation. This activity is appropriate for assessing the effectiveness of the ISMS.

A POA&M must state when each weakness will be remediated, so the target completion date is a mandatory element. It satisfies the stem by providing the scheduled milestone against which remediation progress is tracked and closed.

A first-party audit is an internal audit conducted by the organization itself to assess its own controls, processes, or compliance. It is used for self-assessment and improvement, without external pressure. In this scenario, you are an internal auditor with full access, so it is a first-party audit. This type of audit helps identify gaps before external audits.

The official, version-controlled, and management-approved policy document is the authoritative source for the policy's content. It provides direct evidence of what the policy states and ensures that the assessor is reviewing the current, approved version. This is the most reliable evidence to verify compliance with framework requirements.

When a control is inherited from another provider, the responsibility for assessing that control lies with the provider that implements it. The CSP's assessor should leverage the IaaS provider's existing FedRAMP authorization package, which includes assessment results. This avoids redundant testing and ensures that the control is evaluated by qualified assessors. The CSP must verify that the inherited control meets the required baseline and that the IaaS provider's authorization is current.

A chain of custody records who handled evidence, when, and why. This prevents tampering and ensures evidence remains admissible in legal or regulatory proceedings. In security assessments, maintaining an unbroken chain of custody is essential to demonstrate that evidence has not been altered. It provides a verifiable history that supports the integrity and authenticity of the evidence collected.

NIST SP 800-137 identifies configuration management as a foundational element of continuous monitoring. It ensures that changes to hardware, software, and firmware are tracked and assessed for security impact. Without it, the organization cannot maintain an accurate baseline or determine whether changes introduce new vulnerabilities. The auditor should verify that configuration items are inventoried and changes are approved and documented.

Following the Prepare for Assessment phase, NIST SP 800-53A directs assessors to conduct the assessment itself, gathering evidence and examining, interviewing and testing controls against the defined scope. This 'Assess Security Controls' step produces the findings later consolidated during reporting.

In cloud-native environments, the provider operates the underlying infrastructure, so organisations inherit fewer controls directly and must instead rely on third-party audit reports, such as SOC 2 attestations, as evidence that provider-side controls function effectively.

Interviewing incident response team members helps assess their understanding of their roles, responsibilities, and the procedures they must follow. It also evaluates the effectiveness of training and communication. This is a critical component of assessing incident response capability because even a well-documented plan can fail if the team is not prepared. Interviews provide direct evidence of readiness.

The System Security Plan documents the security controls selected and implemented for a system based on its risk assessment, describing control implementation and responsibilities. It is the authoritative artefact linking assessed risk to the specific controls the organisation commits to operating.

A pre-assessment meeting aligns both parties before formal auditing begins, setting expectations and coordinating logistics. This satisfies the stem's requirement by establishing scope, timelines, evidence requirements and points of contact upfront, reducing misunderstandings during fieldwork. It is preparatory rather than evaluative, so no control testing or compliance determination occurs at this stage.

A self-assessment is conducted internally by the organisation's own staff to evaluate control effectiveness, without an external auditor or regulator driving it. This matches the stem's requirement for an internal department review performed free of external pressure.

Rules of Engagement define the authorised scope, boundaries, timing, and constraints of an assessment, forming the primary agreement between assessor and target organisation. They establish what systems may be tested, satisfying the requirement to outline audit scope before work begins.

The SAP defines the scope, objectives, timeline, and responsibilities for the assessment. It is the foundational document that ensures all parties agree on what will be assessed and how. Before any testing or evidence collection begins, the SAP must be approved to prevent scope creep and misunderstandings. It directly addresses the need to establish a shared understanding of the assessment boundaries.

The continuous monitoring plan (CMP) is the document that outlines the organization's strategy for ongoing monitoring of security controls, including the frequency of assessments, the types of reports, and the roles and responsibilities. Under FedRAMP, the CMP is a required deliverable that describes how the cloud service provider will maintain continuous monitoring. Reviewing the CMP provides the necessary information to verify compliance.

A High risk finding requires the system owner to record the weakness in the POA&M with milestones, resources and a remediation schedule, satisfying the stem's requirement for a plan of action. Simply accepting or ignoring the finding leaves the risk unmanaged and unauthorised.

The system security plan is the foundational document that describes the system boundary, its components, the data flows, and how security controls are implemented. Requesting it first allows the assessor to understand the scope and design of the system, which is essential for planning the assessment. Without the SSP, the assessor would lack the context needed to select appropriate assessment procedures.

The SSP documents the implemented controls, their scope, and any tailoring statements, such as scoping guidance or parameter values. Reviewing it first ensures that assessment procedures are aligned with what is actually implemented and avoids assessing controls that are not applicable or are inherited from a common provider. This step is critical for scoping the assessment accurately.

Communicating findings to stakeholders fulfils the Assessment Reporting phase's core purpose: translating raw assessment results into decision-ready information. This satisfies the stem's requirement for the phase's primary goal, since reporting exists to inform risk decisions, authorisation judgements and remediation priorities — not to perform testing, which belongs to earlier assessment phases.

OVAL defines an XML-based language for expressing system configuration checks, enabling SCAP tools to assess and report on a target's state. It satisfies the stem's configuration-state assessment purpose, distinct from CVE identifiers or CVSS scoring.

Documenting the weakness in a Plan of Action and Milestones satisfies FedRAMP's continuous monitoring requirement: POA&Ms formally record each identified control deficiency, assign remediation milestones, and track progress to closure. This is the mandatory mechanism auditors expect when a required control is unmet, ensuring the finding is tracked rather than left unresolved.

ISO/IEC 27007 provides guidance specifically for auditing information security management systems against ISO/IEC 27001, covering audit programme management, competence, and evidence gathering. It satisfies the stem's requirement for the framework governing how information security audits are conducted.

The CMVP validation certificate is issued under the Cryptographic Module Validation Program, the accredited body that tests cryptographic modules against FIPS 140-3 requirements. It directly evidences independent third-party validation, satisfying the stem's demand for the strongest compliance proof rather than vendor self-assertion.

Examining audit logs and account management records provides objective evidence of whether temporary privileges were revoked as required. This method directly verifies the control's operation by checking actual system activity against policy. It is the most reliable way to determine if the account management control is effective, as it reveals discrepancies between intended and actual behavior without relying on subjective statements.

The auditor should request evidence that demonstrates the compensating controls are implemented and effective. This could include configuration settings, logs, or test results. By evaluating the evidence, the auditor can determine whether the risk is adequately mitigated or if the finding should stand. This collaborative approach respects the system owner's input while maintaining objectivity and evidence-based conclusions.