Assessment And Audit

What is the primary function of an assessor's 'working papers'?

During an audit of an IAM system, the auditor notices that inactive accounts are not being disabled. Which control is failing?

Which THREE activities are part of the 'Assessment Execution' phase?

Which THREE types of findings might appear in an audit report?

Which TWO factors contribute to the 'scope' of an information security audit?

You are auditing a backup solution. Which metric is most critical for the Availability audit?

You are assessing an organization's compliance with SOC 2. The auditor requests evidence of 'Trust Services Criteria'. Which evidence is most relevant for the Availability criterion?

When conducting an audit, what is 'sampling'?

Which technique is best to detect 'false negatives' during a security control assessment?

During an assessment, you identify that an organization is not logging administrative access. What is the most appropriate recommendation in the final report?

Which TWO methods are commonly used to gather assessment evidence?

Which TWO types of controls are specifically examined during an audit?

Which THREE actions are essential for maintaining 'integrity' of audit evidence?

Which THREE items are critical when verifying an organization's Compliance with NIST SP 800-53?

A security auditor needs to verify that the principle of least privilege is applied to a Linux server. Which audit activity is most appropriate?

Which THREE roles are typically involved in a security assessment?

Which TWO elements are required to be included in a Plan of Action and Milestones (POA&M)?

You are performing a gap analysis. What is the correct order of operations for a professional assessment?

You are preparing a NIST SP 800-53A security control assessment. Which methodology step is performed immediately after the 'Prepare for Assessment' phase?

An organization is moving to a cloud-native infrastructure. What is the most significant change in the assessment of 'inherited' controls?

Which document defines the specific security controls that an organization must implement based on its risk assessment?

What is the purpose of a 'pre-assessment' meeting?

Which type of audit is performed by an internal department to assess the effectiveness of security controls without external pressure?

Which document serves as the primary agreement between an assessor and the target organization outlining the scope of an audit?

When an assessment report indicates a 'High' risk finding, what is the primary responsibility of the system owner regarding the POA&M?

Which TWO of the following are primary components of an effective security control assessment report?

During a control assessment, you use the 'examine, interview, and test' methods. Which of these is classified as an 'objective' evidence gathering technique?

What is the primary goal of the 'Assessment Reporting' phase?

When conducting an assessment using the SCAP protocol, what is the primary purpose of the OVAL component?

During a FedRAMP audit, you discover that a customer's cloud environment does not meet a required control. What is the mandatory next step to track this non-compliance?

Which standard provides the framework for conducting information security audits?

You are assessing a system for compliance with FIPS 140-3. Which evidence provides the strongest validation?