CISSP Security Assessment and Testing Practice Question
An organization is preparing for an ISO 27001 certification audit. The audit will be performed by an external body. This type of audit is classified as:
⚠ Common exam trap
Candidates often confuse an internal audit (conducted by the organization's own staff) with an external audit (conducted by an independent third party), especially when the question emphasizes 'preparing for certification' — candidates may mistakenly think internal audits are sufficient for certification, but only an external audit by an accredited body can grant ISO 27001 certification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
External audit
An external audit is performed by an independent third-party organization, such as a certification body, to assess compliance against a standard like ISO 27001. In this scenario, the audit is conducted by an external body specifically for certification purposes, which directly matches the definition of an external audit. This type of audit provides an unbiased evaluation of the Information Security Management System (ISMS) and is required for formal certification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Self-assessment
Why it's wrong here
A self-assessment involves an organization evaluating its own compliance with ISO 27001 requirements using its internal resources and criteria. While crucial for identifying gaps and preparing for an audit, it inherently lacks the independence and objective verification required by an accredited certification body. Therefore, a self-assessment alone cannot result in official ISO 27001 certification, serving instead as a preparatory internal review.
- ✓
External audit
Why this is correct
An external audit is a formal, systematic examination performed by an independent, accredited third-party certification body to verify an organization's conformity with the ISO 27001 standard. This impartial assessment ensures objectivity and credibility, providing the necessary assurance for official certification. It is the definitive step required to achieve and maintain ISO 27001 compliance, as only an external body can grant the certification.
- ✗
Peer review
Why it's wrong here
Peer review involves colleagues or peers within the organization examining specific documents, processes, or controls for accuracy and effectiveness. This collaborative method is valuable for quality assurance and knowledge sharing but is inherently informal and lacks the structured methodology, independence, and formal reporting required for an ISO 27001 certification audit. It serves a different purpose than a formal compliance assessment.
- ✗
Internal audit
Why it's wrong here
An internal audit is a systematic, independent, and documented process conducted by the organization's own personnel or designated internal resources to evaluate the effectiveness of its Information Security Management System (ISMS) against ISO 27001 requirements. While mandatory for maintaining ISO 27001 compliance and preparing for external audits, it does not possess the ultimate third-party independence required by an accredited certification body to grant the actual certification.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Information security management
Information security management is the systematic process of developing, implementing, monitoring, and improving policies, procedures, and controls to protect an organization's information assets from threats and ensure confidentiality, integrity, and availability.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.