mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: Wants to verify that its security policies are…
An organization wants to verify that its security policies are being followed by employees. Which testing method is most appropriate?
⚠ Common exam trap
Watch out — candidates often confuse 'compliance audit' with 'vulnerability scan' because both involve checking systems, but the audit is specifically about policy adherence by people and processes, not technical flaws.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compliance audit
A compliance audit is the most appropriate method to verify that security policies are being followed because it systematically compares actual practices, configurations, and controls against documented policy requirements. Unlike technical scans that identify vulnerabilities, a compliance audit focuses on adherence to rules, standards, and procedures, often using checklists derived from frameworks like ISO 27001 or NIST SP 800-53.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Compliance audit
Why this is correct
A compliance audit systematically evaluates an organization's adherence to established security policies, standards, regulations, and best practices. It involves reviewing documentation, interviewing personnel, and examining controls to determine if they are implemented and operating effectively as prescribed by the policy. This process directly verifies whether the organization's actions align with its stated security commitments.
- ✗
Vulnerability scan
Why it's wrong here
A vulnerability scan is an automated technical assessment designed to identify known security weaknesses or misconfigurations within systems, networks, and applications. While it can reveal deviations from technical standards, its primary focus is on discovering exploitable flaws rather than comprehensively verifying adherence to overarching organizational security policies or procedural controls. It does not assess the existence or effectiveness of policy documentation or employee training.
- ✗
Risk assessment
Why it's wrong here
A risk assessment is a methodical process used to identify potential threats, analyze their likelihood and impact on organizational assets, and evaluate the overall level of risk. Its purpose is to inform decision-making regarding risk mitigation strategies and resource allocation, not to directly audit whether existing security policies are being followed. While policies might be considered during a risk assessment, the assessment itself is not a compliance verification activity.
- ✗
Penetration test
Why it's wrong here
A penetration test is a simulated cyberattack conducted by ethical hackers to actively exploit identified vulnerabilities and assess the resilience of an organization's security controls from an adversarial perspective. This hands-on, goal-oriented exercise focuses on technical exploitability and the ability to breach defenses, rather than auditing the formal documentation or procedural adherence to security policies. It tests the *effectiveness* of controls against real-world attacks, not their *compliance* with written policy.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
ISO 27001
ISO 27001 is an international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS).
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.