hardMultiple ChoiceObjective-mapped
Compliance Audit: Mapping Security Controls to Regulatory Clauses
A company's compliance officer wants to ensure that the organization's security controls meet regulatory requirements for data protection. The officer requests a review of the controls against the regulation's specific clauses. Which type of assessment is most appropriate?
Quick Answer
The answer is a compliance audit because it is the only assessment type that directly maps security controls to specific regulatory clauses, such as GDPR Article 32 or HIPAA Security Rule §164.312, to verify adherence to legal requirements. Unlike a risk assessment, which identifies and prioritizes threats based on likelihood and impact, or a vulnerability assessment, which scans for technical weaknesses, a compliance audit uses structured checklists and evidence collection to confirm that each control satisfies a mandated clause. On the CISSP exam, this distinction tests your understanding of the Governance and Risk Management domain, where the common trap is confusing a risk assessment’s broader scope with the precise, clause-by-clause verification of a compliance audit. Remember the mnemonic “CAR” for Compliance Audit = Regulatory mapping, Risk assessment = Threat prioritization, Vulnerability scan = Technical gaps.
⚠ Common exam trap
It's easy for candidates to confuse a compliance audit with a risk assessment, as both involve reviewing controls, but only the audit measures adherence to specific regulatory clauses rather than prioritizing risks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compliance audit
A compliance audit is the correct assessment type because it systematically evaluates security controls against specific regulatory clauses (e.g., GDPR Article 32, HIPAA Security Rule §164.312). Unlike risk or vulnerability assessments, a compliance audit maps controls directly to legal requirements to verify adherence, often using checklists and evidence collection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk assessment
Why it's wrong here
Evaluates overall risk, not specific regulatory requirements.
- ✗
Vulnerability assessment
Why it's wrong here
Identifies technical vulnerabilities, not regulatory compliance.
- ✗
Penetration test
Why it's wrong here
Tests security by simulating attacks, not compliance.
- ✓
Compliance audit
Why this is correct
Structured review against regulatory clauses.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization wants to verify that its security policies are being followed by employees. Which testing method is most appropriate?
medium- ✓ A.Compliance audit
- B.Vulnerability scan
- C.Risk assessment
- D.Penetration test
Why A: A compliance audit is the most appropriate method to verify that security policies are being followed because it systematically compares actual practices, configurations, and controls against documented policy requirements. Unlike technical scans that identify vulnerabilities, a compliance audit focuses on adherence to rules, standards, and procedures, often using checklists derived from frameworks like ISO 27001 or NIST SP 800-53.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.