Audits and Assessments SY0-701 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of an internal audit in the context of security program management?

   • ATo provide a formal attestation to external customers
   • BTo identify and correct weaknesses in security controls and processes
   • CTo replace the need for continuous monitoring
   • DTo simulate an attack to test incident response
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company wants to test its security defenses against a realistic external attack without providing any prior information to the testers. The testers will attempt to breach the network using only publicly available information. What type of penetration test is this?

   • AGrey-box test
   • BWhite-box test
   • CBlack-box test
   • DInternal audit
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A multinational corporation is preparing for an external audit required by a new data protection regulation. The audit will assess the company's compliance with the regulation across all its global operations. The company's legal team is concerned about the scope of the audit and the potential for findings to be used against them. What is the most important step the company should take before the audit begins?

   • AClearly define the audit scope and objectives in a formal agreement with the auditor
   • BLimit the auditor's access to only the systems that are known to be compliant
   • CConduct a penetration test to identify all vulnerabilities before the auditor does
   • DDelay the audit until all potential issues are resolved
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An internal audit team is reviewing the security of a new application before it is deployed. They are checking whether the application's authentication and authorization controls are implemented correctly. What is the primary goal of this internal audit?

   • ATo exploit vulnerabilities in the application
   • BTo ensure that security controls are effective and aligned with policies
   • CTo provide a formal attestation of compliance to external parties
   • DTo replace the need for external audits
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is undergoing an external audit for a compliance framework. The auditor has requested access to the company's network diagrams and configuration files. The company's security team is concerned about the sensitivity of this information. What is the most appropriate way to handle this request?

   • ARefuse to provide the information, as it is too sensitive
   • BProvide the information under a non-disclosure agreement (NDA) and limit access to the auditor
   • CProvide only a summary of the information, not the full details
   • DProvide the information without any restrictions, as the auditor is trusted
   Reveal Solution Discussion Select an answer first