Audits and Assessments SY0-701 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A security team wants to actively exploit vulnerabilities in their systems to determine the real-world impact of a potential breach. Which activity is most appropriate?

   • AVulnerability scanning
   • BInternal audit
   • CAttestation
   • DPenetration testing
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team is planning a penetration test to evaluate the security of a new web application. They want to simulate an attack by a malicious insider who has limited access to the system. What type of penetration test should they conduct?

   • ABlack-box test
   • BGrey-box test
   • CInternal audit
   • DWhite-box test
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is required to provide evidence to a regulatory body that its financial reporting systems have adequate security controls. The company hires an external auditor to assess these controls and issue a report. What is the primary benefit of using an external auditor for this assessment?

   • AIs less expensive than conducting an internal audit
   • BProvides an independent and objective evaluation of the controls
   • CGuarantees that all vulnerabilities will be found
   • DEliminates the need for internal security controls
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An organization's internal audit team is planning its annual audit schedule. They have limited resources and must prioritize which systems to audit. The team has identified three systems: a legacy system that is critical to operations but has known vulnerabilities, a new system that is not yet in production, and a low-risk internal tool. What should the team prioritize?

   • AThe legacy system, because it is critical and has known vulnerabilities
   • BThe new system, because it is new and may have unknown issues
   • CThe low-risk internal tool, because it is easy to audit
   • DAll systems equally, to ensure comprehensive coverage
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is preparing for a major product launch and wants to ensure its new web application is secure. The security team has a limited budget and must choose between an automated vulnerability scan and a manual penetration test. The application is critical and handles sensitive customer data. What is the most important consideration when making this choice?

   • AThe penetration test provides deeper analysis by attempting to exploit vulnerabilities, while a scan only identifies potential issues.
   • BThe vulnerability scan is more accurate because it uses up-to-date vulnerability databases.
   • CThe vulnerability scan is faster and cheaper, making it the better choice for a limited budget.
   • DThe penetration test is always required by compliance standards, so it must be performed.
   Reveal Solution Discussion Select an answer first