Security Assessment and Testing GISP Practice Questions (Page 7)

Questions 31–33

1. 31foundation · easy

   What is the primary role of a security audit?

   • ATo exploit vulnerabilities in production systems
   • BTo replace the need for continuous monitoring
   • CTo design new security controls from scratch
   • DTo evaluate compliance with policies, standards, and regulations
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a key difference between penetration testing and vulnerability assessment?

   • APenetration testing is only performed on external systems, while vulnerability assessment is internal
   • BPenetration testing actively exploits vulnerabilities to determine impact, while vulnerability assessment primarily identifies and lists them
   • CVulnerability assessment is always automated, while penetration testing is always manual
   • DVulnerability assessment requires written authorization, while penetration testing does not
   Reveal Solution Discussion Select an answer first
3. 33expert · hard

   An organization is preparing for a regulatory audit. The security manager must ensure that the organization's security controls are documented and that evidence of their effectiveness is available. The manager has a limited time to prepare and must decide whether to conduct an internal audit or hire an external auditor. The internal team knows the systems well, but the external auditor provides independence. The organization has a history of internal teams overlooking issues due to familiarity. What is the most appropriate decision?

   • AConduct an internal audit and have the internal team self-certify the findings.
   • BDelay the audit preparation until the regulator provides more specific guidance.
   • CConduct an internal audit because the internal team knows the systems best.
   • DHire an external auditor to provide an independent evaluation of the controls and evidence.
   Reveal Solution Discussion Select an answer first