6.5 - Conduct or Facilitate Security Audits CISSP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A publicly traded company is preparing for its annual financial statement audit. The external auditor has requested access to the company's IT general controls (ITGC) documentation, including user access reviews, change management logs, and backup testing results. The company's internal audit team has already performed a comprehensive review of these areas and found no significant deficiencies. What is the primary reason the external auditor still needs to perform their own testing rather than relying solely on the internal audit team's work?

   • AThe external auditor is required to issue an opinion on the effectiveness of the internal audit team's testing methodology.
   • BThe internal audit team's work is only valid for operational purposes and cannot be used for any regulatory compliance purposes.
   • CThe external auditor is required to duplicate all internal audit tests to ensure no fraud was missed by the internal team.
   • DThe external auditor must provide an independent and objective assessment, as they are not under the company's control, which is essential for the credibility of the audit opinion.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A healthcare organization is required to undergo a certification audit to maintain its HITRUST certification. The certification body has scheduled an on-site audit of the organization's primary data center and a remote audit of its cloud-based patient portal. The organization's IT team is responsible for facilitating the audit. Which action is most critical for the organization to take to ensure a smooth and successful certification audit?

   • AProvide the auditors with unrestricted administrative access to all systems, including the cloud portal, to demonstrate full transparency.
   • BAsk the cloud provider to conduct the audit on the organization's behalf, since the provider is responsible for the security of the portal.
   • CPrepare and provide evidence of compliance, such as policies, configuration screenshots, and access logs, while coordinating schedules for both on-site and remote audit activities.
   • DRequest that the certification body postpone the cloud portion of the audit until the organization can move the portal back on-premises.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A software development company is required to undergo a third-party audit to maintain its PCI DSS compliance. The auditor has scheduled a remote audit and will need to review the company's network architecture diagrams, firewall configurations, and vulnerability scan reports. The company's security team is responsible for facilitating the audit. Which action is most important for the security team to take?

   • APerform a new vulnerability scan immediately before the audit to ensure the reports are up-to-date.
   • BProvide the auditor with administrative access to the firewall to allow them to verify configurations directly.
   • CEnsure that all requested documents are current, accurate, and available in a secure repository for the auditor to access.
   • DRequest that the auditor rely on the company's internal audit reports instead of conducting their own review.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How does audit location affect the audit process?

   • AIt only affects the cost of the audit, not the process
   • BIt determines the type of audit (internal, external, or third-party)
   • CIt affects audit scope, evidence collection, and access controls
   • DIt has no effect on audit scope or evidence collection
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An organization is undergoing a third-party audit for ISO 27001 certification. The organization's IT infrastructure is fully cloud-based, with no on-premises servers. The auditor needs to verify the organization's access control policies and their implementation. Which evidence would be most appropriate for the organization to provide to the auditor for this cloud environment?

   • AExported configuration files and logs from the cloud provider's API showing user roles, permissions, and access review activities.
   • BScreenshots of the cloud console showing user permissions and access policies.
   • CA verbal assurance from the IT manager that access controls are properly configured.
   • DA copy of the cloud provider's SOC 2 Type II report, as it covers all necessary access control evidence.
   Reveal Solution Discussion Select an answer first