6.5 - Conduct or Facilitate Security Audits CISSP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is preparing for both an external financial audit and a third-party ISO 27001 surveillance audit. The external auditor requires access to the company's financial systems, while the ISO auditor requires access to the company's information security management system (ISMS) documentation. The company's audit coordinator has limited resources and must schedule both audits within the same month. Which approach is most effective for managing these concurrent audits?

   • AConduct both audits simultaneously, with the external auditor focusing on financial systems and the ISO auditor on ISMS documentation, using separate points of contact.
   • BAsk the external auditor to also review the ISMS documentation, as it is related to financial controls.
   • CProvide both auditors with the same set of documents to ensure they have all the information they need.
   • DPostpone the ISO surveillance audit until after the external financial audit is completed to avoid resource conflicts.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary role of an external audit?

   • ATo provide objective assurance to stakeholders about the organization's controls
   • BTo help the organization improve its internal processes
   • CTo replace the organization's internal audit function
   • DTo ensure the organization achieves its business objectives
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An organization's internal audit team is planning an audit of its cloud-based email system. The audit objective is to verify that data retention policies are correctly implemented. The team has read-only access to the cloud admin console. The team discovers that the retention policy for a specific mailbox is set to 'indefinite', which contradicts the organization's policy of 7 years. The mailbox belongs to a former employee who is involved in ongoing litigation. Which action should the audit team take?

   • AReport the finding as a compliance issue, as the retention policy does not match the organization's standard policy.
   • BInvestigate whether a litigation hold has been placed on the mailbox, as this would justify the indefinite retention.
   • CRecommend that the retention policy be changed to 7 years immediately to comply with the organization's policy.
   • DIgnore the finding, as the mailbox belongs to a former employee and is not within the audit scope.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is undergoing a third-party audit for SOC 2. The auditor needs to verify the company's backup and recovery procedures. The company's IT infrastructure is hybrid: critical data is stored on-premises, and a backup copy is stored in the cloud. The auditor has requested evidence of backup testing. The company's IT team has performed a backup restoration test six months ago and has documented the results. Which evidence is most appropriate to provide to the auditor?

   • AA new backup restoration test performed specifically for the audit, with results documented and provided to the auditor.
   • BThe documented results of the backup restoration test performed six months ago.
   • CA verbal assurance from the IT manager that backups are tested regularly and work correctly.
   • DA copy of the backup configuration settings showing that backups are scheduled and configured correctly.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A financial services firm is required to undergo a regulatory audit by a government agency. The agency has announced an unannounced on-site audit to review the firm's compliance with data protection regulations. The firm's management is concerned about the audit's impact on daily operations. Which action should the firm take to best prepare for this regulatory audit?

   • AProvide the auditors with a copy of the firm's internal audit reports and ask them to rely on that evidence instead of conducting their own testing.
   • BLimit the auditors' access to only the documents they explicitly request, to minimize the scope of the audit.
   • CRequest a postponement of the audit until the firm can prepare a comprehensive set of evidence.
   • DDesignate a single point of contact to coordinate with the auditors and ensure all requested documents and evidence are provided promptly.
   Reveal Solution Discussion Select an answer first