6.5 - Conduct or Facilitate Security Audits CISSP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An internal audit team is conducting an audit of a cloud-based infrastructure that hosts a critical application. The team has read-only access to the cloud management console. The audit objective is to verify that the principle of least privilege is enforced for all user accounts. The team discovers that a service account has been granted 'Owner' role instead of a more limited role. However, the team cannot determine if this is a deliberate exception or an error. Which action should the audit team take?

   • AImmediately recommend that the 'Owner' role be revoked to enforce least privilege.
   • BInvestigate the change history and any associated approval records to determine if the 'Owner' role was properly authorized.
   • CIgnore the finding, as the audit team has read-only access and cannot verify the intent behind the role assignment.
   • DReport the finding as a high-risk issue, as the 'Owner' role violates the principle of least privilege.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a common objective of a third-party audit?

   • ATo verify compliance with regulations or achieve certification
   • BTo provide an independent opinion on financial statements
   • CTo replace the need for internal audits
   • DTo help the organization identify internal weaknesses
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a primary benefit of conducting an internal audit?

   • AIt provides an independent, unbiased opinion on the organization's security posture
   • BIt allows the organization to identify and address weaknesses in its own controls
   • CIt ensures compliance with all applicable laws and regulations
   • DIt replaces the need for any external or third-party audits
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An internal audit team is reviewing the security of a new cloud-based file sharing service adopted by the marketing department. The team has been granted read-only access to the service's admin console. The audit objective is to verify that external sharing links are properly controlled and expire as per policy. Which action should the audit team take to gather evidence?

   • ADisable all external sharing temporarily to test whether the controls are effective.
   • BAsk the marketing department to provide a list of all external links they have created.
   • CRequest that the cloud provider conduct a security assessment of the service and provide a report.
   • DReview the admin console's sharing settings and export a list of all active external sharing links with their expiration dates.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A large enterprise is preparing for an external audit of its financial reporting controls. The external auditor has requested access to the company's change management system to review recent changes to the ERP system. The company's internal IT team is responsible for facilitating this request. What is the most appropriate way for the IT team to provide access to the auditor?

   • AAsk the auditor to submit a formal request to the IT department for each specific change record they need.
   • BExport the change management logs to a spreadsheet and email them to the auditor.
   • CProvide the auditor with a temporary read-only account to the change management system, with access limited to the relevant change records.
   • DGive the auditor the credentials of a senior IT administrator to ensure they have full access to all records.
   Reveal Solution Discussion Select an answer first