6.5 - Conduct or Facilitate Security Audits CISSP Practice Questions (Page 4)

Questions 16–19

1. 16application · medium

   A multinational company's internal audit team is planning an annual security audit of its finance department. The finance department uses a hybrid environment: an on-premises ERP system and a cloud-based expense management SaaS. The audit team has full administrative access to the on-premises systems but only read-only access to the SaaS configuration and logs. The audit objective is to verify that segregation of duties (SoD) is enforced for financial transactions. Which approach best addresses the audit scope given the access constraints?

   • APerform the audit using only the on-premises ERP data, since the SaaS is outside the organization's direct control and cannot be reliably audited.
   • BRequest full administrative access to the SaaS platform from the vendor before proceeding, as read-only access is insufficient for any meaningful audit.
   • CLimit the audit to the on-premises ERP and issue a formal disclaimer stating that the SaaS component is out of scope due to lack of access.
   • DAudit the on-premises ERP directly and request that the SaaS vendor provide a SOC 2 report and relevant configuration exports to supplement the audit evidence.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An organization is conducting an internal audit of its cloud-based infrastructure. The audit team needs to collect evidence of proper configuration of virtual machines (VMs) and network security groups (NSGs). The team has been granted read-only access to the cloud management console. Which approach is most appropriate for collecting evidence in this cloud environment?

   • ATake screenshots of the cloud console pages showing VM configurations and NSG rules as the primary evidence.
   • BRely on the cloud provider's SOC 2 report as sufficient evidence of proper configuration, without further testing.
   • CRequest that the cloud provider perform the audit and provide a report, since the provider has full access to the environment.
   • DUse the cloud provider's API or CLI with read-only credentials to export configuration settings and NSG rules for analysis.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   When auditing a cloud-based system, what is a key consideration for evidence collection?

   • AThe auditor can collect evidence without any access to the cloud provider
   • BThe auditor must collect evidence from the organization's on-premises systems only
   • CThe auditor must physically inspect the servers
   • DThe auditor may need to rely on the cloud provider's certifications and reports
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which entity is most likely to conduct a third-party audit?

   • AThe organization's internal audit team
   • BA business partner with a vested interest in the organization
   • CA regulatory body or certification body
   • DA cloud service provider auditing its own infrastructure
   Reveal Solution Discussion Select an answer first