6.1 - Design and Validate Assessment, Test, and Audit Strategies CISSP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is required by a regulator to have an independent security audit. The company's internal audit team has already performed a thorough assessment. The regulator has not specified the qualifications of the auditor. What is the most important factor in selecting an external auditor?

   • AThe auditor's ability to complete the audit quickly and at the lowest cost.
   • BThe auditor's familiarity with the company's internal team members.
   • CThe auditor's independence from the company and their relevant industry experience.
   • DThe auditor's willingness to use the company's internal audit tools.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is assessing the security of its cloud-based applications. The internal team has identified a critical vulnerability in the application code. The company wants to remediate the vulnerability before the next assessment. What is the most important factor in determining the remediation priority?

   • AThe availability of a patch from the software vendor.
   • BThe likelihood of exploitation and the potential impact on the business.
   • CThe number of systems affected by the vulnerability.
   • DThe cost of the remediation effort.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A manufacturing company is required by a new data protection regulation to have its data processing activities audited by an independent third party. The company has never undergone such an audit. What is the most appropriate action for the company to take?

   • ASelect a reputable external audit firm with experience in the industry and regulatory requirements.
   • BWait for the regulatory body to conduct the audit at its discretion.
   • CHave the company's legal team review the data processing activities and issue a compliance statement.
   • DAsk the internal audit department to perform the audit and certify compliance.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is migrating its on-premises data center to a public cloud. The security team needs to assess the security of the cloud environment before the migration is complete. The team has experience with on-premises assessments but is new to cloud. What is the most important thing for the team to do?

   • ARely on the cloud provider's security certifications instead of performing their own assessment.
   • BWait until the migration is complete and then assess the entire environment at once.
   • CUse the same assessment tools and procedures as for on-premises without modification.
   • DTrain the team on cloud-specific security concepts and the shared responsibility model.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A retail company is required by its payment card processor to have an annual security assessment of its payment systems. The company has a small internal IT team. What is the most appropriate strategy to meet this requirement?

   • AHire a Qualified Security Assessor (QSA) to conduct the assessment and provide a compliance report.
   • BUse a generic security assessment framework without specific payment industry focus.
   • CHave the internal IT team perform the assessment and self-certify compliance.
   • DAsk the payment card processor to perform the assessment on behalf of the company.
   Reveal Solution Discussion Select an answer first