6.1 - Design and Validate Assessment, Test, and Audit Strategies CISSP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A global company must comply with data residency regulations that require personal data to remain within specific geographic boundaries. The company uses a third-party auditor to assess its cloud infrastructure. What is the most important consideration when designing the audit strategy?

   • AEnsure the auditor has the ability to assess data residency controls and that the audit scope includes verification of data location.
   • BRequire the auditor to perform the audit from within the same geographic region as the data.
   • CAsk the cloud provider to certify that data is stored in the correct region, without independent verification.
   • DLimit the audit to the application layer and avoid reviewing the underlying cloud infrastructure.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company's internal security team is planning a penetration test of a critical application. The application is hosted in a hybrid environment, and the team has limited time due to an upcoming audit. The team wants to maximize coverage while minimizing risk to production systems. What is the most effective approach?

   • APerform a full-scale test of all components, including production, without prioritization.
   • BOnly test the external-facing components, as they are the most likely attack vectors.
   • CUse a combination of internal and external testing, focusing on the most critical components first.
   • DDefer the penetration test until after the audit to allow more time for preparation.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a primary advantage of using an internal team for security assessments?

   • AThe team is required to report findings to external regulators.
   • BThe team has deep familiarity with the organization's systems, networks, and processes.
   • CThe team provides an independent perspective that is free from internal biases.
   • DThe team has no prior knowledge of the organization's systems, ensuring unbiased testing.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a common reason an organization would choose an external assessment over an internal one?

   • ATo ensure the assessment is completed faster by leveraging internal knowledge.
   • BTo reduce the cost of the assessment by using in-house staff.
   • CTo keep all findings confidential within the organization.
   • DTo gain an independent and unbiased view of the organization's security posture.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is moving its customer relationship management (CRM) system to a public cloud provider. The security team needs to assess the security of the CRM system in the cloud. What is the most important consideration for this assessment?

   • AFocusing only on the application code and ignoring the underlying cloud infrastructure.
   • BAssuming the cloud provider has already secured everything, so no assessment is needed.
   • CUnderstanding the shared responsibility model to determine what the company must assess versus what the cloud provider is responsible for.
   • DPerforming the same physical security assessment as for the on-premises data center.
   Reveal Solution Discussion Select an answer first