6.1 - Design and Validate Assessment, Test, and Audit Strategies CISSP Practice Questions (Page 5)

Questions 21–24

1. 21application · medium

   A healthcare organization is required by its insurance carrier to have an independent security assessment of its patient portal. The organization's internal team has already performed vulnerability scans and penetration tests. What is the most appropriate next step?

   • AReview the internal team's reports and submit them to the carrier without further testing.
   • BEngage a qualified external penetration testing firm to conduct an independent assessment.
   • CRequest the software vendor to perform a self-assessment of the portal and share the report.
   • DAsk the internal team to re-run the same tests and document the results for the carrier.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a key characteristic of an external assessment strategy?

   • AIt is performed by an organization's own security team.
   • BIt is always required by law for all organizations.
   • CIt is conducted by an independent entity outside the organization's control.
   • DIt is limited to reviewing documentation and never involves active testing.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A university's IT department wants to assess the security of its student information system, which is hosted on-premises. The department has a dedicated security team. What is the most effective way to conduct this assessment?

   • AUse an automated cloud-based scanning service to assess the on-premises system.
   • BHave the internal security team perform a comprehensive vulnerability assessment and penetration test.
   • COutsource the assessment to an external firm to ensure objectivity.
   • DRely on the system vendor's security certifications without performing any testing.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is an implication of conducting an assessment in a hybrid environment?

   • AThe assessment can be performed using a single set of tools and procedures across all components.
   • BThe assessment does not need to consider data flow between the two environments.
   • CThe assessment is limited to the cloud portion only, as on-premises is not part of the environment.
   • DThe assessment must consider both on-premises and cloud components and their interconnections.
   Reveal Solution Discussion Select an answer first