6.4 Coordinate with Auditors and Regulators in Support of Internal and External Audit Processes ISSMP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During an external audit, the auditors request access to the company's incident response logs. The logs are stored in a SIEM tool that is managed by a third-party vendor. The company's security team is concerned about sharing sensitive log data with the auditors. What is the most appropriate action for the compliance officer?

   • AProvide the auditors with direct access to the SIEM tool so they can review the logs independently.
   • BDeny the auditors' request because the logs are considered proprietary and confidential.
   • CRequest the vendor to export the relevant logs and provide them to the auditors in a secure manner.
   • DAsk the auditors to sign a non-disclosure agreement before providing them with the logs.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An audit has identified a finding that the company's backup procedures are not adequately tested. The compliance officer must formulate a response. What is the most appropriate response?

   • AAcknowledge the finding and commit to conducting quarterly backup restoration tests, with the first test scheduled within 90 days.
   • BState that the company will improve its backup testing procedures without specifying a timeline.
   • CExplain that the current backup procedures are sufficient and that the finding is not valid.
   • DRequest that the auditors provide specific recommendations for improving backup testing.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   After an audit, the company has agreed to implement a new access control policy within six months. The compliance officer is responsible for monitoring the remediation. What is the most effective way to track progress?

   • ASend a single reminder to the responsible team two months before the deadline.
   • BAsk the auditors to monitor the remediation on behalf of the company.
   • CWait until the six-month deadline and then verify that the policy has been implemented.
   • DSchedule monthly check-ins with the responsible team to review progress against milestones.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Why is it important to validate that remediation actions meet regulatory requirements?

   • ATo ensure the organization remains compliant with applicable laws
   • BTo increase the audit budget
   • CTo satisfy the auditors' personal preferences
   • DTo reduce the number of future audits
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of monitoring remediation actions?

   • ATo track the implementation of actions to ensure they are completed as planned
   • BTo close the audit without further action
   • CTo reassign the audit team
   • DTo find new audit findings
   Reveal Solution Discussion Select an answer first