6.4 Coordinate with Auditors and Regulators in Support of Internal and External Audit Processes ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   When evaluating an audit finding, what is the security manager assessing?

   • AThe schedule for the next audit
   • BThe validity, impact, and root cause of the finding
   • CThe auditor's qualifications
   • DThe cost of the audit itself
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An external audit has identified a high-severity finding related to inadequate encryption of sensitive data at rest. The company must respond with a corrective action plan. What is the most critical element to include in the initial response?

   • AA statement that the company will comply with all regulatory requirements related to encryption.
   • BA commitment to implement encryption within a specific timeframe, with assigned responsibilities and milestones.
   • CA request for an extension of the audit deadline to allow more time to develop the plan.
   • DA detailed technical solution for implementing encryption across all data stores.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What should be tracked during the monitoring of remediation actions?

   • AThe personal opinions of the auditors
   • BThe cost of the audit
   • CThe number of days since the last audit
   • DThe status and completion of each action item
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is undergoing a regulatory audit that requires access to a legacy system that is only available during business hours. The audit team is located in a different time zone and can only conduct the audit during their own business hours, which overlap with the company's off-peak hours. The compliance officer must coordinate the audit activities. What is the most appropriate action?

   • AProvide the audit team with remote access to the legacy system so they can conduct the audit during their own business hours.
   • BCoordinate with the audit team to schedule specific times when the legacy system is available and the audit team can access it, even if it requires some flexibility from both parties.
   • CAsk the audit team to adjust their working hours to align with the company's business hours.
   • DProvide the audit team with a data extract from the legacy system so they can review it offline.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An external audit has identified a finding that the company's patch management process is not consistently applied across all servers. The IT team disputes the finding, stating that the servers are patched manually and that the audit only looked at a small sample. The compliance officer must evaluate the finding. What is the most appropriate action?

   • AAccept the finding because the auditors are independent and have expertise in patch management.
   • BRequest that the auditors expand their sample to include more servers before making a decision.
   • CReview the patch management logs and compare them against the audit sample to determine if the finding is accurate.
   • DReject the finding because the IT team has provided a valid explanation for the patch management process.
   Reveal Solution Discussion Select an answer first