6.4 Coordinate with Auditors and Regulators in Support of Internal and External Audit Processes ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When coordinating audit scheduling, what is a key consideration for the security manager?

   • ASelecting the audit findings that will be reported
   • BEnsuring key personnel and systems are available during the audit window
   • CChoosing the audit methodology and testing procedures
   • DDeciding which regulations apply to the audit
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a key component of a formal audit response?

   • AA promise to never have findings again
   • BA request to cancel the audit
   • CA corrective action plan with timelines and responsible parties
   • DA list of excuses for the findings
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Who should be identified in a corrective action plan?

   • AThe parties responsible for implementing the corrective actions
   • BThe auditors who found the issues
   • CThe external regulators
   • DThe customers affected by the findings
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is it important to coordinate audit timelines with regulators in advance?

   • ATo allow auditors to extend the audit indefinitely
   • BTo ensure the audit does not conflict with other organizational activities
   • CTo give the organization time to hide non-compliant practices
   • DTo eliminate the need for internal audit reviews
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An external auditor has reported a finding that the company's firewall rules are not reviewed regularly. The network team disputes the finding, stating that they review the rules annually, which they believe is sufficient. The compliance officer must validate the finding. What is the most appropriate action?

   • AReject the finding because the network team has provided evidence of annual reviews.
   • BAccept the finding because the auditors have determined that annual reviews are not sufficient.
   • CReview the firewall review logs and compare them against the audit requirement to determine if the finding is accurate.
   • DAsk the auditors to provide a specific requirement for firewall review frequency.
   Reveal Solution Discussion Select an answer first