6.4 Coordinate with Auditors and Regulators in Support of Internal and External Audit Processes ISSMP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An internal audit report identifies a finding that the company's firewall rules are overly permissive, allowing unnecessary inbound traffic. The security team disputes the finding, stating that the rules are required for a legacy application. As the compliance officer, what is your first step in evaluating this finding?

   • AAccept the finding as valid because the auditors are independent and have expertise.
   • BEscalate the dispute to senior management for a decision.
   • CReject the finding because the security team has provided a valid reason for the configuration.
   • DReview the firewall configuration and the legacy application's requirements to determine if the finding is accurate.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of determining the root cause of an audit finding?

   • ATo develop an effective corrective action plan
   • BTo assign blame to a specific employee
   • CTo delay the audit response
   • DTo justify the audit cost
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   During the planning phase of an external audit, which activity is the security manager primarily responsible for coordinating with the audit team?

   • ADefining the audit scope, objectives, and required resources
   • BApproving the final audit report for issuance
   • CImplementing all corrective actions identified in the prior audit
   • DExecuting the audit tests and collecting evidence
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An auditor reports a finding that the company's data retention policy is not being followed, citing examples of old data that should have been deleted. The data owner claims the data is still needed for an ongoing legal matter. What should the compliance officer do to validate the finding?

   • AReview the legal hold requirements and the data retention policy to determine if the data is exempt from deletion.
   • BAccept the finding because the auditor has provided examples of non-compliance.
   • CAsk the auditor to provide more examples of non-compliance before making a decision.
   • DReject the finding because the data owner has provided a valid reason for retaining the data.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company has remediated an audit finding by implementing a new data classification scheme. Before closing the finding, the compliance officer must validate the remediation. What is the most appropriate validation method?

   • ASample a set of data assets and verify that they are classified according to the new scheme.
   • BWait for the next audit to verify the implementation.
   • CAsk the data owners to confirm that they have classified their data.
   • DReview the new data classification policy and confirm that it has been approved by management.
   Reveal Solution Discussion Select an answer first