6.4 Coordinate with Auditors and Regulators in Support of Internal and External Audit Processes ISSMP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of defining the scope of an audit during the planning phase?

   • ATo guarantee that no findings will be identified
   • BTo assign blame for any control deficiencies found
   • CTo replace the need for regulatory oversight
   • DTo determine which systems, processes, and locations will be examined
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary role of the security manager during the execution of an audit?

   • AApproving the audit budget
   • BDetermining the final audit rating
   • CFacilitating communication and logistics between the organization and auditors
   • DPerforming the audit tests on behalf of the auditors
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What does validating an audit finding involve?

   • AVerifying the accuracy and completeness of the finding through evidence review
   • BRejecting all findings to minimize work
   • CAccepting the finding without question
   • DEscalating the finding to the CEO immediately
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is about to undergo an external audit that will cover multiple locations and systems. The audit team has requested a list of all systems and data flows. What is the most important consideration when defining the audit scope?

   • ALimiting the scope to only the systems that are critical to the audit objectives, while ensuring that all relevant areas are covered.
   • BIncluding all systems and data flows, even those that are not relevant to the audit objectives.
   • CAllowing the auditors to determine the scope without input from the company.
   • DExcluding any systems that are considered sensitive or confidential to protect them from auditor scrutiny.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company has completed the remediation of an audit finding by implementing multi-factor authentication (MFA) for all remote access. Before closing the finding, what should the compliance officer do to validate the remediation?

   • AAsk the auditors to confirm that the remediation is sufficient.
   • BConfirm that MFA is enabled on all remote access accounts by reviewing the configuration.
   • CReview the audit finding and assume that the remediation is complete because the team reported it as done.
   • DTest the MFA implementation by attempting to access the system without MFA and verifying that access is denied.
   Reveal Solution Discussion Select an answer first