Purpose of a Security Audit CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team is asked to evaluate the organization's compliance with internal security policies and identify areas for improvement. The team plans to compare current practices against the policies and produce a report with recommendations. However, the team is also asked to actively test the effectiveness of the controls by attempting to bypass them. Which approach best combines these requirements?

   • AConduct only a penetration test, as it covers both compliance and control effectiveness
   • BConduct a security audit to verify compliance and a penetration test to assess control effectiveness
   • CConduct a vulnerability scan and a risk assessment
   • DConduct only a security audit, as it covers both compliance and control effectiveness
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which statement best describes a security audit?

   • AA one-time penetration test to find exploitable vulnerabilities
   • BA process of implementing security patches and updates
   • CA continuous monitoring system that detects intrusions in real time
   • DAn independent examination of security controls and processes against criteria
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   During a security audit, the auditor discovers that a system administrator has been bypassing the change management process to apply urgent security patches. The administrator argues that this is necessary to protect the systems. The auditor is concerned about the lack of documentation. What is the most appropriate action for the auditor to take?

   • AReport the administrator to management for disciplinary action
   • BIgnore the finding, as the administrator's actions are justified
   • CImmediately stop the administrator from applying any more patches
   • DReport the finding in the audit report and recommend a formal change management process
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   After completing a security audit, the audit team has identified several critical vulnerabilities in the organization's network infrastructure. The team has documented the findings and is now preparing to communicate the results to management. What is the most important deliverable to produce at this stage?

   • AA summary of the audit team's qualifications
   • BA list of all systems that were not audited
   • CA detailed vulnerability scan report
   • DA formal audit report with findings and recommendations
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Who is typically responsible for ensuring that audit findings are addressed?

   • AThe auditees
   • BThe auditors
   • CExternal regulators
   • DManagement
   Reveal Solution Discussion Select an answer first