Purpose of a Security Audit CT-SEC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary difference between a security audit and a security assessment?

   • AAn audit is performed only by external parties, while an assessment is only internal
   • BAn audit verifies compliance against criteria, while an assessment evaluates overall security posture
   • CAn audit is always automated, while an assessment is always manual
   • DAn audit focuses on vulnerabilities, while an assessment focuses on compliance
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A mid-sized company is preparing for an ISO 27001 certification. Management wants an independent evaluation of its information security management system (ISMS) before the formal certification audit. The company's internal security team has deep knowledge of the systems but lacks certification experience. What is the most appropriate approach?

   • ASkip the pre-audit and proceed directly to the formal certification audit to save time and cost.
   • BEngage an external third-party auditor to perform a pre-certification audit and issue a gap analysis report.
   • CHave the internal security team conduct the audit and prepare the certification report.
   • DAsk the internal team to perform a self-assessment and submit it directly to the certification body.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An audit team is in the process of gathering evidence for a security audit. The team is reviewing access control lists, interviewing system administrators, and examining security incident logs. Which phase of the audit process is the team currently in?

   • APlanning and preparation
   • BFollow-up and remediation
   • CReporting and recommendations
   • DData collection and analysis
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company's management is concerned about the overall security posture and wants a comprehensive evaluation of its security controls, policies, and procedures. The goal is to identify weaknesses and verify that the implemented controls are effective. Which activity best meets this need?

   • AReview security logs to detect past incidents
   • BConduct a security audit to evaluate controls against defined criteria
   • CPerform a penetration test to exploit vulnerabilities
   • DRun a vulnerability scan to identify known weaknesses
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a typical deliverable of a security audit?

   • AAn audit report detailing findings and recommendations
   • BA list of employee performance reviews
   • CA set of newly implemented security controls
   • DA marketing plan for the security team
   Reveal Solution Discussion Select an answer first