Purpose of a Security Audit CT-SEC Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which objective is typically associated with a security audit?

   • AAssessing the effectiveness of security controls
   • BDeploying security software across the network
   • CDeveloping a business continuity plan
   • DTraining employees on security awareness
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A large enterprise is required by its industry regulator to undergo an independent security audit every two years. The company's internal audit team is well-qualified and has conducted internal audits for years. To meet the regulatory requirement, what type of audit should the company arrange?

   • APeer review conducted by another department within the company
   • BSelf-assessment performed by the security team
   • CExternal audit conducted by an independent third-party firm
   • DInternal audit conducted by the company's audit team
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company is required to comply with both ISO 27001 and the NIST Cybersecurity Framework. The company wants to conduct a single security audit that satisfies both requirements. The audit team is considering which criteria to use. What is the most appropriate approach?

   • AUse ISO 27001 as the primary criteria and map NIST CSF requirements to it
   • BUse NIST CSF as the primary criteria and ignore ISO 27001
   • CConduct two separate audits, one for each standard
   • DUse a custom set of criteria that combines both standards
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which phase of a security audit involves gathering evidence about security controls?

   • AFollow-up
   • BData collection
   • CPlanning
   • DReporting
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is conducting a security audit to verify compliance with data protection regulations. The audit team has limited resources and must decide which systems to include. The company's customer database is the primary focus of the regulations, while the internal employee portal is not directly covered. What is the most appropriate scope decision?

   • AInclude the customer database and any systems that interact with it
   • BInclude only the customer database in the audit scope
   • CInclude both the customer database and the employee portal in the audit scope
   • DInclude only the employee portal, as it is less protected and more likely to have issues
   Reveal Solution Discussion Select an answer first