Security Audits and Security Testing CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An auditor is planning a security audit of a large organization with multiple business units. The audit sponsor wants the audit to be completed in one month, but the auditor estimates that a full audit would take three months. The sponsor insists that the audit must cover all business units. What is the BEST approach for the auditor to take?

   • AConduct the audit without sampling, covering every control in every business unit
   • BRefuse the audit because the timeline is unrealistic
   • CReduce the scope by excluding all business units except the largest one
   • DNegotiate a risk-based sampling approach that covers all business units but focuses on high-risk areas
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How does a security audit differ from security testing in terms of its primary focus?

   • AAn audit is always automated, while testing is always manual
   • BAn audit produces a list of vulnerabilities, while testing produces a compliance certificate
   • CAn audit focuses on compliance and control effectiveness, while testing focuses on identifying exploitable vulnerabilities
   • DAn audit is performed only by external parties, while testing is performed only by internal teams
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   During a security audit, the auditor finds a discrepancy between the documented firewall rules and the actual firewall configuration. The IT team claims the documentation is outdated and the actual configuration is correct. The auditor needs to determine the true state of the firewall. What is the MOST reliable evidence for the auditor to use?

   • AThe IT team's verbal explanation of the firewall rules
   • BThe outdated documentation, as it was approved by management
   • CThe actual firewall configuration file exported from the firewall device
   • DA network diagram showing the intended firewall architecture
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An organization is preparing for a security audit. The audit sponsor wants the audit to be completed within two weeks and to focus only on the payment processing system. The audit team has limited resources. What is the MOST important factor for the audit team to consider when planning the audit?

   • AThe audit team should use automated tools exclusively to save time
   • BThe audit must cover all systems in the organization to be comprehensive
   • CThe scope of the audit must be limited to the payment processing system to meet the deadline
   • DThe audit should be postponed until more resources are available
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team is planning to test the resilience of its network perimeter. They want to identify exploitable vulnerabilities in internet-facing services without causing disruption. Which security testing technique BEST fits this requirement?

   • ACode review of the application source code
   • BVulnerability scanning to identify known weaknesses in the services
   • CSocial engineering to test employee awareness
   • DPenetration testing to actively exploit vulnerabilities and gain access
   Reveal Solution Discussion Select an answer first