CSC Security Control Auditing 2

Question 1

During a security control audit, an auditor discovers that a firewall rule set has not been reviewed in 18 months. Which audit finding category best describes this?

Accepted Answer

Control deficiency

Answer

Material weakness

Answer

Significant deficiency

Answer

Observation

Question 2

Which sampling method selects audit samples based on the monetary value or risk weighting of transactions?

Accepted Answer

Monetary unit sampling

Answer

Random sampling

Answer

Stratified sampling

Answer

Judgmental sampling

Question 3

An organization uses a third-party service for payroll processing. Under SOC 2 Type II auditing, what document provides assurance about the service provider's controls?

Accepted Answer

SOC 2 Type II report from the service organization

Answer

Penetration test report

Answer

Vendor security questionnaire

Answer

ISO 27001 certificate

Question 4

What is the primary purpose of a compensating control in an audit context?

Accepted Answer

To satisfy a compliance requirement when the primary control cannot be implemented

Answer

To replace a failed detective control

Answer

To document exceptions in the audit trail

Answer

To monitor the effectiveness of preventive controls

Question 5

An auditor is testing access controls and pulls a list of all user accounts. She compares this to HR termination records. What audit procedure is she performing?

Accepted Answer

Reconciliation

Answer

Substantive testing

Answer

Walkthrough

Answer

Observation

Question 6

Which NIST SP 800-53A assessment method involves the auditor watching personnel perform their duties to verify control operation?

Accepted Answer

Observe

Answer

Interview

Answer

Examine

Answer

Test

Question 7

A control audit reveals that privileged access reviews are performed annually instead of the required quarterly cadence. This is best documented as a:

Accepted Answer

Audit finding with a root cause and remediation plan

Answer

Risk acceptance

Answer

Policy exception

Answer

Inherent risk