CSC Security Control Auditing 2

Question 1

During a security control audit, an auditor discovers that a firewall rule set has not been reviewed in 18 months. Which audit finding category best describes this?

Accepted Answer

Control deficiency

Answer

An unreviewed firewall rule set represents a control deficiency where the control is not operating as designed or intended.

Question 2

Which sampling method selects audit samples based on the monetary value or risk weighting of transactions?

Accepted Answer

Monetary unit sampling

Answer

Monetary unit sampling (MUS) gives each dollar unit an equal chance of selection, focusing audit attention on higher-value transactions.

Question 3

An organization uses a third-party service for payroll processing. Under SOC 2 Type II auditing, what document provides assurance about the service provider's controls?

Accepted Answer

SOC 2 Type II report from the service organization

Answer

A SOC 2 Type II report from the service organization provides independent assurance that its controls operated effectively over a defined period.

Question 4

What is the primary purpose of a compensating control in an audit context?

Accepted Answer

To satisfy a compliance requirement when the primary control cannot be implemented

Answer

Compensating controls are alternative measures that satisfy a compliance requirement when the standard control is not feasible to implement.

Question 5

An auditor is testing access controls and pulls a list of all user accounts. She compares this to HR termination records. What audit procedure is she performing?

Accepted Answer

Reconciliation

Answer

Reconciliation compares two data sets from different sources to identify discrepancies, here matching active accounts against HR termination data.

(CSC) Cybersecurity Compliance Certification Practice Test

(CSC) Cybersecurity Compliance Certification Practice Test

CSC Security Control Auditing 2