CSC Security Control Auditing 3

Question 1

Under the COSO Internal Control – Integrated Framework, which component addresses the organization's commitment to integrity and ethical values?

Accepted Answer

Control Environment

Answer

The Control Environment is the foundational component of COSO that sets the tone at the top, including commitment to integrity and ethical values.

Question 2

During a vulnerability assessment audit, an auditor finds that critical patches are applied within 72 hours but the policy requires 24 hours. What type of gap is this?

Accepted Answer

Operating effectiveness gap

Answer

An operating effectiveness gap means the control exists and is designed correctly but does not perform as required during actual execution.

Question 3

When auditing encryption controls, which factor is MOST important to verify for data at rest on a database server?

Accepted Answer

That database columns containing sensitive data use AES-256 or equivalent encryption

Answer

For data at rest, auditors verify that sensitive fields are encrypted using strong algorithms like AES-256 at the storage layer, not transport encryption.

Question 4

A CIS Controls audit maps findings to the Implementation Group (IG) framework. Which IG is recommended as the minimum baseline for all enterprises regardless of size?

Accepted Answer

IG1

Answer

CIS IG1 represents the essential cyber hygiene controls that all organizations should implement regardless of size, resource, or risk profile.

Question 5

Which audit evidence type carries the highest reliability when evaluating the existence of a security control?

Accepted Answer

System-generated logs obtained directly by the auditor

Answer

Evidence obtained directly by the auditor from source systems is more reliable than evidence provided by the auditee, which could be manipulated.

(CSC) Cybersecurity Compliance Certification Practice Test

(CSC) Cybersecurity Compliance Certification Practice Test

CSC Security Control Auditing 3