Security Auditing & Compliance Standards Flashcards

Which of the following BEST describes a continuous compliance monitoring approach?

Answer: Automated, real-time checks of controls against compliance requirements

Continuous compliance monitoring uses automated tools to provide real-time or near-real-time validation that controls remain effective and compliant.

Under FedRAMP, which authorization path allows a CSP to receive authorization from a single agency that other agencies can then leverage?

Answer: Agency Authorization

Agency Authorization allows a federal agency to sponsor a CSP, and other agencies can reuse that authorization rather than starting from scratch.

During an ISO 27001 surveillance audit, the auditor identifies a control that was previously certified but is now missing evidence of operation. This would MOST likely result in:

Answer: A major nonconformity requiring corrective action within a defined timeframe

A control that existed but lacks operational evidence is a major nonconformity that requires documented corrective action within a specified period.

Which NIST SP 800-53 control family addresses audit and accountability?

Answer: AU — Audit and Accountability

The AU (Audit and Accountability) control family in NIST SP 800-53 covers audit event logging, log content, audit review, and protection of audit information.

A retail organization undergoes a PCI DSS Qualified Security Assessor (QSA) audit. The QSA's role is to:

Answer: Validate compliance with PCI DSS requirements and issue a Report on Compliance

A QSA is authorized by the PCI SSC to assess compliance with PCI DSS and produce a formal Report on Compliance (ROC) for Level 1 merchants.

Which technique involves comparing access rights granted to users with those actually required for their job function to identify excessive privileges?

Answer: User access review (recertification)

User access reviews (recertification campaigns) compare provisioned rights against job requirements to revoke unnecessary or excessive privileges.

The 'right to audit' clause in a vendor contract primarily ensures that:

Answer: The organization can inspect the vendor's security controls and records

A right-to-audit clause contractually grants the organization (or its representatives) the ability to inspect, test, and review the vendor's security posture.