SSCP Security Auditing & Compliance Standards 2

Question 1

Which audit type is performed without prior notice to the auditee to capture the true state of security controls?

Accepted Answer

Unannounced audit

Answer

Unannounced audits capture the genuine state of controls because staff cannot prepare or temporarily implement missing safeguards.

Question 2

Under HIPAA Security Rule, which of the following is a required implementation specification?

Accepted Answer

Audit controls

Answer

Audit controls is a required specification under the Technical Safeguards section of the HIPAA Security Rule, while encryption is addressable.

Question 3

A SOC 2 Type II report differs from a SOC 2 Type I report primarily because it:

Accepted Answer

Evaluates control design and operating effectiveness over a period of time

Answer

SOC 2 Type II assesses both the design and operating effectiveness of controls over a defined review period, not just their design at a point in time.

Question 4

Which PCI DSS requirement mandates that cardholder data environments use unique IDs for each person with computer access?

Accepted Answer

Requirement 8

Answer

PCI DSS Requirement 8 requires that all users be assigned a unique ID to ensure accountability and traceability of actions.

Question 5

Which term describes the practice of comparing an organization's security controls against an established baseline or best-practice framework?

Accepted Answer

Gap analysis

Answer

A gap analysis identifies differences between the current state of controls and the desired baseline or framework requirements.

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Security Auditing & Compliance Standards 2