SSCP Security Auditing & Compliance Standards 3

Question 1

Which ISO 27001 document establishes the scope, objectives, and policies of an organization's information security management system?

Accepted Answer

Information Security Policy

Answer

The Information Security Policy sets top-level direction and commitment from management for the ISMS, defining scope and objectives.

Question 2

During a compliance audit, the auditor requests evidence of patch management activities. Which artifact BEST demonstrates timely patching?

Accepted Answer

Patch deployment logs with timestamps

Answer

Patch deployment logs with timestamps provide objective evidence that patches were actually applied and within acceptable timeframes.

Question 3

Which GDPR principle requires that personal data be collected for specified, explicit, and legitimate purposes?

Accepted Answer

Purpose limitation

Answer

The purpose limitation principle under GDPR requires organizations to collect data only for clearly defined, lawful purposes.

Question 4

The concept of 'separation of duties' in an audit context is designed primarily to prevent:

Accepted Answer

Single-person fraud or error going undetected

Answer

Separation of duties ensures no single individual can complete a sensitive process alone, reducing the risk of undetected fraud or error.

Question 5

Which framework is commonly used as a baseline for auditing IT governance and aligns IT goals with business objectives?

Accepted Answer

COBIT

Answer

COBIT (Control Objectives for Information and Related Technologies) provides a framework for IT governance and management aligned with business goals.

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Security Auditing & Compliance Standards 3