SSCP Security Auditing & Compliance Standards 4

Question 1

Which of the following BEST describes a continuous compliance monitoring approach?

Accepted Answer

Automated, real-time checks of controls against compliance requirements

Answer

Continuous compliance monitoring uses automated tools to provide real-time or near-real-time validation that controls remain effective and compliant.

Question 2

Under FedRAMP, which authorization path allows a CSP to receive authorization from a single agency that other agencies can then leverage?

Accepted Answer

Agency Authorization

Answer

Agency Authorization allows a federal agency to sponsor a CSP, and other agencies can reuse that authorization rather than starting from scratch.

Question 3

During an ISO 27001 surveillance audit, the auditor identifies a control that was previously certified but is now missing evidence of operation. This would MOST likely result in:

Accepted Answer

A major nonconformity requiring corrective action within a defined timeframe

Answer

A control that existed but lacks operational evidence is a major nonconformity that requires documented corrective action within a specified period.

Question 4

Which NIST SP 800-53 control family addresses audit and accountability?

Accepted Answer

AU — Audit and Accountability

Answer

The AU (Audit and Accountability) control family in NIST SP 800-53 covers audit event logging, log content, audit review, and protection of audit information.

Question 5

A retail organization undergoes a PCI DSS Qualified Security Assessor (QSA) audit. The QSA's role is to:

Accepted Answer

Validate compliance with PCI DSS requirements and issue a Report on Compliance

Answer

A QSA is authorized by the PCI SSC to assess compliance with PCI DSS and produce a formal Report on Compliance (ROC) for Level 1 merchants.

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Security Auditing & Compliance Standards 4