SSCP Security Auditing & Compliance Standards 5

Question 1

Which control framework specifically addresses security requirements for US federal information systems and is mandated by law?

Accepted Answer

FISMA / NIST SP 800-53

Answer

FISMA (Federal Information Security Modernization Act) mandates that federal agencies implement security controls defined in NIST SP 800-53.

Question 2

An organization receives an audit finding that its change management process lacks formal rollback procedures. This finding is BEST addressed by:

Accepted Answer

Updating change management policy and procedures to include rollback steps and testing

Answer

The finding identifies a process gap; the correct remediation is to update procedures to include rollback planning and test those procedures.

Question 3

Which term describes the process where an organization independently verifies that its own controls are operating as intended before an external audit?

Accepted Answer

Internal audit / self-assessment

Answer

Internal audits or self-assessments allow organizations to proactively identify gaps and remediate them before external auditors review the same controls.

Question 4

Under SOX Section 404, management and external auditors must report on the effectiveness of:

Accepted Answer

Internal controls over financial reporting

Answer

SOX Section 404 requires management to assess and report on internal controls over financial reporting (ICFR), with external auditor attestation.

Question 5

Which evidence collection method is considered MOST reliable in an audit because it is obtained directly by the auditor without intermediary involvement?

Accepted Answer

Direct observation by the auditor

Answer

Direct observation is the most reliable audit evidence because the auditor personally witnesses the control in operation, eliminating reliance on auditee-supplied information.

(SSCP) Security Operations and Administration Practice Test

(SSCP) Security Operations and Administration Practice Test

SSCP Security Auditing & Compliance Standards 5