Free Audits, Assessments, and Frameworks practice questions

Internal audit reports directly to the audit committee of the board, so a finding about the CIO's department can't be buried by the CIO, and the audit charter sets out that reporting line. Reporting to the CIO, the CISO or the audited managers would put the people being checked in control of the findings.

Reperforming the control yourself, such as disabling a test account and confirming the access is gone, is the strongest evidence an auditor can gather. Watching someone perform the task is the tempting choice and beats an interview or a questionnaire, which are only claims, but observation is still weaker than inspecting records or reperforming the control.

Benchmarking compares an organization's measures with industry peers or a published baseline and answers how the organization compares. A gap analysis is the tempting choice, but it compares the current state with a target requirement to find what is missing, not with other companies.

A self-assessment is performed by the people who own the controls, so it is cheap and builds ownership but lacks independence, and its results are a starting point for internal and external auditors rather than a replacement for them. A formal opinion that outsiders rely on comes from an independent examination, not a self-rating.

An assertion is a claim made by management, and the auditor's job is to gather enough evidence to support or contradict it. Treating the statement as evidence is the classic mistake, because the claim is what is being tested; the opinion is the auditor's own conclusion, issued only after that testing.

A penetration test is an authorized attempt to exploit weaknesses the way an attacker would, confirming which findings are real and chaining them to show impact. A vulnerability scan only reports that a weakness probably exists, without trying to use it or relating one finding to another.

A known environment test gives testers full documentation, source code and accounts, so no time is spent on discovery and coverage is deepest in a short engagement. An unknown environment test gives the most realistic outsider view but takes longer and can miss weaknesses deep inside, and integrated describes purple teaming rather than what testers are told.

Physical testers carry a signed authorization letter naming the client, scope and dates, with an emergency contact who can confirm at any hour that the test is legitimate. A certification shows skill, not permission, and a network test's rules of engagement or a commercial SOW don't give a guard a quick way to verify the test.

Only someone with authority over the specific assets can approve testing them, so the county that controls the building must give written authorization. Paying for a test doesn't grant that right: in a 2019 Iowa case, testers hired by the state court administration were arrested inside a county courthouse because the county disputed the state's authority to approve the test.

The outside team plays the attacker and works toward a defined objective without the defenders being told, which is offensive, or red team, testing. Purple teaming would have attackers and defenders working openly together, and defensive testing is the blue team's side, measuring whether the SOC notices and contains the attack.