Assessment/Audit of Security and Privacy Controls

Planning, conducting, and reporting on security control assessments and audits, including risk response planning.

5 minutes 5 Questions

Assessment/Audit of Security and Privacy Controls is a critical process within Governance, Risk, and Compliance (GRC) frameworks that involves systematically evaluating an organization's security and privacy measures to ensure they are effectively designed, implemented, and operating as intended. …

Concepts covered
Compliance Evidence Collection and ReviewAssessment and Audit Plan DevelopmentAssessment Scoping: Assets, Methods, and Level of EffortAssessment Objectives, Scope, and LogisticsStakeholder Roles and Responsibilities in AssessmentAssessment Methods: Interview, Examine, TestPenetration Testing and Vulnerability ScanningEvidence Verification and ValidationPreliminary Findings and Risk Mitigation SummariesNon-Compliant Findings Reassessment and ValidationRisk Response Options: Avoid, Accept, Share, Mitigate, TransferFinal Assessment Report DevelopmentCompliance Determination DocumentationRisk Response Plan and PrioritizationResource Identification for Risk Mitigation
Test mode:
Start practice test

CGRC - Assessment/Audit of Security and Privacy Controls Example Questions

Test your knowledge of Assessment/Audit of Security and Privacy Controls

Question 1

An organization successfully resolves a non-compliant finding by increasing its central audit log retention from 30 days to the required 90 days. An independent assessor subsequently reviews the system and validates that the new configuration is fully operational and functioning as intended. What operational step must the compliance team perform next to accurately finalize this reassessment phase?

Correct Answer: Update the system security plan and the plan of action and milestones to reflect the newly validated retention setting.

Updating the system security plan and the plan of action and milestones is the correct step because it ensures the authorization documentation accurately reflects the resolved finding and the system's current operating state.

Pausing continuous monitoring is incorrect since monitoring must remain ongoing to detect new threats. Revising the inherent risk baseline is wrong because inherent risk represents the risk level before any mitigations are applied. Mandating a complete re-evaluation is unnecessary because only the modified control requires a targeted reassessment.

The key concept tested is remediation documentation and lifecycle management.

Question 2

A small business owner runs an online store and discovers that accepting credit card payments introduces a risk of data breaches. The owner decides to use a third-party payment processor to handle all credit card transactions. Which risk response option does this action represent?

Correct Answer: Transfer, because the responsibility for handling sensitive payment data is shifted to the third-party processor

Using a third-party payment processor represents risk transfer because the business owner is shifting the responsibility and liability for handling sensitive credit card data to another entity that specializes in secure payment processing.

Mitigation would involve implementing controls to reduce the risk while still handling the data internally. Sharing implies both parties jointly own and manage the risk, but here the processor assumes primary responsibility for payment data security. Avoidance would mean eliminating the risk entirely by not accepting credit cards at all, rather than outsourcing the function to someone else.

The key concept tested is distinguishing between risk transfer and other risk response strategies, particularly understanding that outsourcing a risky activity to a specialist constitutes transfer.

Question 3

Which statement best describes the primary function of establishing the assessment scope prior to conducting security control evaluations?

Correct Answer: It defines the specific system components, facilities, and organizational boundaries subjected to the evaluation process.

The correct answer accurately identifies that scoping establishes the boundaries of the assessment by specifying the system components, locations, and organizational elements to be evaluated.
Wrong answers are incorrect because sequencing tests and selecting tools are part of assessment planning rather than scoping, establishing remediation timelines occurs after the evaluation during the mitigation phase, and specifying budget constraints is an administrative project management function rather than the primary purpose of defining the assessment scope.
The key concept tested is the purpose of scoping in security control assessments.

More Assessment/Audit of Security and Privacy Controls questions
402 questions (total)
Practice 100 questions
One session at a time, always new questions