Skip to content
AvailabilitySign inBook a DemoStart free lab
Topic: Audits, Logging & MetricsSwitch
All CISSP topics

6.0 Security Assessment and Testing

Audits, Logging & Metrics Practice Questions

Audit types, SOC 1/2/3 and Type I vs. Type II, log review and SIEM, account reviews, and KPIs vs. KRIs.

One solved question, so you can see how these are marked

A security manager wants an unbiased evaluation of controls operated by the company itself, with the results used to improve the security program before the next certification review. Which assessment is BEST?

An internal audit performed under an approved audit plan

An internal audit evaluates the organization's own controls and can support improvement under an approved audit plan. A customer-commissioned or independent external audit provides outside assurance, while a penetration test targets technical weaknesses rather than the full control program.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

All 9 Audits, Logging & Metrics questions in this set

Answers and explanations appear when you work through the set above.

  1. A cloud provider gives a prospective customer a SOC report. The customer needs evidence that security controls operated effectively throughout the previous 12 months. Which report provides the MOST relevant evidence?

    • SOC 1 Type I
    • SOC 2 Type II
    • SOC 3 Type I
    • SOC 1 Type II

  2. An auditor is testing whether a privileged access approval control actually prevented unauthorized use during the last quarter. Which evidence is MOST appropriate?

    • The privileged access policy and a signed statement that administrators have read it
    • Sample requests, approvals, and access activity
    • A vulnerability scan showing no critical findings
    • A current network diagram showing the privileged system

  3. A SIEM review finds that authentication logs from a critical application are arriving several hours late. What should the security manager do FIRST?

    • Increase dashboard retention so delayed events remain searchable for the next audit
    • Disable authentication alerts until delivery is restored
    • Declare that the application has failed its audit
    • Investigate the logging path and preserve the affected period for review

  4. During a quarterly account review, a manager discovers several active accounts for contractors whose engagements ended. What is the BEST response?

    • Disable accounts under the offboarding procedure, investigate exposure, and fix lifecycle gaps
    • Keep the accounts active until the next annual audit
    • Delete the contractor accounts and their activity records immediately to prevent subsequent use of the credentials
    • Transfer ownership of the accounts to the service desk

  5. Which measure is a key risk indicator rather than a key performance indicator for an identity program?

    • Percentage of access requests completed within the service target
    • Median time for the help desk to resolve an access ticket
    • Percentage of terminated users still enabled past the required deadline
    • Number of quarterly access reviews completed on schedule

  6. Senior management receives a dashboard showing that vulnerability scans completed on schedule, but critical findings remain open beyond the risk acceptance period. What should the report emphasize?

    • The scan completion rate, treating on-time scanning as evidence that critical vulnerability risk has been resolved
    • The number of scanners deployed, because capacity is the main concern
    • The total number of findings without considering age or severity
    • Overdue critical exposure, business impact, ownership, and remediation or exception decisions

  7. A business relies on a payment processor and wants assurance over the processor's security controls without granting its own staff unrestricted access to the provider's environment. Which approach is MOST appropriate?

    • Perform an internal audit of the processor using the company's internal audit team
    • Evaluate an independent SOC 2 Type II report against the processor contract requirements
    • Accept the processor's marketing security statement as sufficient evidence
    • Run an unauthenticated vulnerability scan against the processor's public address

  8. An audit team is validating a control that requires daily review of alerts for impossible-travel sign-ins. Which test method gives the STRONGEST evidence that the review operated as required?

    • Sample dated reviews and alerts for documented investigation and disposition
    • Interview the dashboard analyst and obtain a description of the intended daily alert review procedure
    • Inspect the vendor's product brochure for alert functionality
    • Compare the organization's password length to its policy

  9. A board report shows mean time to detect improving while the number of high-confidence incidents missing the response service target is increasing. What is the BEST interpretation?

    • The security program is improving overall because one metric improved
    • The detection metric should be discarded because response is more important
    • Distinct outcomes requiring action on response capacity and risk
    • The organization should replace both measures with the number of security tools deployed