CISSP Exam - Question 262

Question

The Chief Executive Officer (CEO) wants to implement an internal audit of the company's information security posture. The CEO wants to avoid any bias in the audit process; therefore, has assigned the Sales Director to conduct the audit. After significant interaction over a period of weeks the audit concludes that the company's policies and procedures are sufficient, robust and well established. The CEO then moves on to engage an external penetration testing company in order to showcase the organization's robust information security stance. This exercise reveals significant failings in several critical security controls and shows that the incident response processes remain undocumented. What is the MOST likely reason for this disparity in the results of the audit and the external penetration test?

Examice · Accepted Answer

The internal audit conducted by the Sales Director likely did not have the necessary technical expertise to thoroughly evaluate the information security posture. Properly assessing security controls and incident response processes requires specialized knowledge which the Sales Director probably lacked. This inadequacy could lead to an incomplete or inaccurate audit, failing to identify critical vulnerabilities that an experienced external penetration testing company would uncover.

Jamati · Answer

A salesman has no business running InfoSec audits.

rajkamal0 · Answer

A is the best answer.

Rollizo · Answer

it could be really that the internal audit had a focus only in commercial matters

629f731 · Answer

While technical expertise is crucial for certain assessments, the core reason for the disparity, given the context, seems to be the difference in scope and objectives between the internal audit and the external penetration test, making option B (The scope of the penetration test exercise and the internal audit were significantly different) the MOST likely reason.

oudmaster · Answer

B is not true, because the scope is the same as PenTest; "Information Security Posture".

Proctored_Expert · Answer

D. The information technology (IT) and governance teams have failed to disclose relevant information to the internal audit team leading to an incomplete assessment being formulated.

xxxBadManxxx · Answer

The internal audit, conducted by the Sales Director, likely focused on assessing policies and procedures rather than conducting technical assessments or testing of critical security controls. Conversely, the external penetration test would have involved comprehensive technical testing, including attempts to exploit vulnerabilities and weaknesses in the system. This difference in scope could lead to varying results, with the external penetration test uncovering weaknesses that were not identified by the internal audit

CCNPWILL · Answer

Answer is A ... Gimme question.

CISSP Exam - Question 262

Discussion