CISSP Practice Question (Domain 6: Security Assessment and Testing)

A regulated enterprise relies on continuous automated control testing dashboards for audit readiness. An external auditor notes controls appear effective, but underlying test logic was recently modified by the same team being assessed. Management wants minimal disruption.

What is the MOST appropriate action to take NEXT?

A. Accept results since controls are continuously monitored

B. Perform an independent validation of assessment tools and methods

C. Increase testing frequency to offset potential bias

D. Document the issue as an accepted audit limitation

Study more now!

17 comments