Discussion
Consider the following statements about evidencing security controls.
1. An auditor asks for evidence that a control operated, not that it exists.
2. Automated configuration checks produce that evidence continuously.
3. A written policy alone is sufficient evidence that a control operated.
Answer: B
The first two are correct and describe what an audit actually looks for. The third confuses intent with operation, since a policy nobody followed produces no evidence at all and is precisely the gap an audit is designed to find.
No comment is present. Be the first to comment.
Loading…
Post your comment
Please log in or register to post a comment.
Examination Categories
- SSC Exams
- Banking Exams
- Teaching Exams
- Civil Services Exams
- Railways Exams
- Engineering Recruitment Exams
- Defence Exams
- State Government Exams
- Police Exams
- Insurance Exams
- Nursing Exams
- Other Government Exams
- NRA CET
- PG Entrance Exams
- Campus Placement
- MBA Entrance Exams
- CUET and UG Entrance
- Judiciary Exams
- Regulatory Body Exams
- Software Development