Question 290 A department's user access recertifications are signed by a former manager. What should auditors verify? Track key risk and performance indicators tied to control objectives Record exercise failures, owners, corrective actions and re-test evidence Measure applied patch state, exceptions and remediation times against thresholds Cross-check reviewer authority and current manager ownership for approvals Explanation Correct Answer D:A signature is weak evidence if the approver lacked responsibility at review time. Incorrect Answers A:Metrics are valuable when they support decisions about meaningful risk or effectiveness; it is relevant where a risk dashboard displays thousands of firewall events without any governance objective, whereas the current facts require cross-check reviewer authority and current manager ownership for approvals to address the stated problem. B:The other scenario states that a disaster recovery drill discovers a contact list with obsolete phone numbers, where process improvement requires traceable remediation of demonstrated weaknesses; by contrast, the present case requires cross-check reviewer authority and current manager ownership for approvals. C:Deployment actions need independent state verification to support compliance conclusions; although this helps when a company claims all patches meet policy because a script was deployed, it leaves the current case's need to cross-check reviewer authority and current manager ownership for approvals unresolved.
Question 291 A company claims all patches meet policy because a script was deployed. What evidence is more meaningful? Track key risk and performance indicators tied to control objectives Cross-check reviewer authority and current manager ownership for approvals Collect periodic restore test results against recovery objectives Measure applied patch state, exceptions and remediation times against thresholds Explanation Correct Answer D:Deployment actions need independent state verification to support compliance conclusions. Incorrect Answers A:The other scenario states that a risk dashboard displays thousands of firewall events without any governance objective, where metrics are valuable when they support decisions about meaningful risk or effectiveness; by contrast, the present case requires measure applied patch state, exceptions and remediation times against thresholds. B:The other scenario states that a department's user access recertifications are signed by a former manager, where a signature is weak evidence if the approver lacked responsibility at review time; by contrast, the present case requires measure applied patch state, exceptions and remediation times against thresholds. C:Backup job completion is not proof that usable systems or data can be recovered; it is relevant where a company tracks successful backups but never validates a restore, whereas the current facts require measure applied patch state, exceptions and remediation times against thresholds to address the stated problem.
Question 292 An incident response procedure changes but no one records tabletop lessons. What program record should be established? Capture exercise observations and incorporate approved procedural revisions Track key risk and performance indicators tied to control objectives Record exercise failures, owners, corrective actions and re-test evidence Collect periodic restore test results against recovery objectives Explanation Correct Answer A:A tested process depends on feedback and version-controlled improvement. Incorrect Answers B:For the separate situation in which a risk dashboard displays thousands of firewall events without any governance objective, metrics are valuable when they support decisions about meaningful risk or effectiveness; here the stated problem requires capture exercise observations and incorporate approved procedural revisions. C:Process improvement requires traceable remediation of demonstrated weaknesses; this responds to the different circumstance in which a disaster recovery drill discovers a contact list with obsolete phone numbers, while the current case states that an incident response procedure changes but no one records tabletop lessons, calling for capture exercise observations and incorporate approved procedural revisions. D:For the separate situation in which a company tracks successful backups but never validates a restore, backup job completion is not proof that usable systems or data can be recovered; here the stated problem requires capture exercise observations and incorporate approved procedural revisions.
Question 293 A scan reports a critical vulnerability on an isolated retired test system. How should its finding be reported? Schedule evidence-based follow-up and retesting of agreed fixes Classify findings by risk and assign remediation ownership, deadlines and exceptions Reassess the evidence and document whether the control changes residual exposure Present validated severity, exposure context and agreed remediation priority separately Explanation Correct Answer D:Risk reporting must distinguish technical weakness from operational and business impact. Incorrect Answers A:The other scenario states that an assessment concludes with recommendations but never verifies remediation, where security assurance improves when corrective actions are validated, not just promised; by contrast, the present case requires present validated severity, exposure context and agreed remediation priority separately. B:Prioritized reporting allows management to address consequential issues instead of an undifferentiated backlog; although this helps when an audit report labels every observation 'failed' without rating materiality or owner, it leaves the current case's need to present validated severity, exposure context and agreed remediation priority separately unresolved. C:This option fits a different fact pattern where a third party disputes a finding and presents a compensating control: objective validation considers material mitigating evidence without suppressing the finding; the current case instead requires present validated severity, exposure context and agreed remediation priority separately.
Question 294 An assessor finds evidence that contradicts the approved security baseline. What should the report contain? Document the deviation, underlying evidence, owner and corrective action recommendation Document exception rationale, accountable approver, compensating measures and review date Schedule evidence-based follow-up and retesting of agreed fixes Classify findings by risk and assign remediation ownership, deadlines and exceptions Explanation Correct Answer A:A useful audit finding identifies the observed control deviation, objective supporting evidence, accountable owner and corrective action; these elements allow remediation to be tracked and independently rechecked. Incorrect Answers B:The other scenario states that a management team accepts an audit exception with no expiry date, where permanent informal waivers undermine accountable risk treatment and recurring verification; by contrast, the present case requires document the deviation, underlying evidence, owner and corrective action recommendation. C:For the separate situation in which an assessment concludes with recommendations but never verifies remediation, security assurance improves when corrective actions are validated, not just promised; here the stated problem requires document the deviation, underlying evidence, owner and corrective action recommendation. D:For the separate situation in which an audit report labels every observation 'failed' without rating materiality or owner, prioritized reporting allows management to address consequential issues instead of an undifferentiated backlog; here the stated problem requires document the deviation, underlying evidence, owner and corrective action recommendation.
Question 295 A penetration tester discovers personal data during authorized testing outside the requested data sample. What should be done? Minimize further access and follow agreed privacy and disclosure escalation procedures Classify findings by risk and assign remediation ownership, deadlines and exceptions Document the deviation, underlying evidence, owner and corrective action recommendation Reassess the evidence and document whether the control changes residual exposure Explanation Correct Answer A:Authorized testing is still constrained by data handling and evidence minimization rules. Incorrect Answers B:The other scenario states that an audit report labels every observation 'failed' without rating materiality or owner, where prioritized reporting allows management to address consequential issues instead of an undifferentiated backlog; by contrast, the present case requires minimize further access and follow agreed privacy and disclosure escalation procedures. C:This option fits a different fact pattern where an assessor finds evidence that contradicts the approved security baseline: traceable findings support accountability and subsequent verification; the current case instead requires minimize further access and follow agreed privacy and disclosure escalation procedures. D:The other scenario states that a third party disputes a finding and presents a compensating control, where objective validation considers material mitigating evidence without suppressing the finding; by contrast, the present case requires minimize further access and follow agreed privacy and disclosure escalation procedures.
Question 296 A security team wants to disclose an unpatched supplier weakness on social media immediately. What process should precede publication? Minimize further access and follow agreed privacy and disclosure escalation procedures Coordinate responsible vulnerability disclosure and risk mitigation with affected stakeholders Document exception rationale, accountable approver, compensating measures and review date Document the deviation, underlying evidence, owner and corrective action recommendation Explanation Correct Answer B:Uncontrolled disclosure can increase exploitation risk and break agreed obligations. Incorrect Answers A:This option fits a different fact pattern where a penetration tester discovers personal data during authorized testing outside the requested data sample: authorized testing is still constrained by data handling and evidence minimization rules; the current case instead requires coordinate responsible vulnerability disclosure and risk mitigation with affected stakeholders. C:For the separate situation in which a management team accepts an audit exception with no expiry date, permanent informal waivers undermine accountable risk treatment and recurring verification; here the stated problem requires coordinate responsible vulnerability disclosure and risk mitigation with affected stakeholders. D:The other scenario states that an assessor finds evidence that contradicts the approved security baseline, where traceable findings support accountability and subsequent verification; by contrast, the present case requires coordinate responsible vulnerability disclosure and risk mitigation with affected stakeholders.
Question 297 An audit report labels every observation 'failed' without rating materiality or owner. What should change? Document the deviation, underlying evidence, owner and corrective action recommendation Document exception rationale, accountable approver, compensating measures and review date Classify findings by risk and assign remediation ownership, deadlines and exceptions Reassess the evidence and document whether the control changes residual exposure Explanation Correct Answer C:Prioritized reporting allows management to address consequential issues instead of an undifferentiated backlog. Incorrect Answers A:Traceable findings support accountability and subsequent verification; this responds to the different circumstance in which an assessor finds evidence that contradicts the approved security baseline, while the current case states that an audit report labels every observation 'failed' without rating materiality or owner, calling for classify findings by risk and assign remediation ownership, deadlines and exceptions. B:Permanent informal waivers undermine accountable risk treatment and recurring verification; although this helps when a management team accepts an audit exception with no expiry date, it leaves the current case's need to classify findings by risk and assign remediation ownership, deadlines and exceptions unresolved. D:The other scenario states that a third party disputes a finding and presents a compensating control, where objective validation considers material mitigating evidence without suppressing the finding; by contrast, the present case requires classify findings by risk and assign remediation ownership, deadlines and exceptions.
Question 298 A third party disputes a finding and presents a compensating control. How should the tester respond? Reassess the evidence and document whether the control changes residual exposure Coordinate responsible vulnerability disclosure and risk mitigation with affected stakeholders Present validated severity, exposure context and agreed remediation priority separately Document exception rationale, accountable approver, compensating measures and review date Explanation Correct Answer A:Objective validation considers material mitigating evidence without suppressing the finding. Incorrect Answers B:Uncontrolled disclosure can increase exploitation risk and break agreed obligations; it is relevant where a security team wants to disclose an unpatched supplier weakness on social media immediately, whereas the current facts require reassess the evidence and document whether the control changes residual exposure to address the stated problem. C:For the separate situation in which a scan reports a critical vulnerability on an isolated retired test system, risk reporting must distinguish technical weakness from operational and business impact; here the stated problem requires reassess the evidence and document whether the control changes residual exposure. D:For the separate situation in which a management team accepts an audit exception with no expiry date, permanent informal waivers undermine accountable risk treatment and recurring verification; here the stated problem requires reassess the evidence and document whether the control changes residual exposure.
Question 299 An assessment concludes with recommendations but never verifies remediation. What process closes the gap? Classify findings by risk and assign remediation ownership, deadlines and exceptions Coordinate responsible vulnerability disclosure and risk mitigation with affected stakeholders Schedule evidence-based follow-up and retesting of agreed fixes Document the deviation, underlying evidence, owner and corrective action recommendation Explanation Correct Answer C:Security assurance improves when corrective actions are validated, not just promised. Incorrect Answers A:Prioritized reporting allows management to address consequential issues instead of an undifferentiated backlog; although this helps when an audit report labels every observation 'failed' without rating materiality or owner, it leaves the current case's need to schedule evidence-based follow-up and retesting of agreed fixes unresolved. B:This option fits a different fact pattern where a security team wants to disclose an unpatched supplier weakness on social media immediately: uncontrolled disclosure can increase exploitation risk and break agreed obligations; the current case instead requires schedule evidence-based follow-up and retesting of agreed fixes. D:For the separate situation in which an assessor finds evidence that contradicts the approved security baseline, traceable findings support accountability and subsequent verification; here the stated problem requires schedule evidence-based follow-up and retesting of agreed fixes.
Question 300 A management team accepts an audit exception with no expiry date. What should be recorded? Schedule evidence-based follow-up and retesting of agreed fixes Coordinate responsible vulnerability disclosure and risk mitigation with affected stakeholders Reassess the evidence and document whether the control changes residual exposure Document exception rationale, accountable approver, compensating measures and review date Explanation Correct Answer D:Permanent informal waivers undermine accountable risk treatment and recurring verification. Incorrect Answers A:Security assurance improves when corrective actions are validated, not just promised; it is relevant where an assessment concludes with recommendations but never verifies remediation, whereas the current facts require document exception rationale, accountable approver, compensating measures and review date to address the stated problem. B:For the separate situation in which a security team wants to disclose an unpatched supplier weakness on social media immediately, uncontrolled disclosure can increase exploitation risk and break agreed obligations; here the stated problem requires document exception rationale, accountable approver, compensating measures and review date. C:Objective validation considers material mitigating evidence without suppressing the finding; it is relevant where a third party disputes a finding and presents a compensating control, whereas the current facts require document exception rationale, accountable approver, compensating measures and review date to address the stated problem.
