The Chief Executive Officer (CEO) wants to implement an internal audit of the company's information security posture. The CEO wants to avoid any bias in the audit process; therefore, has assigned the Sales Director to conduct the audit.
After significant interaction over a period of weeks the audit concludes that the company's policies and procedures are sufficient, robust and well established. The CEO then moves on to engage an external penetration testing company in order to showcase the organization's robust information security stance. This exercise reveals significant failings in several critical security controls and shows that the incident response processes remain undocumented.
What is the MOST likely reason for this disparity in the results of the audit and the external penetration test?

Question

The Chief Executive Officer (CEO) wants to implement an internal audit of the company's information security posture. The CEO wants to avoid any bias in the audit process; therefore, has assigned the Sales Director to conduct the audit.

After significant interaction over a period of weeks the audit concludes that the company's policies and procedures are sufficient, robust and well established. The CEO then moves on to engage an external penetration testing company in order to showcase the organization's robust information security stance. This exercise reveals significant failings in several critical security controls and shows that the incident response processes remain undocumented.

What is the MOST likely reason for this disparity in the results of the audit and the external penetration test?

William Macy · Accepted Answer

The scope of the penetration test exercise and the internal audit were significantly different.

William Macy · Answer

The external penetration testing company used custom zero-day attacks that could not have been predicted.

William Macy · Answer

The information technology (IT) and governance teams have failed to disclose relevant information to the internal audit team leading to an incomplete assessment being formulated.

William Macy · Answer

The audit team lacked the technical experience and training to make insightful and objective assessments of the data provided to them.

Question list

List of questions

Question 1

(1)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 1031 - CISSP discussion

Suggested answer: C

0 comments