SY0-701 · Objective 5.5 · Security Program Management and Oversight
5.5 Audits and assessments explained
The official objective: “Explain types and purposes of audits and assessments.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 5.5 covers
Objective 5.5 sorts the ways an organisation's security gets checked. Questions describe who is doing the checking and how, and ask you to name the type.
Attestation is a formal statement that something is true, such as an auditor confirming that controls meet a standard. Internal audits are run by the organisation's own staff. They may focus on compliance with internal policy, report to an audit committee that oversees the audit function independently of operational management, and include self-assessments, where a team reviews its own controls against a framework's checklist without outside auditors.
External audits are run by outsiders. Regulatory examinations are carried out by a regulator, and their findings must be fixed. Assessments are broader evaluations. Independent third-party audits give customers and partners confidence that someone without a stake has checked the controls.
Penetration testing gets the most detail. A physical test tries to get into buildings, for example by following staff through doors. Offensive testing attacks; defensive testing focuses on detecting and responding. Integrated testing combines the two in real time, sometimes called purple teaming, so defenders learn as attackers work. The environment describes how much testers are told. In a known environment, testers get full information such as network diagrams and credentials. In a partially known environment, they get some. In an unknown environment, they get nothing and work like an outside attacker.
Reconnaissance is the information-gathering stage. Passive reconnaissance collects information without touching the target's systems: public websites, job postings, social media and DNS records. Active reconnaissance interacts with the target, such as port scanning, which the target could notice.
Test work must be agreed in advance. Rules of engagement set the scope, timing, allowed techniques and emergency contacts, so the test doesn't disrupt the business or break the law.
Read questions for two clues: who runs the check (own staff, regulator, independent third party) and how much the testers know (everything, something or nothing). Those two answers usually point straight to the right term.
What candidates mix up
- Internal audit versus self-assessment: an internal audit has some independence through the audit committee; a self-assessment is a team checking itself.
- Known versus unknown environment: known means full information is given; unknown means none.
- Passive versus active reconnaissance: passive never touches the target's systems; active does.
- Regulatory examination versus independent audit: a regulator's findings are mandatory; an independent audit is usually commissioned for assurance.
Practice questions for 5.5
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
A penetration test is scoped so the testers receive no network diagrams, credentials or system information in advance, simulating an outside attacker. What type of test is this?
- AAn unknown-environment test
- BA known-environment test
- CA partially known environment test
- DA defensive test
Show answer and explanation
Answer: A) An unknown-environment test
- AIn an unknown-environment (black-box) test, testers start with no inside knowledge, as an external attacker would.
- BIn a known-environment (white-box) test, testers receive full information such as diagrams and source code.
- CA partially known (gray-box) test gives testers some information, such as user-level credentials.
- DDefensive testing evaluates the blue team's detection and response; it doesn't describe how much information testers get.
Question 2
A bank's own staff review its controls against internal policy, while separately a regulator's examiners inspect the bank against legal requirements. How are these two activities best described?
- AInternal versus external audit
- BQualitative versus quantitative analysis
- CDue care versus due diligence
- DKnown versus unknown environment testing
Show answer and explanation
Answer: A) Internal versus external audit
- AInternal audits are performed by the organization's own staff; external audits come from independent parties such as regulators.
- BThose are risk analysis methods, not audit types.
- CThese describe an organization's obligations, not who performs an audit.
- DThose describe penetration test information levels.
Question 3
Before a penetration test begins, testers collect information from public websites, job postings and social media without sending any traffic to the target's systems. What is this phase?
- APassive reconnaissance
- BActive reconnaissance
- CExploitation
- DLateral movement
Show answer and explanation
Answer: A) Passive reconnaissance
- APassive reconnaissance gathers information without directly interacting with the target's systems.
- BActive reconnaissance probes the target directly, such as with port scans.
- CExploitation attempts to break into systems; nothing is being attacked yet.
- DLateral movement happens after initial access, moving between internal systems.
Other Security Program Management and Oversight objectives
Also: the Security Program Management and Oversight domain page (20% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.