An organization is the victim of a major data breach just one month after passing an external cyber security audit. Which of the following is the likely reason for this situation?
A.
Both the auditor and the organization validated the controls to be accurate.
B.
The organization had the minimum level of controls in place to pass the audit.
C.
The auditor performed an in-depth analysis of the required controls.
D.
The audit was initiated by appropriate levels of management in the organization.
B. The organization had the minimum level of controls in place to pass the audit.
Explanation:
The scenario reflects the "compliance illusion" highlighted in the search results. Organizations often implement the bare minimum controls to satisfy audit checklists (e.g., PCI DSS, ISO 27001) without addressing real-world security gaps. For example:
A company might encrypt cardholder data (to pass PCI DSS) but fail to secure APIs or third-party integrations, leaving attack surfaces exposed.
Auditors may validate documented controls (e.g., firewall configurations) but not test for emerging threats like zero-day exploits or social engineering.
Why Other Options Are Incorrect:
A. Validated controls: Even if controls are "accurate," they may lack depth (e.g., outdated encryption standards).
C. In-depth analysis: Most audits focus on compliance, not adversarial testing (e.g., penetration tests).
D. Management-initiated audits: Leadership buy-in doesn’t guarantee robust controls; audits often prioritize compliance over security.
This section is not available anymore. Please use the main Exam Page.CISSP Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
a_kto_to
3 months agoBestCommentorNA
9 months, 2 weeks agojackdryan
1 year, 3 months ago