Exam CRISC topic 1 question 1787 discussion

An audit is a systematic and formal review that evaluates whether the administrative and technical controls have been implemented correctly and are functioning as intended. It includes documentation review, interviews, and testing to ensure that controls are reducing the risk effectively. Audits also provide an independent assessment of the control environment.

This tests for exploitable vulnerabilities and the effectiveness of certain technical controls but may not evaluate all administrative controls or the overall control environment.

Agree, it's C

Incorrect. C. ________________________ Perform a pentest. By conducting a penetration test, organizations can assess the effectiveness of the newly implemented administrative and technical controls in preventing unauthorized access, data breaches, or other security incidents. The test involves attempting to exploit vulnerabilities in the system to gain unauthorized access, escalate privileges, or compromise sensitive data.

C. Perform a penetration test. Penetration testing, also known as pen testing, involves simulating real-world attacks on systems, networks, and applications to identify vulnerabilities that could be exploited by malicious actors. By conducting penetration tests, organizations can assess the effectiveness of their control measures in mitigating potential risks and identify any residual vulnerabilities that may exist despite the implementation of controls.