Exam: Chapters 118–121 · Security+ SY0-701

Chapters 118–121 Practice Exam

📝 20 scored questions ⏱️ 25-minute target 🎯 Pass threshold: 80% (16/20)

Time remaining

25:00

Part A — Multiple Choice (Questions 1–20)

Ch 118 · Audits & Assessments

Question 1 of 20

Which governance body is responsible for authorizing all internal audits, defining their scope, reviewing all findings upon completion, and ensuring corrective actions are tracked and implemented? A critical exam fact: all internal audits begin AND end with this body's involvement.

A. Chief Information Security Officer (CISO) — has operational security authority across all functions B. Compliance department — manages day-to-day regulatory requirements and controls C. Security Operations Center — monitors security events and manages incident response D. Audit committee — governance oversight body that authorizes, scopes, and reviews all internal audits

✅ D — Audit committee. The audit committee is the governance body that owns both ends of the internal audit lifecycle: it authorizes audits at the start and reviews findings at the end. This is a critical exam fact — the CISO has operational security responsibility but does not govern the audit function. The compliance department manages day-to-day regulatory tasks but is not the governance body that starts and stops audits.

Ch 118 · Audits & Assessments

Question 2 of 20

A publicly traded company's CEO and CFO must personally sign a formal declaration stating that their financial reporting IT controls are effective and that financial statements accurately represent the company's financial position. Which regulation mandates this, and what is the specific term for this formal personal declaration?

A. PCI DSS — Qualified Security Assessor certification issued after annual assessment B. HIPAA — Business Associate Agreement requiring covered entity attestation of PHI protection C. SOX Section 302 — executive attestation; personally signing false certifications carries up to 20 years imprisonment D. FedRAMP — cloud service provider authorization attestation required before government deployment

✅ C — SOX Section 302. The Sarbanes-Oxley Act Section 302 requires CEOs and CFOs of publicly traded companies to personally attest to the accuracy of financial statements and the effectiveness of internal controls over financial reporting. Attestation is the formal professional opinion regarding the accuracy of the organization's posture — it creates personal criminal liability. Willful false certification carries up to 20 years imprisonment. This is the exam's canonical example of attestation combined with personal accountability.

Ch 118 · Audits & Assessments

Question 3 of 20

A company distributes compliance checklists to all departments; each department evaluates its own security controls and submits results to the compliance team. What is the PRIMARY limitation of this approach, and how must organizations address it for regulatory purposes?

A. Self-assessments are more thorough than external audits because employees understand their own systems better than outside auditors could B. Self-assessments lack independence — departments grade their own work, which tends toward optimistic results; external audits from independent parties with no financial stake in the outcome are required for regulatory credibility C. Self-assessments cannot be used as input for formal audit programs because they are not performed by licensed auditors or certified assessors D. Self-assessments are too resource-intensive for most organizations because they require dedicated assessment tools and trained compliance personnel in every department

✅ B — Lack of independence. The fundamental limitation of self-assessments is that the evaluating department grades its own work. This creates a conflict of interest that tends toward optimistic results — departments have incentives to present themselves favorably. External audits are credible precisely because the auditor has no financial stake in the outcome: their professional reputation depends on accurate findings, not favorable ones. Self-assessments are valuable for scaling compliance awareness but cannot substitute for external audit credibility.

Ch 118 · Audits & Assessments

Question 4 of 20

A healthcare organization has an exceptional internal audit team that conducts monthly security reviews. When HIPAA's Office for Civil Rights requires an external audit of PHI protections, management argues that their strong internal audit documentation should substitute for the external audit. Which statement correctly evaluates this argument?

A. The argument fails. HIPAA's external audit authority cannot be satisfied by internal audit documentation — internal staff have an inherent conflict of interest that violates the independence requirement, regardless of how thorough their work is B. The argument succeeds if the internal audit documentation is comprehensive and uses HIPAA-approved assessment frameworks and standardized checklists C. The argument partially succeeds; internal audits can satisfy the examination phase, and external auditors only need to review the documentation rather than performing direct evidence gathering D. The argument succeeds if the internal audit team reports directly to the board rather than to operations, which provides sufficient organizational independence

✅ A — The argument fails. External audits are mandated by regulation specifically because independence cannot be achieved by internal staff, regardless of organizational reporting structure. The type, frequency, and scope of external audits is determined by the applicable regulation — organizations cannot opt out by pointing to internal audit quality. HIPAA, SOX, PCI DSS, CMMC, and FedRAMP all require external assessment; strong internal audits complement but never replace them.

Ch 118 · Audits & Assessments

Question 5 of 20

After completing a three-week examination of a financial institution's IT security controls — reviewing access logs, inspecting server configurations, and interviewing security personnel — an independent CPA firm issues a signed written statement: "Based on our examination, it is our professional opinion that this institution's security posture accurately reflects its stated compliance status." What is the specific term for this signed statement?

A. Audit charter — the document authorizing the scope and objectives of the audit engagement B. Examination report — the document produced at the end of the hands-on evidence-gathering phase C. Compliance certification — the formal certificate issued when an organization passes an external audit D. Attestation — the formal professional opinion of the truth or accuracy of an organization's security posture, issued after independent examination; creates personal accountability for the signatory

✅ D — Attestation. Attestation is the formal professional opinion regarding the accuracy or reliability of an organization's security posture. The audit gathers evidence (the examination phase); attestation is the conclusion — the auditor formally affirming what they found and taking personal accountability for that statement. Key distinction: audit = evidence-gathering process; attestation = the formal conclusion signed at the end. False attestation creates legal liability for the signatory.

Ch 119 · Penetration Tests

Question 6 of 20

During a penetration test, a tester uses Netcat to establish a TCP connection to port 22 on a target server. The server immediately responds with "SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.3." The tester records the SSH version for CVE research. Why is this classified as active rather than passive reconnaissance?

A. Passive; reading a service banner only receives data the server willingly sends and does not modify any system state B. Active; the tester directly established a TCP connection to the target system, generating an entry in the server's access logs — any direct network interaction with the target's systems constitutes active reconnaissance C. Passive; banner grabbing is an OSINT technique because service banners are publicly available to anyone who connects D. Active; the tester will use the banner information to search CVE databases, and any activity that informs a future attack is classified as active

✅ B — Active reconnaissance. The defining criterion: active reconnaissance sends network traffic to the target's systems, generating entries in logs (firewall logs, server access logs, IDS alerts). Establishing a TCP connection to port 22 sends packets to the target server and creates a log entry. This is the classic active technique called banner grabbing or service identification. Passive reconnaissance uses only publicly available sources without sending any traffic to the target network at all.

Ch 119 · Penetration Tests

Question 7 of 20

A company hires a pen testing firm and provides them with a standard employee-level username and password for the HR system before testing begins. No network diagrams, IP inventories, or architecture documentation are provided. The testers must discover the network topology themselves but begin with authenticated access to one application. What type of test environment is this?

A. Known environment (white box); receiving credentials provides complete knowledge of what the account can access, which constitutes full information disclosure B. Unknown environment (black box); no technical documentation was provided, so the testers are effectively blind to the target environment C. Partially known environment (gray box); the testers have limited specific information (credentials) but must discover the broader technical environment — simulating a compromised employee account or trusted business partner D. Integrated environment; providing credentials indicates a red/blue team collaboration model rather than a standard assessment

✅ C — Partially known environment (gray box). Gray box provides testers with some but not complete information. User credentials without infrastructure documentation is a classic gray box scenario: it simulates a compromised insider account, a disgruntled employee, or a trusted business partner who has limited legitimate access. The tester starts with one foothold (the credentials) but must discover the rest of the environment independently. This tests whether limited initial access can be escalated to broader compromise.

Ch 119 · Penetration Tests

Question 8 of 20

A server room contains a database server with full-disk encryption, MFA-protected login, and a dedicated firewall blocking all unauthorized external network connections. A red team member bypasses the server room's physical lock and gains direct access to the hardware. Why does physical access make the server's software and network security controls largely irrelevant?

A. Physical access allows modifying the boot process, booting from external USB media that loads an OS ignoring the installed authentication and encryption software, or directly replacing OS authentication files — circumventing all logical controls without triggering any network-based defenses B. The firewall and encryption are still effective against physical access; physical access only matters if the attacker also knows the administrator password C. Physical access is only relevant for unencrypted systems; full-disk encryption prevents data access regardless of physical presence D. Physical access matters only for data exfiltration via removable media; the firewall still prevents network-based attack escalation even after physical access

✅ A — Physical access bypasses all software and network controls. An attacker with physical access to a server can: modify BIOS/UEFI boot order to boot from USB, boot a live Linux environment that mounts the drive without OS-level authentication, install a pre-boot keylogger to capture the full-disk encryption passphrase, or physically replace hardware. Even full-disk encryption can be defeated if the attacker can capture the passphrase before decryption. This is why servers live in locked, access-controlled data centers — physical access is the most fundamental security boundary.

Ch 119 · Penetration Tests

Question 9 of 20

Before an authorized penetration test, a researcher spends a week gathering intelligence: reviewing the target company's engineering blog posts and press releases, reading employee LinkedIn profiles, finding technology stack details in public job postings, examining Shodan results for the organization's IP ranges, and reviewing GitHub commits from company email addresses. No packets are sent to the target organization's systems. This entire activity is classified as:

A. Passive reconnaissance; no traffic was sent to the target's systems — all sources were publicly accessible, making this undetectable by the target's network monitoring B. Active reconnaissance; using third-party databases like Shodan constitutes indirect interaction with systems containing the target's data C. Social engineering reconnaissance; leveraging publicly available information about specific individuals is inherently a social engineering technique D. Gray box reconnaissance; combining OSINT and technical tools like Shodan provides partial knowledge, placing this between passive and active

✅ A — Passive reconnaissance. The defining test: did any traffic reach the target organization's network? No — LinkedIn, blogs, job postings, Shodan, and GitHub are all third-party public sources. The target's firewall never sees these queries. Passive reconnaissance is nearly undetectable because the target's monitoring tools have no visibility into what a researcher reads on public websites. This is why organizations struggle to defend against it: the information is already publicly available.

Ch 119 · Penetration Tests

Question 10 of 20

During a penetration engagement, the passive reconnaissance phase takes 3 days and produces zero entries in the target's network logs. The subsequent active reconnaissance phase takes 1 day and produces 847 entries across the target's firewall logs and IDS alerts. Which statement most accurately compares the value and nature of these two phases?

A. The passive phase was less valuable because it produced no log entries; the effectiveness of reconnaissance should be measured by the volume of data generated B. Both phases have equal value; passive reconnaissance verifies that the team is looking at the correct target before active work begins C. The active phase should have been conducted first to discover live hosts, which would then direct more focused passive research D. Passive reconnaissance gathered organizational and human intelligence from public sources without any detectable footprint; active reconnaissance produced precise technical data (open ports, OS versions, service versions) that enables targeted exploitation but is detectable in the target's logs

✅ D — Each phase produces different intelligence with different detectability tradeoffs. Passive reconnaissance (human/organizational intelligence: employee roles, technology stack hints, OSINT) leaves no trace in target logs — it is essentially undetectable. Active reconnaissance (technical intelligence: which hosts are live, which ports are open, which services and versions run) is precise and directly enables CVE matching, but every probe appears in the target's logs. Professional engagements use passive first to minimize exposure, then active to get the technical precision needed for exploitation.

Ch 120 · Security Awareness

Question 11 of 20

An automated security monitoring system generates an alert at 2:17 AM: an employee account has replaced the Windows hosts file on their workstation with a version that redirects the corporate authentication server's domain name to an external IP address. Which anomalous behavior category applies, and why?

A. Unexpected behavior; the 2 AM timing deviates significantly from the employee's normal work schedule and access patterns B. Unintentional behavior; hosts file modifications are common accidental changes made during network troubleshooting C. Risky behavior; modifying the hosts file to redirect the authentication server is an inherently dangerous action — it can intercept credentials regardless of whether the change was intentional or malware-driven D. Normal behavior; hosts file modifications are a standard Windows network troubleshooting technique used regularly by IT staff

✅ C — Risky behavior. The three categories require different analytical lenses. Risky behavior: the action itself is inherently dangerous regardless of intent (modifying the hosts file, replacing OS files, exfiltrating data). Unexpected behavior: normal action in wrong context (foreign login). Unintentional: accident (typo, misplaced device). Replacing the hosts file to redirect an authentication server is inherently dangerous — it creates a credential interception opportunity. The 2 AM timing is suspicious context, but the classification key is the action type: dangerous action = risky behavior.

Ch 120 · Security Awareness

Question 12 of 20

A CISO presents to the board: six months ago, 29% of employees clicked simulated phishing links. After targeted training for those who clicked, the rate dropped to 5%. The board questions whether to continue quarterly simulation campaigns or replace them with training videos only. What is the strongest argument for continuing the simulation campaigns?

A. Stopping the campaigns would violate PCI DSS requirements for ongoing phishing testing programs for any organization processing card payments B. The click rate is the only metric that measures actual employee behavior under simulated phishing conditions; continued campaigns detect whether improvement persists and identify new susceptibility as the workforce changes — training videos teach concepts but cannot measure behavior C. Employees expect phishing simulations and will become overly suspicious of real phishing emails, reducing productivity through excessive verification behaviors D. Quarterly simulations satisfy SOC 2 Type II requirements for continuous user behavior monitoring under security awareness control categories

✅ B — Simulations measure behavior; videos teach concepts. The phishing click rate is the primary metric from simulated campaigns because it measures what employees actually do under simulated attack conditions — not what they say they would do, or what they learned in a video. Continued quarterly campaigns serve two purposes: (1) verify that the 5% improvement is sustained over time and (2) identify new susceptibility as new employees join, roles change, and attack techniques evolve. Without ongoing measurement, behavioral regression goes undetected.

Ch 120 · Security Awareness

Question 13 of 20

At 11:45 PM on a Sunday, a software engineer's account accesses a financial processing code repository the engineer has never worked on and downloads the complete source code (2.1 GB). The engineer normally accesses only the front-end UI repository and works Monday through Friday, 9 AM to 5 PM. Which anomalous behavior category applies?

A. Risky behavior; downloading large volumes of sensitive source code creates a significant intellectual property exfiltration risk B. Unintentional behavior; the engineer may have accidentally triggered a mass download while searching for a specific file in an unfamiliar repository C. Unexpected behavior; the timing (Sunday 11:45 PM), the accessed repository (never previously accessed), and the download volume all deviate from the account's established normal baseline on multiple dimensions simultaneously D. Normal behavior; software engineers frequently review code across all repositories for cross-system integration work

✅ C — Unexpected behavior. Unexpected behavior is characterized by deviations from established normal patterns — the action itself (accessing a repository) is normal, but the context is entirely wrong on multiple dimensions: wrong time (11:45 PM Sunday vs. weekday business hours), wrong repository (financial processing vs. front-end UI), wrong volume (2.1 GB vs. typical incremental access). Multiple simultaneous deviations from baseline are a strong indicator of credential compromise — an attacker operating from a different time zone with access to the account. This is distinct from risky behavior, which focuses on the action type rather than the pattern deviation.

Ch 120 · Security Awareness

Question 14 of 20

A finance employee intends to wire $50,000 to a vendor but accidentally enters an incorrect IBAN number in the transfer form. The transfer reaches an unrelated account. The source material explicitly uses "typing the wrong domain name" as an example of this same behavior category. What category of anomalous behavior does the accidental IBAN entry represent?

A. Unintentional behavior; the employee made an accidental human error despite good intent — yet the financial and security consequences are entirely real B. Risky behavior; initiating wire transfers without dual authorization controls is an inherently risky action that creates financial exposure C. Unexpected behavior; an incorrect IBAN deviates from the employee's normal accurate transaction history D. Insider threat behavior; significant financial transactions with incorrect destination accounts are indicators of deliberate fraud

✅ A — Unintentional behavior. Unintentional behavior = accidental human errors that create security or financial risk despite good user intent. The source material lists "typing the wrong domain name" as the canonical example; an incorrect IBAN in a wire transfer is the financial equivalent — same pattern, different context. The exam lesson: all three categories (risky, unexpected, unintentional) require security awareness training because even innocent mistakes cause real incidents. Unintentional does not mean harmless.

Ch 120 · Security Awareness

Question 15 of 20

A retail chain's security manager proposes implementing security awareness training only for IT staff and store managers: "Cashiers just ring up purchases — they don't interact with security-relevant systems and don't need security training." Which response best evaluates this proposal?

A. The proposal is reasonable; cashiers have limited system access and their day-to-day role does not require security awareness training beyond PCI DSS payment handling basics B. The proposal partially succeeds; cashiers should receive only payment security training since their role involves PCI DSS-regulated card processing activities C. The proposal fails only for store managers; other non-technical staff can be covered by an annual compliance acknowledgment form rather than full security awareness training D. The proposal fails; cashiers are primary targets for social engineering attacks (fake refund requests, distraction techniques, payment terminal tampering). Attackers always target the weakest human link — minimum awareness training establishes the security floor for every employee regardless of technical role

✅ D — All employees require minimum awareness training. The minimum awareness level is the security baseline that all employees share, regardless of job function. Attackers specifically target non-technical staff because they are perceived as easier to manipulate. A cashier who enables a social engineer's access to the back office, accepts a skimming device installation, or reveals a colleague's password creates the same breach as a vulnerable server. Role-specific training adds depth on top of this baseline — it does not replace the baseline for any employee.

Ch 121 · User Training

Question 16 of 20

A third-party consulting firm is contracted to perform data analysis on the organization's customer database. The project manager wants to grant the consultant immediate database access to avoid delaying the project start. The consultant has not yet completed any security training. What should happen?

A. The consultant can receive temporary read-only access while completing training; read-only access cannot cause data modification so the training requirement can be deferred B. Pre-access training must be completed and documented before any system access is granted, regardless of whether the user is an employee or a third-party contractor — the project timeline must accommodate this requirement C. The organization's security team can grant expedited access if the consulting firm provides a signed statement that their staff follow equivalent security practices D. Third-party contractors with active professional certifications (CISA, CISSP, etc.) are exempt from pre-access training requirements because certification demonstrates equivalent security knowledge

✅ B — Pre-access training applies to all users, including third parties. The pre-access training requirement is triggered by access level, not employment status. A contractor who will access organizational systems must complete the organization's security training before receiving credentials — the same as any employee. Read-only access still exposes sensitive data and still requires the user to understand reporting obligations and data handling policies. Professional certifications demonstrate general knowledge but not the organization's specific policies and procedures.

Ch 121 · User Training

Question 17 of 20

A USB drive labeled "IT Department — Annual Review Backup" is left on a break room table. An employee connects it to their laptop to check the contents. Within two seconds, a PowerShell window flashes briefly on screen and closes. What most likely happened and what should the employee have done?

A. A legitimate IT backup drive triggers automated scripts when inserted; the employee should check the contents and report the unusual behavior to IT for investigation B. This was a BadUSB attack; the drive's firmware was reprogrammed to present as a keyboard (HID device) and inject PowerShell commands automatically. The OS trusts keyboard input implicitly, so commands execute without user approval. The employee should never have connected an unknown USB device regardless of any label — the correct action was to report it to IT security without plugging it in C. The PowerShell window was triggered by Windows Autorun, which is standard behavior for USB drives; this is expected and does not indicate a security incident D. The sticky note label indicates this is an authorized IT device; the PowerShell activity was part of the normal backup restoration script that runs on insertion

✅ B — BadUSB attack. BadUSB reprograms a USB device's firmware to masquerade as a different device type — classically, a keyboard. When connected, the OS trusts it as input hardware (keyboards don't need driver approval) and the device begins typing commands at millisecond speed. The brief PowerShell window that closes instantly is the signature: commands executed and the window was dismissed by the script itself. No visual inspection can detect BadUSB because the malicious logic lives in firmware, not in visible files. The unconditional training rule: never connect unknown USB devices regardless of labeling.

Ch 121 · User Training

Question 18 of 20

A network engineer posts on a public developer forum seeking help with a VLAN routing issue. The post includes the firewall model (Cisco Catalyst 9300), PAN-OS version (17.9.4a), the specific error message, and a screenshot showing interface names and IP addressing. No credentials or personal data were included. Which security concern does this behavior represent?

A. Confidentiality; the organization's internal network configuration is confidential information that should not be shared publicly B. Data classification violation; network configurations are typically classified as "internal" or "confidential" under standard classification schemes, making this a policy breach C. Compliance violation; posting network device configurations on public websites may violate PCI DSS cardholder data environment protection requirements D. OPSEC failure; the post reveals the specific OS version (enabling CVE research for applicable vulnerabilities), the VLAN structure (network segmentation intelligence), and hardware model — actionable passive reconnaissance data the organization inadvertently made public

✅ D — OPSEC (Operational Security) failure. OPSEC is about thinking from the attacker's perspective: what can an adversary learn from this post? Answer: the exact OS version maps to specific CVEs in public vulnerability databases; the VLAN structure reveals network segmentation; the hardware model reveals attack surface. No credentials are needed — this intelligence alone enables targeted exploitation planning. OPSEC training teaches users to anonymize or generalize technical details before posting publicly, even when seeking legitimate help. The correct post would say "a recent IOS-XE version" not a specific build number.

Ch 121 · User Training

Question 19 of 20

A remote employee connects to the company's CRM system from a coffee shop using public Wi-Fi without using VPN, reasoning: "CRM uses HTTPS, so my data is encrypted end-to-end — VPN is redundant for web applications." From a user training and security policy perspective, is this acceptable?

A. Yes; HTTPS provides end-to-end content encryption, making VPN redundant for web-based applications over trusted protocols B. Acceptable with low risk; public Wi-Fi attacks are uncommon for casual business users and HTTPS protects the most sensitive content C. No; VPN is required for all corporate system access regardless of the application's own encryption. VPN routes traffic through organizational security controls, prevents exposure of session tokens and authentication cookies on untrusted networks, and ensures consistent policy enforcement — HTTPS protects content but not session metadata or authentication state on the local segment D. Acceptable for read-only access; VPN is required only when the employee is writing to corporate systems or accessing highly classified information

✅ C — VPN is required for all corporate system access. HTTPS encrypts the payload in transit but does not protect against session hijacking on the local network segment. On public Wi-Fi, an attacker performing a man-in-the-middle attack can capture session tokens and authentication cookies even when HTTPS is in use, depending on implementation. Beyond the technical risk, VPN routes all traffic through organizational security controls (DLP, web filtering, threat detection) that provide protection beyond what HTTPS alone offers. The policy is unconditional: all corporate system access from outside the office requires VPN, regardless of the perceived sensitivity of the specific task.

Ch 121 · User Training

Question 20 of 20

A user receives a phone call: "Hi, this is David from HR. I'm processing W-2 corrections and I need to verify your Social Security Number to ensure your tax documents reach the right address. I see you're listed at [reads the user's correct home address]." The caller's knowledge of the address appears to legitimize the call. Which social engineering technique is this and what should the user do?

A. Pretexting using social proof and urgency; the caller fabricated a scenario (W-2 corrections) and used partial knowledge (the address) to appear legitimate. The user should refuse the SSN request, terminate the call, and contact HR directly using the known company phone directory — not any callback number the caller provides B. The call is likely legitimate; authentic HR staff would only know the employee's home address through official company records, proving insider access C. Spear phishing; the use of personalized information (name, address) to create a targeted manipulation is the defining characteristic of a spear phishing attack D. Vishing; the employee should hang up immediately without engaging in any conversation, as any response provides additional intelligence to the attacker

✅ A — Pretexting with social proof. Pretexting = fabricating a plausible scenario to justify an unusual request. Here the pretext is "W-2 correction." The use of the employee's address as "social proof" is a manipulation technique — addresses are available from data brokers, public records, and prior breaches; an attacker knowing your address does not prove they are from HR. Legitimate HR never asks for SSNs by phone. The defense: refuse, terminate, and independently verify through a known-good contact channel. "Vishing" describes the phone-call delivery mechanism; pretexting is the specific manipulation technique within it.

Part B — Scenario Questions (unscored — self-assess)

Ch 118–119 · Scenario

Scenario Question A

A healthcare organization's CISO tells the audit committee: "We completed a thorough internal self-assessment last month and found no critical issues. I recommend we skip the formal external audit this year to reduce costs — our self-assessment was more comprehensive than any external auditor's review would be." The organization processes PHI for 50,000 patients and is a HIPAA covered entity. Additionally, the organization is considering replacing its annual one-time penetration test with an integrated continuous testing model.

Address: (1) Why is the CISO's recommendation problematic from governance, regulatory, and credibility perspectives? (2) What external audits cannot be waived regardless of self-assessment quality? (3) What are the key differences between a one-time penetration test and integrated continuous testing, and which is more appropriate for this healthcare organization?

1. Problems with skipping the external audit:

Governance: The CISO does not have authority to waive external audit requirements — this decision exceeds the CISO's operational role. The audit committee governs the audit function; regulatory compliance is not a discretionary budget item.

Regulatory: HIPAA requires covered entities to demonstrate PHI protection and the HHS Office for Civil Rights has audit authority. A self-assessment cannot satisfy this because internal staff lack the independence required for credible external verification. The regulation defines what is required; the organization cannot choose to opt out based on internal assessment quality.

Credibility: Self-assessments have inherent conflict of interest — the evaluating department grades its own work. External auditors' credibility comes precisely from their independence: no financial stake in the outcome, professional reputation at risk if findings are inaccurate. Regulators, patients, and business partners cannot rely on an organization's self-reported compliance.

2. Non-waivable external audits for this organization:
• HIPAA: HHS OCR audit authority over covered entities — PHI handling, Security Rule controls, Breach Notification compliance
• Any business associate agreements requiring external assessment
• If the organization accepts payment cards: PCI DSS QSA assessment above transaction thresholds

3. One-time vs. integrated penetration testing:

One-time test: Point-in-time snapshot; produces a list of vulnerabilities at a specific moment; findings may be remediated but retesting is not built in; the organization may be re-exposed between annual engagements as the environment changes.

Integrated (continuous) testing: Ongoing red/blue cycle — red team finds vulnerabilities, blue team remediates, red team retests; self-reinforcing improvement loop; provides ongoing security posture visibility rather than periodic snapshots; converts penetration testing from an annual event into a continuous security operation.

For a healthcare organization: Integrated testing is better suited if resources permit, because the threat environment and system configurations evolve constantly. PHI environments change with new applications, patches, and staff access changes that annual tests miss. The continuous feedback loop ensures that each change is tested rather than waiting for the next annual engagement window.

Ch 120–121 · Scenario

Scenario Question B

A penetration tester's engagement report documents three findings from the physical and social engineering phases: (1) Three USB drives planted in the parking lot were connected to employee workstations within 2 hours of being placed. (2) Two employees provided badge access to a social engineer claiming to be a printer repair technician — no verification was requested. (3) A simulated phishing campaign sent to all 400 employees produced a 41% click rate, with finance employees clicking at 67% and IT staff at 8%.

Address: (1) For each finding, identify the relevant user training coverage area and classify the employee behavior by anomalous behavior category where applicable. (2) What minimum program components should be immediately implemented? (3) What specific metrics should be tracked at 3-month and 6-month intervals to measure program effectiveness?

1. Analysis of each finding:

Finding 1 (USB drives connected):
Training area: Removable media and situational awareness
Behavior category: Unintentional (employees didn't intend to create a security incident — they were curious or helpful) with elements of risky behavior (connecting unknown USB drives is an inherently dangerous action regardless of intent)
Root cause: No training on USB threat awareness; no policy prohibiting unknown device connection

Finding 2 (Badge tailgating):
Training area: Situational awareness (physical security) and social engineering recognition
Behavior category: Unintentional (employees were trying to be helpful) with risky behavior elements (granting physical access without verification is an inherently dangerous action)
Root cause: No training on tailgating procedures; no clear policy on visitor verification; employees not empowered to challenge unfamiliar individuals

Finding 3 (41% phishing click rate):
Training area: Security awareness (phishing recognition) and job-function training (finance-specific BEC training needed)
Behavior category: Unintentional for those who didn't recognize the phishing attempt
Finance 67% vs. IT 8% gap: Finance employees face BEC and wire transfer fraud specifically — their role requires targeted job-function training on top of the baseline

2. Minimum program components to implement immediately:
• Minimum awareness baseline for ALL employees: phishing recognition (domain checking, urgency indicators), USB/removable media policy (never connect unknown devices), physical security (visitor verification, tailgating prevention), how to report incidents
• Job-function training for finance: wire transfer fraud, CEO impersonation (BEC), invoice manipulation — the 67% click rate is an urgent gap
• Phishing simulation program: quarterly campaigns with immediate just-in-time training for those who click; track click rate as primary metric
• Documented pre-access training requirement: all new employees and third parties complete training before access
• Automated behavioral monitoring: flag unusual download volumes, external transfers, off-hours access

3. Metrics at 3 and 6 months:
At 3 months:
• Overall phishing click rate (target: below 20%, down from 41%)
• Finance department click rate specifically (target: below 25%, down from 67%)
• Training completion rate (target: 95%+ all employees)
• USB incident reports (any unknown USB devices found and properly reported vs. connected)

At 6 months:
• Overall click rate (target: below 10%)
• Finance click rate (target: below 15%)
• MFA adoption rate (if not already mandated, track enrollment progress)
• Password manager adoption rate
• Password sharing incidents reported
• Physical security: number of visitor verification failures in follow-up physical tests

← Back to Study Hub

—

Pass threshold: 80% (16 / 20 correct)

← Back to Study Hub

Exam: Security Program Management & Awareness