CISSP Practice Question (Domain 6: Security Assessment and Testing)

A financial institution uses continuous control monitoring to support regulatory examinations. During a supervisory review, regulators challenge whether reported control effectiveness constitutes “reasonable assurance,” given that testing criteria, thresholds, and exception handling are defined by the same team operating the controls. Leadership wants defensible assurance without dismantling automation.

What is the MOST appropriate action to take NEXT?

A. Rotate control owners periodically to reduce familiarity bias

B. Establish independent assurance criteria and validation over monitoring logic

C. Increase sampling depth and testing frequency across automated controls

D. Supplement dashboards with annual external audit attestations

Come back for the answer tomorrow, or study more now!

13 comments