CISA Question 305

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B2

  A significant increase in cybersecurity audit findings indicates that there may be gaps or weaknesses in the existing cybersecurity policy. Audit findings reflect deficiencies or areas where the policy, controls, or practices are not effectively addressing security risks, making it a strong indicator that the policy needs to be revised to improve its effectiveness.

• Chose B1

  Direct Indicator of Policy Gaps: A significant increase in audit findings directly indicates that there are weaknesses or deficiencies in the current cybersecurity controls, which are often tied to the policy itself. It suggests that the policy may not be adequately addressing security requirements or is not being implemented effectively. Focus on Effectiveness: Audit findings assess the effectiveness of controls and policies, making this the most direct indicator that the policy may need revision to address identified issues and improve overall security posture.

• 2

  D is right