ISC2 CISSP Practice Question

The correct answer is to use automated scanning tools with validated benchmarks against specific regulatory requirements. This approach combines automation (which provides consistency, repeatability, and scale) with validated benchmarks (ensuring accuracy) specifically tailored to the regulatory requirements the organization must meet (focused relevance).

Manual inspection by security analysts, while valuable for certain aspects of compliance assessment, lacks consistency and scalability across a global organization.

Relying on self-attestation forms from department managers introduces bias and lacks verification, making it unreliable for regulatory compliance purposes.

Performing random spot checks based on previous audit findings is too limited in scope and reactive rather than comprehensive, as it focuses only on previously identified issues rather than ensuring full compliance with current requirements.