ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

The chief goal of a security control audit is to verify that the safeguards an organization chose-whether technical, administrative, or physical-are still implemented as designed, operating effectively, and meeting the requirements of internal policy, external regulations, and the current threat environment. Audits focus on evidence such as configurations, logs, and personnel practices to confirm continued adequacy and effectiveness. While audits may uncover vulnerabilities, they are not intended to execute exploitation techniques like penetration testing, perform post-incident root-cause analysis, or automatically direct the design of new controls without first establishing whether existing measures remain suitable.