Information Security Audit: Foundations and Controls

This test covers the foundational vocabulary and concepts that underpin every information-security audit. You will work through the CIA triad and what each property means in practice, the three categories of controls (preventive, detective, corrective), and the essential elements of risk management including threats, vulnerabilities, and residual risk. The test also addresses audit types, the stages of a formal audit process, and core governance concepts such as segregation of duties, least privilege, and information-security policy hierarchies. Questions draw on internationally recognised frameworks including ISO/IEC 27001, COBIT, and NIST SP 800-53. No prior audit experience is assumed. A correct answer demonstrates that you can recall definitions accurately, distinguish closely related terms, and recognise which concept applies in a given scenario.