Information Security Audit: Risk Assessment, Cloud and Compliance

This test evaluates advanced competency in information security auditing across the full risk-management lifecycle. Topics span quantitative risk metrics including Single Loss Expectancy, Annualized Rate of Occurrence, and Annualized Loss Expectancy; qualitative risk frameworks and their limitations; security maturity models such as CMMI and the SSE-CMM; continuous auditing and monitoring architectures; cloud-specific audit challenges including shared-responsibility boundaries and multi-tenancy risks; third-party and supply-chain risk assessment methodologies; audit report structure, findings classification, and remediation tracking; and compliance obligations across multiple regulatory jurisdictions including GDPR, HIPAA, SOX, and PCI-DSS. Questions are framed at the analysis level, requiring candidates to distinguish between closely related standards, apply principles to scenario-based fact patterns, and evaluate the appropriateness of specific controls or audit approaches in complex operational contexts.