Which of the following organizations is typically in charge of validating the implementation and effectiveness of security controls?

Question

Options

• ASecurity Administrators
• BInternal/External Audit
• CRisk Management
• DSecurity Operations

• A
  8% (5)
• B
  77% (50)
• C
  12% (8)
• D
  3% (2)

Explanation

Internal/External Audit (B) is correct because audit functions exist specifically to provide independent, objective validation that security controls are properly implemented and operating effectively - this is the core mandate of auditors, who assess compliance against standards and report findings to leadership.

• Security Administrators (A) implement and manage security controls, but validating their own work would lack independence - they're the ones being audited, not the validators.
• Risk Management (C) identifies and prioritizes risks and recommends controls, but it doesn't perform the hands-on testing to confirm those controls actually work.
• Security Operations (D) monitors and responds to threats in real time; it operates within the security environment rather than independently evaluating it.

Memory tip: Think of auditors like a building inspector - they don't build the house (admins do) or decide what safety codes matter (risk management does), but they show up after the work is done to verify everything was done correctly and works as intended.

No community discussion yet for this question.