The Chief Information Security Officer (CISO) at a large company would like to gain an understanding of how the company's security policies compare to the requirements imposed by external…

The correct answer is D. External examination. An external examination (also known as an external audit or external review) is the best method for the Chief Information Security Officer (CISO) to gain an understanding of how the company's security policies compare to external regulatory requirements. External examinations…

Submitted by marco_it· Mar 6, 2026Security program management and oversight

Question

The Chief Information Security Officer (CISO) at a large company would like to gain an understanding of how the company's security policies compare to the requirements imposed by external regulators. Which of the following should the CISO use?

Options

APenetration test
BInternal audit
CAttestation
DExternal examination

How the community answered

(49 responses)

A
4% (2)
B
14% (7)
C
4% (2)
D
78% (38)

Explanation

An external examination (also known as an external audit or external review) is the best method for the Chief Information Security Officer (CISO) to gain an understanding of how the company's security policies compare to external regulatory requirements. External examinations are conducted by third- party entities that assess an organization's compliance with laws, regulations, and industry standards. Penetration tests focus on identifying vulnerabilities, not compliance. Internal audits assess internal controls but are not impartial or focused on regulatory Attestation is a formal declaration but does not involve the actual evaluation of compliance.

Community Discussion

No community discussion yet for this question.

Full SY0-701 Practice