10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The FITSP-Auditor exam has 150 questions and runs 3 hours.
These 10 free FITSP-Auditor questions are organized by exam domain, so you can see how each part of the FITSP-Auditor blueprint is tested. Reveal the answer and explanation under each question.
A proposed privileged-login method combines a PIN with a phishing-resistant passkey, but synchronizes the private key across devices. Under NIST SP 800-63B-4, which change removes this method's specific barrier to AAL3?
Correct answer: A - Use a hardware-protected authenticator with a non-exportable private key.
A recovery exercise produces the following record for a benefits-processing service: Approved RTO: 2 hours. Approved RPO: 45 minutes. Outage begins: 14:00. Service fully restored: 15:35. Only usable backup: completed at 13:45, containing transactions through 12:50. No later transactions can be recovered. The owner reports that both objectives were achieved. What should the auditor record?
Correct answer: D - The time objective was met, but the point objective was missed: the recoverable data were 70 minutes old.
A federal emergency-notification system holds two information types with approved FIPS 199 impacts: Evacuation instructions: confidentiality not applicable; integrity High; availability High. Staff contact records: confidentiality Moderate; integrity Low; availability Low. Aggregation and system-level information do not raise these impacts. Which system category and initial security-control baseline follow?
Correct answer: D - Confidentiality Moderate, integrity High, availability High; High baseline
An appliance's deployed cryptographic module, version and operating environment match an active FIPS 140-3 certificate. Its security policy requires approved-mode initialization, but the configuration shows that step was omitted. The vendor responds to the auditor with an AES algorithm-validation certificate. Which statement accurately describes the deployment?
Correct answer: C - The module is validated, but its deployment violates the approved-mode conditions.
At a federal grant agency, a supervisor may enter award amendments and approve amendments entered by other staff. Agency policy requires a different person to approve each amendment. The application rejects unassigned users and records individual actions, yet a controlled test lets the supervisor approve an amendment they entered. The failed safeguard is:
Correct answer: C - Separation of duties for individual amendment approvals.
Three database administrators use named, MFA-protected accounts through a bastion host. The legacy database accepts a shared maintenance account. After a disputed table deletion, its log identifies only that account. Bastion logs contain session start and end times, and the deletion falls within two overlapping sessions; no command-to-session link is recorded. Which change would make future commands individually attributable?
Correct answer: A - Record the authenticated bastion session with each future database command.
A draft Privacy Act finding alleges improper disclosure because claimant consent was not obtained and no published routine use covers the access. The evidence shows that a benefits supervisor retrieved records by claimants' names solely to resolve her assigned cases. She works for the agency maintaining the records, and her documented duties require this access. What is the strongest disposition of the finding?
Correct answer: A - Withdraw it; verified access needed for this employee's duties is permitted.
"Tell us which access exceptions to accept; we'll sign your selections," a program manager asks during GAGAS audit planning. The same audit team will later assess those decisions. Which response preserves useful advice without taking over management's role?
Correct answer: B - Explain the criteria and let management decide which exceptions to accept.
An application's approved control allocation assigns event generation and forwarding to its application team, and retention of at least 12 months to a shared logging service. The local buffer holds seven days. End-to-end tests confirm that required events reach the service. Its current assessment confirms that this application's retention requirement is satisfied; the auditor also retrieves its records from 13 months ago. Does the short local buffer establish a retention deficiency?
Correct answer: B - No; the documented shared service provides the required retention.
A smart contract releases an agency's equipment payments when a warehouse feed reports delivery. Investigators find that a faulty import in the feed labels purchase orders as completed deliveries. The contract executes its approved rule correctly, and the ledger's signatures, hash links and consensus checks all pass. Where did the decisive control failure occur?
Correct answer: B - Validation of external receipt data supplied to the contract.
The full bank has 1,020 more FITSP-Auditor questions with explanations.
Continue in the free practice test →
View plans