Which of the following best describes the process of evaluating the effectiveness of security controls through interviewing, examination, and testing?
A. Risk assessment
B. Vulnerability assessment
C. Risk evaluation
D. Security assessment
Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.
My suggested answer is D. Security assessment.
An assessment is performed to evaluate the fulfillment of specified requirements; an audit is a formal assessment conducted by independent parties or auditors. Security assessment generally refers to the evaluation applied to the information system, its components and environment, and the security controls that enforce security, through testing, examination, and interviewing.
In the context of information security, security assessments and audits are common practices.
References
D: Security assessment