Study guide
Internal and External Audits and Evidence
CompTIA Security+ SY0-701
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook
2 Domain 1: General Security Concepts (12%)
CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact
3 Domain 1: Identity, Trust, and Cryptography Basics
AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules
4 Domain 2: Threat Actors, Vectors, and Social Engineering
Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios
5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks
Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping
6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities
Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions
7 Domain 3: Security Architecture - Secure Architecture Models
Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios
8 Domain 3: Security Architecture - Network Security Architecture
Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design
9 Domain 3 Part C: Data Protection and Resilience
Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience
10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT
Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security
11 IAM Operations and Access Control
Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring
12 Logging, Monitoring, and Detection
Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling
13 Incident Response
IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics
14 Digital Forensics and Investigation
Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps
15 Vulnerability, Patch, Asset, and Automation Operations
Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling
16 Governance, Policies, and Risk Management
Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting
17 Third-Party Risk, Compliance, and Privacy
Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences
18 Audits, Penetration Testing, and Awareness
Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls
19 Final Review and PBQ Labs
PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation
Internal and External Audits and Evidence
Key Takeaways Explain This Topic AI
Internal audits are performed by or for the organization to find control gaps before external scrutiny; external audits are independent and support regulatory, customer, or contractual assurance.
Audit evidence must be relevant, reliable, complete, sufficient, and tied to a specific control objective and audit period.
Auditors sample artifacts — tickets, logs, configurations, approvals, exception records — and expand the sample or issue a finding when samples fail.
A complete finding states condition, criteria, cause, effect/risk, and recommendation, followed by a management response with owner and target date.
Attestation reports such as SOC 2 (AICPA) and ISO/IEC 27001 certification are common external assurance outputs that Security+ expects you to recognize.
Last updated: June 2026
What an Audit Actually Tests
An audit is a structured, evidence-based evaluation of whether a control exists, is designed correctly, and operates as intended over a defined period. The requirement being tested comes from a law, regulation, contract, framework, internal policy, or management directive. On SY0-701 the most-tested distinction is audit versus penetration test: an audit asks "can you prove the required control operates?" while a pen test asks "can this control be exploited?" Do not conflate them.
Auditors distinguish design effectiveness (the control, if it ran, would meet the objective) from operating effectiveness (the control actually ran every time during the period). A firewall-review policy that nobody followed passes design but fails operating effectiveness. This is why auditors collect evidence spanning the whole period rather than a single snapshot: a control that worked only in the week before the audit demonstrates neither consistency nor reliability, and a skilled auditor will detect the gap by sampling across the full window.
Attestation outputs you should recognize on the exam include the SOC 1 report (financial-reporting controls), the SOC 2 report (security, availability, processing integrity, confidentiality, and privacy trust criteria from the AICPA), and ISO/IEC 27001 certification. A SOC 2 Type I evaluates control design at a point in time, while Type II evaluates operating effectiveness over a period (often six to twelve months) — Type II carries far more weight with customers because it proves the control ran repeatedly.
Regulatory examinations such as PCI DSS assessments or HIPAA audits follow the same evidence logic but map to a named obligation.
Internal vs External Audits
Audit type Performed by Primary purpose Example
Internal audit (first-party) Internal audit team or contractor reporting to management/board Find gaps before external review; drive improvement Review privileged-access recertification before renewal
External audit (second-party) A customer or partner auditing you Validate contractual security obligations Enterprise customer audits your access reviews
External audit (third-party) Independent licensed firm Provide assurance to regulators/customers SOC 2 Type II or ISO/IEC 27001 certification audit
Compliance audit Internal or external Test against named obligations Confirm PCI DSS or HIPAA control requirements
Operational audit Internal or external Improve process and control efficiency Investigate late deprovisioning tickets
Independence is the dividing line. An administrator may supply evidence, but cannot be the sole judge of whether their own control is effective in an independent engagement — that is a self-assessment, not third-party assurance. Internal audit functions preserve independence by reporting administratively to management but functionally to the board or audit committee, so they can raise findings without retaliation.
When a customer audits you directly it is a second-party engagement; when a licensed independent firm issues an opinion for many stakeholders it is a third-party engagement, which is what regulators and large customers normally demand.
Evidence Quality and Sampling
Good evidence is relevant (maps to the objective), reliable (system-generated beats verbal claims), complete (covers the population), sufficient (enough samples to conclude), and timely (within the audit period).
Control objective Strong evidence Weak evidence
New access is approved before granting Request ticket with approver, role, timestamp, fulfillment log Screenshot of the login page
Firewalls reviewed quarterly Review minutes, rule export, decisions, change tickets "The firewall is important"
- Backups are tested Restore test results, date, scope, failures, signoff A backup-product brochure
- Logs retained per policy SIEM retention config + sample event search A policy with no system proof
- Exceptions managed Exception register with owner, expiry, approval An informal chat message
Auditors rarely test 100% of a population. For a Jan–Mar period they may sample 25 of the users created and request matching approvals. If a sample fails, they may expand the sample or issue a finding. A self-assessment is also called a first-party attestation ; a third-party report (SOC 2) carries far more weight with customers. Sample sizes are not arbitrary — they scale with population size and the auditor's required confidence level, and a control that runs daily is sampled differently from one that runs quarterly.
Reliability also ranks evidence: a tamper-resistant, system-generated log outranks a manually maintained spreadsheet, which outranks a verbal assertion. When an auditor cannot obtain sufficient appropriate evidence, the result is a scope limitation , which can itself become a finding even when the underlying control may be fine.
Audit Finding Scenario
An external auditor tests 25 terminated employees. Four accounts were disabled late and two retained active VPN tokens after the directory account was disabled. Policy requires removal within 24 hours. A complete finding reads:
Condition: Six sampled leavers had incomplete or late deprovisioning.
Criteria: Policy requires access removal within 24 hours.
Cause: VPN token revocation was outside the automated leaver workflow.
Effect/Risk: Former personnel could retain remote access.
Recommendation: Add VPN revocation, daily reconciliation, and exception alerting.
Management then issues a response naming an owner and a target remediation date — auditors track this to closure.
Evidence Handling and Common Traps
Evidence often contains secrets, credentials, or personal data. Share it through approved channels, minimize it to the audit need, and redact passwords or unrelated customer data without destroying reliability.
Providing policy when the auditor asked for operating evidence .
Producing evidence outside the audit period.
Editing screenshots so they lose reliability.
Forgetting exceptions and failed samples.
Treating an internal self-assessment as independent external assurance.