True or False? The Payment Card Industry Data Security Standard $($PCI DSS$)$ is an industry$-$created standard that applies to organizations that process payment cards.

True

False

Question $14$

An auditor can use several methods to conduct an assessment of IT security controls. Which of the following is not a typical assessment method?

Examination

Interview

Install

Test

Question $15$

True or False? A risk assessment can be qualitative or quantitative.

True

False

Question $16$

What does an audit report rating of "ineffective" indicate?

The control environment is totally compliant with all policies and industry norms.

The control environment is substantially compliant with policies and industry norms.

The control environment is partially compliant with policies and has pockets of noncompliance that need to be remediated.

The control environment is substantially noncompliant with policies and industry norms and requires urgent remediation to become compliant with policies.

Question $17$

True or False? Whereas choosing not to purchase antivirus software is a way to accept a risk, an example of a compensating measure is to not open file attachments.

True

False