Which statement best describes the objective of a cybersecurity audit?

### Why this is right An audit examines controls, processes, and evidence to judge whether they meet stated requirements and objectives. Its findings can identify weaknesses and support corrective decisions, but an audit cannot guarantee that incidents will never occur. ### The concept A cybersecurity audit is a structured review of how an organization manages security and whether its controls work as expected. The audit needs objectives and a defined scope so that evidence can be evaluated against relevant requirements. A cybersecurity assessment is related, but it more broadly evaluates assets, threats, vulnerabilities, risks, and controls. Neither activity automatically fixes identified gaps. ### The other options - **B. To guarantee that the organization will never experience a cyber incident**: an audit evaluates evidence and controls; it cannot guarantee future outcomes. - **C. To replace all security assessments with a one-time technical scan**: an audit is not necessarily a scan, and it does not replace broader risk assessment. - **D. To select a particular security product for every department**: product selection is not the audit’s stated objective. ### Terms - **Control**: A safeguard or process used to address a security risk or meet a requirement. - **Scope**: The boundaries that specify which organizational areas, systems, or processes an audit examines. ### Remember An audit evaluates evidence against defined expectations; it does not promise perfect security.