Questão 40 — CompTIA SY0-701 CompTIA Security+ Certification Exam

Explanation: Correct answer: B. Gap analysis An internal auditbest assesses the compliance level of in-place IT processes and assets against a certification the company is pursuing. An internal audit: - Reviews existing processes, controls, and assets against specific compliance framework requirements - Identifies gaps between current state and certification requirements - Can be conducted by internal audit teams or consultants - Provides a detailed assessment of compliance status and recommendations for remediation - Helps the organization understand what needs to be fixed before pursuing formal certification This differs from an external audit (conducted by a third party for formal certification) or a vulnerability scan (which focuses on technical vulnerabilities rather than compliance framework requirements).