What evidence is typically used to support control testing in the SAR?

• A. Test results, configuration snapshots, vulnerability scan outputs, interviews, and artifacts
• B. Interviews alone
• C. Vulnerability scan outputs alone
• D. Configuration snapshots alone

Answer: (A)

Control testing in the Security Assessment Report relies on a mix of evidence to show that a control is both properly implemented and actually functioning in practice. Test results provide objective proof of how the control performs under defined test conditions. Configuration snapshots capture the current state of system settings, allowing you to verify that configurations align with policy baselines. Vulnerability scan outputs highlight known weaknesses and the remediation status, illustrating how the control stands up to common threats. Interviews offer a view into how the control is applied in day-to-day operations and whether procedures are followed. Artifacts such as policies, procedures, logs, change records, and other documentation add traceability and corroborate what the technical data shows.

Relying on just one type of evidence leaves gaps: interviews alone don’t prove technical effectiveness, vulnerability scans alone don’t confirm precise configurations or procedural adherence, and configuration snapshots alone don’t demonstrate actual testing or operational use. Using all these evidence types together gives a complete, convincing picture of control effectiveness in the SAR.