Discuss HITRUST CCSFP Exam Topic 5 Question 13

A sample of laptops is being selected to ensure AV software has been properly installed/configured. Where should the population be pulled from? [0173]

AThe AV console, as it lists all laptops with AV installed

BThe IT asset inventory, for capital assets only

CThe IT asset inventory, for a list of all laptops

DThe Risk Register, as it lists all firewalls with AV installed

Suggested Answer: C

When testing implementation, the population must include the full set of in-scope assets, not just a subset filtered by existing controls.

AV console (A) only shows devices with AV installed; it would exclude noncompliant assets.

IT asset inventory (C) provides the complete list of laptops, making it the proper source for random sample selection.

Risk register (D) lists risks, not devices.

Capital assets only (B) not comprehensive for all laptops.

Extract Reference (HITRUST Assessment Sampling Guidance, CCSFP [0173]):

Sampling must be based on the complete population from the IT asset inventory; reliance on control-based systems (e.g., AV console) introduces bias.

Get Premium CCSFP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

26 comments · newest first

Oliva 7 days ago

C gives us the full picture. Better safe than sorry!

Francisca 12 days ago

D doesn't make sense. Firewalls and AV software are different.

Malcom 17 days ago

I feel like B is too narrow. We need to check all laptops, not just capital assets.

Gwen 23 days ago

Option A seems too limited. What if some laptops aren't on the console?

Chaya 28 days ago

Agreed! We need a complete list to ensure nothing is missed.

Sue 1 month ago

I think option C is the best choice. It covers all laptops.

Queen 1 month ago

Definitely C! It ensures nothing is overlooked.

Estrella 1 month ago

Option D is irrelevant. Firewalls don’t help with laptop AV checks.

Nikita 2 months ago

I feel option B is too narrow. We need all laptops, not just capital assets.

Na 2 months ago

Option A seems too limited. What if some laptops are missing?

Antione 2 months ago

Agreed! We need a complete list for accuracy.

Giuseppe 2 months ago

I think option C is the best choice. It covers all laptops.

Maia 2 months ago

B is too limited, we need to check all laptops, not just capital assets.

Judy 2 months ago

Wait, why would we use the Risk Register for this? Seems off.

Merri 3 months ago

Totally agree with C, we need the full list!

Carman 3 months ago

I think A makes more sense, it’s specific to AV.

Beth 3 months ago

C is the best choice, it covers all laptops.

Lorita 3 months ago

C makes the most sense, we need a complete list.

Cherri 3 months ago

B is too limited, we need all laptops in the sample.

Brendan 4 months ago

Surprised that D is even an option, it’s not relevant!

Mindy 5 months ago

I disagree, A is more accurate since it focuses on AV.

Mitsue 5 months ago

C is the best choice, it covers all laptops.

Cristina 6 months ago

The Risk Register seems off to me; I don't recall it being the right source for checking AV installations. It’s more about firewalls, I think.

Jame 6 months ago

I practiced a similar question, and I feel like the IT asset inventory is definitely the way to go, but I wonder if capital assets only is too limiting.

Carmen 6 months ago

I'm not too sure, but I remember something about the AV console being useful for checking installations. Could that be an option?

Annamae 6 months ago

I think the population should come from the IT asset inventory since it should have a complete list of all laptops, right?

HITRUST CCSFP Exam - Topic 5 Question 13 Discussion