Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

HITRUST CCSFP Exam - Topic 5 Question 13 Discussion

A sample of laptops is being selected to ensure AV software has been properly installed/configured. Where should the population be pulled from? [0173]
C) The IT asset inventory, for a list of all laptops
A) The AV console, as it lists all laptops with AV installed
B) The IT asset inventory, for capital assets only
D) The Risk Register, as it lists all firewalls with AV installed

HITRUST CCSFP Exam - Topic 5 Question 13 Discussion

Actual exam question for HITRUST's CCSFP exam
Question #: 13
Topic #: 5
[All CCSFP Questions]

A sample of laptops is being selected to ensure AV software has been properly installed/configured. Where should the population be pulled from? [0173]

Show Suggested Answer Hide Answer
Suggested Answer: C

When testing implementation, the population must include the full set of in-scope assets, not just a subset filtered by existing controls.

AV console (A) only shows devices with AV installed; it would exclude noncompliant assets.

IT asset inventory (C) provides the complete list of laptops, making it the proper source for random sample selection.

Risk register (D) lists risks, not devices.

Capital assets only (B) not comprehensive for all laptops.

Extract Reference (HITRUST Assessment Sampling Guidance, CCSFP [0173]):

Sampling must be based on the complete population from the IT asset inventory; reliance on control-based systems (e.g., AV console) introduces bias.


by Jill at Apr 07, 2026, 06:17 AM

Limited Time Offer

25%

Off

Get Premium CCSFP Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Beth
C is the best choice, it covers all laptops.
upvoted 0 times
...
Lorita
5 days ago
C makes the most sense, we need a complete list.
upvoted 0 times
...
Cherri
10 days ago
B is too limited, we need all laptops in the sample.
upvoted 0 times
...
Brendan
15 days ago
Surprised that D is even an option, it’s not relevant!
upvoted 0 times
...
Mindy
2 months ago
I disagree, A is more accurate since it focuses on AV.
upvoted 0 times
...
Mitsue
2 months ago
C is the best choice, it covers all laptops.
upvoted 0 times
...
Cristina
3 months ago
The Risk Register seems off to me; I don't recall it being the right source for checking AV installations. It’s more about firewalls, I think.
upvoted 0 times
...
Jame
3 months ago
I practiced a similar question, and I feel like the IT asset inventory is definitely the way to go, but I wonder if capital assets only is too limiting.
upvoted 0 times
...
Carmen
3 months ago
I'm not too sure, but I remember something about the AV console being useful for checking installations. Could that be an option?
upvoted 0 times
...
Annamae
3 months ago
I think the population should come from the IT asset inventory since it should have a complete list of all laptops, right?
upvoted 0 times
...

Save Cancel