ISACA CCAK Certificate of Cloud Auditing Knowledge Online Training

Question #31

A cloud service provider utilizes services of other service providers for its cloud service.

Which of the following is the BEST approach for the auditor while performing the audit for the cloud service?

A . The auditor should review the service providers’ security controls even more strictly, as they are further separated from the cloud customer.
B . The auditor should review the relationship between the cloud service provider and its service provider to help direct and estimate the level of effort and analysis the auditor should apply.
C . As the contract for the cloud service is between the cloud customer and the cloud service provider, there is no need for the auditor to review the services provided by the service providers.
D . As the relationship between the cloud service provider and its service providers is governed by separate contracts between them, there is no need for the auditor to review the services

Reveal Solution Hide Solution

Question #32

The PRIMARY objective for an auditor to understand the organization’s context for a cloud audit is to:

A . determine whether the organization has carried out control self-assessment (CSA) and validated audit reports of the cloud service providers.
B . validate an understanding of the organization’s current state and how the cloud audit plan fits into the existing audit approach.
C . validate the organization’s performance effectiveness utilizing cloud service provider solutions.
D . validate whether an organization has a cloud audit plan in place.

Reveal Solution Hide Solution

Question #33

During the planning phase of a cloud audit, the PRIMARY goal of a cloud auditor is to:

A . specify appropriate tests.
B . address audit objectives.
C . minimize audit resources.
D . collect sufficient evidence.

Reveal Solution Hide Solution

Question #34

An auditor examining a cloud service provider’s service level agreement (SLA) should be MOST concerned about whether:

A . the agreement includes any operational matters that are material to the service operations.
B . the agreement excludes any sourcing and financial matters that are material in meeting the service level agreement (SLA).
C . the agreement includes any service availability matters that are material to the service operations.
D . the agreement excludes any operational matters that are material to the service operations

Reveal Solution Hide Solution

Question #35

A cloud auditor should use statistical sampling rather than judgment (nonstatistical) sampling when:

A . generalized audit software is unavailable.
B . the auditor wants to avoid sampling risk.
C . the probability of error must be objectively quantified.
D . the tolerable error rate cannot be determined.

Reveal Solution Hide Solution

Question #36

The FINAL decision to include a material finding in a cloud audit report should be made by the:

A . auditee’s senior management.
B . organization’s chief executive officer (CEO).
C . cloud auditor.
D . organization’s chief information security officer (CISO)

Reveal Solution Hide Solution

Question #37

What aspect of Software as a Service (SaaS) functionality and operations would the cloud customer be responsible for and should be audited?

A . Access controls
B . Vulnerability management
C . Patching
D . Source code reviews

Reveal Solution Hide Solution

Question #38

What areas should be reviewed when auditing a public cloud?

A . Identity and access management (IAM) and data protection
B . Source code reviews and hypervisor
C . Patching and configuration
D . Vulnerability management and cyber security reviews

Reveal Solution Hide Solution

Question #39

Which of the following aspects of risk management involves identifying the potential reputational and financial harm when an incident occurs?

A . Impact analysis
B . Likelihood
C . Mitigation
D . Residual risk

Reveal Solution Hide Solution

Question #40

Which of the following would be the MOST critical finding of an application security and DevOps audit?

A . Certifications with global security standards specific to cloud are not reviewed, and the impact of noted findings are not assessed.
B . Application architecture and configurations did not consider security measures.
C . Outsourced cloud service interruption, breach, or loss of stored data occurred at the cloud service provider.
D . The organization is not using a unified framework to integrate cloud compliance with regulatory requirements

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

According to the web search results, the most critical finding of an application security and DevOps audit would be that the application architecture and configurations did not consider security measures. This finding indicates a serious lack of security by design and security by default principles, which are essential for ensuring the confidentiality, integrity, and availability of the application and its data. If the application architecture and configurations are not secure, they could expose the application to various threats and vulnerabilities, such as unauthorized access, data breaches, denial-of-service attacks, injection attacks, cross-site scripting attacks, and others. This finding could also result in non-compliance with relevant security standards and regulations, such as ISO 27001, PCI DSS, GDPR, and others. Therefore, this finding should be addressed with high priority and urgency by implementing appropriate security measures and controls in the application architecture and configurations.

The other options are not as critical as option B.

Option A is a moderate finding that indicates a lack

of awareness and assessment of the global security standards specific to cloud, such as ISO 27017, ISO 27018, CSA CCM, NIST SP 800-53, and others. This finding could affect the security and compliance of the cloud services used by the application, but it does not directly impact the application itself.

Option C is a severe finding that indicates a major incident that occurred at the cloud service provider level, such as a service interruption, breach, or loss of stored data. This finding could affect the availability, confidentiality, and integrity of the application and its data, but it is not caused by the application itself.

Option D is a minor finding that indicates a lack of efficiency and consistency in integrating cloud compliance with regulatory requirements. This finding could affect the compliance posture of the application and its data, but it does not directly impact the security or functionality of the application.

Reference: [Application Security Best Practices – OWASP]

[DevSecOps: What It Is and How to Get Started – ISACA]

[Cloud Security Standards: What to Expect & What to Negotiate – CSA] [Cloud Computing Security Audit – ISACA] [Cloud Computing Incident Response – ISACA]

[Cloud Compliance: A Framework for Using Cloud Services While Maintaining Compliance – ISACA]