Which of the following is the common cause of misconfiguration in a cloud environment?
A
Explanation:
Reference: https://businessinsights.bitdefender.com/the-top-5-cloud-threats-that-smbs-need-to-address
Which of the following metrics are frequently immature?
A
None
Which of the following quantitative measures is KEY for an auditor to review when assessing the implementation of
continuous auditing of performance on a cloud system?
C
None
Which of the following is MOST important to consider when developing an effective threat model during the introduction of a
new SaaS service into a customer organizations architecture? The threat model:
A
None
As a developer building codes into a container in a DevSecOps environment, which of the following is the appropriate
place(s) to perform security tests?
D
None
An organization has an ISMS implemented, following ISO 27001 and Annex A controls. The CIO would like to migrate some
of the infrastructure to the cloud. Which of the following standards would BEST assist in identifying controls to consider for
this migration?
D
Explanation:
ISO/IEC 27017 standard defines the requirements for an information security management system (ISMS). Note that the
entire organization is not necessarily affected by the standard, because it all depends on the scope of the ISMS. The scope
could be limited by the provider to one group within an organization, and there is no guarantee that any group outside of the
scope has appropriate ISMSs in place. It is up to the auditor to verify that the scope of the engagement is fit for purpose. As
the customer, you are responsible for determining whether the scope of the certification is relevant for your purposes.
An organization deploying the Cloud Control Matrix (CCM) to perform a compliance assessment will encompass the use of
the Corporate Governance Relevance feature to filter out those controls:
A
None
How should controls be designed by an organization?
A
Explanation:
Reference: https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2016/internal-control-key-to-delivering-
stakeholder-value
Changes to which of the following will MOST likely influence the expansion or reduction of controls required to remediate the
risk arising from changes to an organizations SaaS vendor?
C
Explanation:
Reference: https://assets.kpmg/content/dam/kpmg/ch/pdf/key-risks-internal-audit-2018.pdf
What data center and physical security measures should a cloud customer consider when assessing a cloud service
provider?
C
Explanation:
Reference: https://www.omg.org/cloud/deliverables/CSCC-Security-for-Cloud-Computing-10-Steps-to-Ensure-Success.pdf
Prioritizing assurance activities for an organizations cloud services portfolio depends PRIMARILY on an organizations
ability to:
A
None
What is the advantage of using dynamic application security testing (DAST) over static application security testing (SAST)
methodology?
A
Explanation:
Reference: https://www.synopsys.com/blogs/software-security/sast-vs-dast-difference/
What aspect of SaaS functionality and operations would the cloud customer be responsible for and should be audited?
A
Explanation:
Reference: https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=919233
When migrating to a cloud environment, which of the following should be the PRIMARY driver for the use of encryption?
A
None
When a client’s business process changes, the CSP SLA should:
D
Explanation:
Reference: http://www.diva-portal.org/smash/get/diva2:1312384/FULLTEXT01.pdf