Understand Audit Process, Methodologies, and Required Adaptations for a Cloud Environment CCSP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of monitoring within an internal information security controls system?

   • ADeveloping a new marketing campaign.
   • BRegularly reviewing access logs to detect unauthorized access attempts.
   • CConducting a financial audit.
   • DWriting a new security policy.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is planning an audit of its cloud environment, which includes a SaaS application for HR management and a PaaS platform for custom applications. The company operates in multiple countries with different data protection laws. The audit team must develop an audit plan that covers all relevant systems and complies with legal requirements. Which of the following is the most important factor to consider when developing the audit plan?

   • AThe availability of the company's internal audit staff, as they may need to travel to multiple locations.
   • BThe need to audit all systems in a single location to simplify the process.
   • CThe legal and regulatory requirements of each jurisdiction where data is processed, as they may affect the audit scope, access to data, and reporting obligations.
   • DThe preferences of the cloud provider's sales team, as they can facilitate access to the provider's systems.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is planning an audit of its cloud environment, which includes a SaaS application for customer relationship management. The audit team needs to identify all relevant stakeholders to involve in the audit planning. Which of the following groups should be included?

   • AOnly the IT operations team, as they manage the cloud environment.
   • BInternal audit, IT operations, legal/compliance, and the cloud provider's audit liaison.
   • COnly the external auditor, as they will perform the audit.
   • DOnly the internal audit team and the cloud provider's sales representative.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Why is it important to involve the cloud provider in the audit process?

   • ATo allow the provider to influence the audit findings.
   • BTo help the provider improve its own security posture.
   • CTo ensure the provider is aware of the customer's marketing strategy.
   • DTo obtain access to audit evidence and information about the provider's controls.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a key component of an internal ISMS?

   • AA risk assessment process to identify and evaluate information security risks.
   • BA list of all external audit reports.
   • CA financial audit of the organization's expenditures.
   • DA marketing strategy to promote the organization's security posture.
   Reveal Solution Discussion Select an answer first