Understand Audit Process, Methodologies, and Required Adaptations for a Cloud Environment CCSP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is establishing an internal ISMS to support its cloud operations. The ISMS will be used as the basis for internal and external audits. Which of the following components is essential for the ISMS to effectively support audits?

   • AA single document that contains all security procedures and is updated annually.
   • BA comprehensive list of all cloud provider controls, regardless of relevance to the company.
   • CA certification from an external auditor that the ISMS is compliant with ISO 27001.
   • DDocumented policies, risk assessment procedures, and evidence of control implementation and monitoring.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a cloud environment, how do audit requirements typically affect the cloud service provider (CSP) and the customer under the shared responsibility model?

   • AThe CSP must provide audit evidence for the services and controls it operates, while the customer must audit its own use of the cloud services and its data.
   • BThe customer is solely responsible for auditing the entire cloud environment, including the CSP's infrastructure.
   • CAudit requirements apply only to the CSP, and the customer is exempt from audit obligations.
   • DThe CSP is responsible for auditing all customer data and applications, while the customer is responsible for auditing the physical infrastructure.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is performing a gap analysis of its cloud-based email system against its internal security baseline. The baseline is defined in the company's ISMS. The gap analysis reveals that the email system does not enforce multi-factor authentication (MFA) for all users, while the baseline requires MFA for all remote access. Which of the following is the most appropriate next step?

   • ADocument the gap and develop a remediation plan to implement MFA for all remote access users.
   • BAccept the risk without documentation, as the email system is not critical.
   • CImmediately disable remote access to the email system to eliminate the risk.
   • DUpdate the baseline to remove the MFA requirement, as it is not feasible for the email system.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company's internal audit department is evaluating the effectiveness of its information security controls system. The company uses a public cloud for data storage and has implemented an ISMS. The internal audit team wants to assess whether the controls are operating effectively. Which activity is most appropriate for the internal audit team to perform?

   • APerform a vulnerability scan of the company's network and report the results without further analysis.
   • BRely solely on the cloud provider's SOC 2 report to conclude on the effectiveness of all controls.
   • CReview the ISMS documentation and conduct tests of the company's controls, including those that rely on the cloud provider's controls as evidenced by the provider's SOC 2 report.
   • DAsk the external auditor to perform the internal audit, as they have more experience.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company's internal audit team is preparing for an annual audit of its cloud-based HR system. The team wants to identify gaps between the current security controls and the company's baseline security policy. The HR system is hosted in a public cloud, and the company has an ISMS that documents its security policies and controls. Which approach is most effective for the audit team to perform the gap analysis?

   • AReview the cloud provider's SOC 2 report and assume that all controls listed in the report are implemented in the company's system.
   • BConduct a risk assessment of the HR system and implement all possible security controls to eliminate all risks.
   • CAsk the cloud provider to perform the gap analysis on behalf of the company, as the provider has access to the underlying infrastructure.
   • DCompare the controls implemented in the cloud system against the controls defined in the company's ISMS baseline, and document any missing or partially implemented controls.
   Reveal Solution Discussion Select an answer first