Understand Audit Process, Methodologies, and Required Adaptations for a Cloud Environment CCSP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Why is it important for a cloud customer to review the scope statement of an SSAE or ISAE report?

   • ATo confirm that the report is publicly available.
   • BTo determine if the report covers all the controls that the customer relies on for its compliance.
   • CTo determine the cost of the audit.
   • DTo verify that the auditor was independent and unbiased.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An auditor is reviewing a cloud provider's ISAE 3402 report (Type II) for a client that uses the provider's infrastructure as a service. The report's scope statement includes the provider's data centers and network operations, but explicitly excludes the virtualization layer and the customer-facing management portal. The client's internal audit team wants to rely on this report for their annual audit. What is the most appropriate conclusion for the auditor to communicate?

   • AThe report is sufficient because ISAE 3402 reports cover all controls relevant to the client's use of the service.
   • BThe report does not provide assurance over the excluded areas, so the client should obtain additional assurance for the virtualization layer and management portal, such as a separate audit or provider attestation.
   • CThe client can rely on the report for the excluded areas because the provider's controls are audited annually.
   • DThe client should request a SOC 3 report to cover the excluded areas, as it provides broader assurance.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which type of policy would most likely include requirements for cloud service provider risk assessments?

   • AHuman resources policy
   • BFunctional policy
   • COrganizational policy
   • DCloud computing policy
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company's external auditor is planning the annual financial statement audit. The company uses a cloud provider for its accounting system. The external auditor needs to obtain assurance over the provider's controls that are relevant to financial reporting. Which of the following is the most appropriate source of assurance for the external auditor?

   • AA SOC 3 report from the cloud provider, as it is a general-use report.
   • BA SOC 2 report (Type II) from the cloud provider, as it covers all security controls.
   • CThe company's internal audit report on the cloud provider's controls.
   • DA SOC 1 report (Type II) from the cloud provider, which provides assurance over controls relevant to financial reporting.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a unique assurance challenge introduced by virtualization in cloud computing?

   • AVirtualization allows multiple tenants to share the same physical hardware, making it difficult to isolate audit evidence and verify that controls are applied consistently.
   • BVirtualization makes it impossible to perform audits because the infrastructure is not physical.
   • CVirtualization eliminates the need for physical security controls.
   • DVirtualization requires auditors to have physical access to every virtual machine.
   Reveal Solution Discussion Select an answer first