Understand Audit Process, Methodologies, and Required Adaptations for a Cloud Environment CCSP Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is planning an audit of its cloud infrastructure, which includes both on-premises systems and a public cloud environment. The audit team needs to define the audit scope and objectives. Which of the following is the most important first step in the audit planning process?

   • ADraft the audit report template to ensure consistency across all findings.
   • BIdentify the relevant stakeholders, including the cloud provider's audit liaison, and define the audit scope and objectives in coordination with them.
   • CSelect the audit tools and software to be used during the audit before defining the scope.
   • DRequest the cloud provider's SOC 3 report to avoid the need for detailed audit planning.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   How does a distributed IT model, with resources in multiple geographical locations, affect the audit scope?

   • AIt requires the auditor to consider the legal and regulatory requirements of each jurisdiction where data is processed or stored.
   • BIt only affects the cloud provider, not the customer.
   • CIt simplifies the audit because all data is stored in one location.
   • DIt eliminates the need for audits because the cloud provider is responsible for all compliance.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is a common restriction in the scope of an SSAE or ISAE audit report?

   • AThe report excludes controls that are the responsibility of the user entity, such as controls over user access and data handling.
   • BThe report includes all subservice organizations without exception.
   • CThe report provides an opinion on the effectiveness of all controls, including those not tested.
   • DThe report covers all controls of the service organization, including those not relevant to user entities.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A healthcare organization is moving its electronic health records (EHR) system to a public cloud. The organization must comply with HIPAA and HITECH regulations. The organization's compliance officer is concerned about the cloud provider's ability to meet these requirements. Which of the following is the most appropriate action?

   • ARequire the provider to sign a general data protection agreement (DPA) to ensure HIPAA compliance.
   • BRely on the provider's SOC 1 report, as it covers all security and privacy controls.
   • CAccept the provider's self-assessment of HIPAA compliance without independent verification.
   • DSign a business associate agreement (BAA) with the provider and obtain a HITRUST CSF certification or a SOC 2 report that includes HIPAA security and privacy criteria.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a common way that audit requirements affect a cloud customer's responsibilities?

   • AThe customer must ensure that its own configurations and data handling practices comply with relevant standards and regulations.
   • BThe customer must provide the cloud provider with access to its internal audit reports.
   • CThe customer is exempt from all audit requirements because the provider is responsible for compliance.
   • DThe customer must conduct physical security audits of the cloud provider's data centers.
   Reveal Solution Discussion Select an answer first