An organization is in the initial phases of cloud adoption. It is not very knowledgeable about cloud security and cloud shared responsibility models. Which of the following approaches is BEST suited for such an organization to evaluate its cloud security?

• A.Use of an established standard/regulation to map controls and use as the audit criteria
• B.As this is the initial stage, the ISO/IEC 27001 certificate shared by the cloud service provider is sufficient for audit and compliance purposes.
• C.For efficiency reasons, use of its on-premises systems' audit criteria to audit the cloud environment
• D.Development of the cloud security audit criteria based on its own internal audit test plans to ensure appropriate coverage

Comment: *

Name: *

Email: *

Verification: *

Cloud Control Matrix (CCM) controls can be used by cloud customers to:

• A.define different control frameworks for different cloud service providers.
• B.build an operational cloud risk management program.
• C.facilitate communication with their legal department.
• D.develop new security baselines for the industry.

Comment: *

Name: *

Email: *

Verification: *

Use elastic servers when possible and move workloads to new instances.

• A.True
• B.False

Comment: *

Name: *

Email: *

Verification: *

Prioritizing assurance activities for an organization's cloud services portfolio depends PRIMARILY on an organization's ability to:

• A.collate views from various business functions using cloud services.
• B.schedule frequent reviews with high-risk cloud service providers.
• C.maintain a comprehensive cloud service inventory.
• D.develop plans using a standardized risk-based approach.

Comment: *

Name: *

Email: *

Verification: *

During an audit it was identified that a critical application hosted in an off-premises cloud is not part of the organization's DRP (Disaster Recovery Plan). Management stated that it is responsible for ensuring that the cloud service provider (CSP) has a plan that is tested annually. What should be the auditor's NEXT course of action?

• A.Review the contract and DR capability.
• B.Plan an audit of the CSP.
• C.Review the CSP audit reports.
• D.Review the security white paper of the CSP.

Comment: *

Name: *

Email: *

Verification: *