The MAIN limitation of relying on traditional cloud compliance assurance approaches such as SOC2 attestations is that:
Correct Answer: C
Traditional cloud compliance assurance approaches such as SOC2 attestations have the main limitation of providing a point-in-time snapshot of an organization's compliance posture. This means that they only reflect the state of the organization's security and compliance controls at a specific date or period, which may not be representative of the current or future state. Cloud environments are dynamic and constantly changing, and so are the threats and risks that affect them. Therefore, relying on traditional cloud compliance assurance approaches may not provide sufficient or timely assurance that the organization's cloud services and data are adequately protected and compliant with the relevant requirements and standards.12 To overcome this limitation, some organizations adopt continuous cloud compliance assurance approaches, such as continuous monitoring, auditing, and reporting. These approaches enable the organization to collect, analyze, and report on the security and compliance status of its cloud environment in near real-time, using automated tools and processes. Continuous cloud compliance assurance approaches can help the organization to identify and respond to any changes, issues, or incidents that may affect its cloud security and compliance posture, and to maintain a high level of trust and transparency with its stakeholders, customers, and regulators.34 References := What is SOC 2? Complete Guide to SOC 2 Reports | CSA1; Guidance on cloud security assessment and authorization - ITSP.50.105 - Canadian Centre for Cyber Security2; Continuous Compliance: The Future of Cloud Security | CloudCheckr3; Continuous Compliance: How to Automate Cloud Security Compliance4
Question 132
An IS auditor is a member of an application development team that is selecting software. Which of the following would impair the auditor's independence?
Correct Answer: A
Question 133
When building a cloud governance model, which of the following requirements will focus more on the cloud service provider's evaluation and control checklist?
Correct Answer: C
Question 134
Which of the following is a cloud-specific security standard?
Correct Answer: A
Explanation ISO/IEC 15027017 is a cloud-specific security standard that provides guidelines for information security controls applicable to the provision and use of cloud services. It is based on ISO/IEC 27002, which is a general standard for information security management, but it also includes additional controls and implementation guidance that specifically relate to cloud services. ISO/IEC 15027017 is intended to help both cloud service providers and cloud service customers to enhance the security and confidentiality of their cloud environment and to comply with relevant regulatory requirements and industry standards.12 References := ISO/IEC 27017:2015 - Information technology - Security techniques - Code of practice for information security controls based on ISO/IEC 27002 for cloud services1; Cloud Security Standards: ISO, PCI, GDPR and Your Cloud - Exabeam3; ISO/IEC 27017 - Wikipedia2
Question 135
A large organization with subsidiaries in multiple locations has a business requirement to organize IT systems to have identified resources reside in particular locations with organizational personnel. Which access control method will allow IT personnel to be segregated across the various locations?
