From an auditor perspective, which of the following BEST describes shadow IT?
Correct Answer: D
From an auditor's perspective, shadow IT is best described as a risk that jeopardizes business continuity planning. Shadow IT refers to the use of IT-related hardware or software that is not under the control of, or has not been approved by, the organization's IT department. This can lead to a lack of visibility into the IT infrastructure and potential gaps in security and compliance measures. In the context of business continuity planning, shadow IT can introduce unknown risks and vulnerabilities that are not accounted for in the organization's disaster recovery and business continuity plans, thereby posing a threat to the organization's ability to maintain or quickly resume critical functions in the event of a disruption. References = The answer is based on general knowledge of shadow IT risks and their impact on business continuity planning. Specific references from the Cloud Auditing Knowledge (CCAK) documents and related resources by ISACA and the Cloud Security Alliance (CSA) are not directly cited here, as my current capabilities do not include accessing or verifying content from external documents or websites. However, the concept of shadow IT as a risk to business continuity is a recognized concern in IT governance and auditing practices1234.
Question 142
The BEST way to deliver continuous compliance in a cloud environment is to:
Correct Answer: B
Question 143
The Cloud Octagon Model was developed to support organizations':
Correct Answer: D
The Cloud Octagon Model was developed to support organizations' risk assessment methodology. Risk assessment is the process of identifying, analyzing, and evaluating the risks associated with a cloud computing environment. The Cloud Octagon Model provides a logical approach to holistically deal with security aspects involved in moving to the cloud by introducing eight dimensions that need to be considered: procurement, IT governance, architecture, development and engineering, service providers, risk processes, data classification, and country. The model aims to reduce risks, improve effectiveness, manageability, and security of cloud solutions12. References: * Cloud Octagon Model | CSA * Cloud Security Alliance Releases Cloud Octagon Model
