Which of the following can be used to determine whether access keys are stored in the source code or any other configuration files during development?
Correct Answer: D
Credential scanning is a technique that can be used to detect and prevent the exposure of access keys and other sensitive information in the source code or any other configuration files during development. Credential scanning tools can scan the code repositories, files, and commits for any hardcoded credentials, such as access keys, passwords, tokens, certificates, and connection strings. They can also alert the developers or security teams of any potential leaks and suggest remediation actions, such as rotating or revoking the compromised keys, removing the credentials from the code, or using secure storage mechanisms like vaults or environment variables. Credential scanning can be integrated into the development pipeline as part of the continuous integration and continuous delivery (CI/CD) process, or performed periodically as a security audit. Credential scanning can help reduce the risk of credential leakage, which can lead to unauthorized access, data breaches, or account compromise. Reference: Protecting Source Code in the Cloud with DSPM Best practices for managing service account keys Protect your code repository
Question 62
Which of the following has the MOST substantial impact on how aggressive or conservative the cloud approach of an organization will be?
Correct Answer: D
Risk appetite and budget constraints have the most substantial impact on how aggressive or conservative the cloud approach of an organization will be. Risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Budget constraints are the limitations on the financial resources that an organization can allocate to its cloud initiatives. Both factors influence the organization's strategic decisions on which cloud service models, deployment models, providers, and solutions to adopt, as well as the level of security, compliance, and performance to achieve. An organization with a high risk appetite and a large budget may opt for a more aggressive cloud approach, such as moving critical applications and data to a public cloud provider, while an organization with a low risk appetite and a small budget may opt for a more conservative cloud approach, such as keeping sensitive information on-premises or using a private cloud provider12. Reference: ISACA, Certificate of Cloud Auditing Knowledge (CCAK) Study Guide, 2021, p. 17-18. CSA, Cloud Controls Matrix (CCM) v4.0, 2021, p. 63.
Question 63
Due to cloud audit team resource constraints, an audit plan as initially approved cannot be completed. Assuming that the situation is communicated in the cloud audit report which course of action is MOST relevant?
Correct Answer: C
Question 64
To ensure a cloud service provider is complying with an organization's privacy requirements, a cloud auditor should FIRST review:
Correct Answer: A
To ensure a cloud service provider is complying with an organization's privacy requirements, a cloud auditor should first review the organizational policies, standards, and procedures that define the privacy objectives, expectations, and responsibilities of the organization. The organizational policies, standards, and procedures should also reflect the legal and regulatory requirements that apply to the organization and its cloud service provider, as well as the best practices and guidelines for cloud privacy. The organizational policies, standards, and procedures should provide the basis for evaluating the cloud service provider's privacy practices and controls, as well as the contractual terms and conditions that govern the cloud service agreement. The cloud auditor should compare the organizational policies, standards, and procedures with the cloud service provider' s self-disclosure statements, third-party audit reports, certifications, attestations, or other evidence of compliance123. Reviewing the adherence to organization policies, standards, and procedures (B) is a subsequent step that the cloud auditor should perform after reviewing the organizational policies, standards, and procedures themselves. The cloud auditor should assess whether the cloud service provider is following the organization' s policies, standards, and procedures consistently and effectively, as well as whether the organization is monitoring and enforcing the compliance of the cloud service provider. The cloud auditor should also identify any gaps or deviations between the organization's policies, standards, and procedures and the actual practices and controls of the cloud service provider123. Reviewing the legal and regulatory requirements is an important aspect of ensuring a cloud service provider is complying with an organization's privacy requirements, but it is not the first step that a cloud auditor should take. The legal and regulatory requirements may vary depending on the jurisdiction, industry, or sector of the organization and its cloud service provider. The legal and regulatory requirements may also change over time or be subject to interpretation or dispute. Therefore, the cloud auditor should first review the organizational policies, standards, and procedures that incorporate and translate the legal and regulatory requirements into specific and measurable privacy objectives, expectations, and responsibilities for both parties123. Reviewing the IT infrastructure (D) is not a relevant or sufficient step for ensuring a cloud service provider is complying with an organization's privacy requirements. The IT infrastructure refers to the hardware, software, network, and other components that support the delivery of cloud services. The IT infrastructure is only one aspect of cloud security and privacy, and it may not be accessible or visible to the cloud auditor or the organization. The cloud auditor should focus on reviewing the privacy practices and controls that are implemented by the cloud service provider at different layers of the cloud service model (IaaS, PaaS, SaaS), as well as the contractual terms and conditions that define the privacy rights and obligations of both parties123. References := * Cloud Audits and Compliance: What You Need To Know - Linford & Company LLP * Trust in the Cloud in audits of cloud services - PwC * Cloud Compliance & Regulations Resources | Google Cloud
Question 65
An organization currently following the ISO/IEC 27002 control framework has been charged by a new CIO to switch to the NIST 800-53 control framework. Which of the following is the FIRST step to this change?
Correct Answer: D
The first step to switch from the ISO/IEC 27002 control framework to the NIST 800-53 control framework is to map ISO/IEC 27002 and NIST 800-53 and detect gaps and commonalities. This step can help the organization to understand the similarities and differences between the two frameworks, and to identify which controls are already implemented, which controls need to be added or modified, and which controls are no longer applicable. Mapping can also help the organization to leverage the existing work done under ISO/IEC 27002 and avoid starting from scratch or discarding valuable information. Mapping can also help the organization to align with both frameworks, as they are not mutually exclusive or incompatible. In fact, NIST SP 800-53, Revision 5 provides a mapping table between NIST 800-53 and ISO/IEC 27001 in Appendix H- 21. ISO/IEC 27001 is a standard for information security management systems that is based on ISO/IEC 27002, which is a code of practice for information security controls2. References: * NIST SP 800-53, Revision 5 Control Mappings to ISO/IEC 27001 * ISO - ISO/IEC 27002:2013 - Information technology - Security techniques - Code of practice for information security controls
