APIs and web services require extensive hardening and must assume attacks from authenticated and unauthenticated adversaries.
Correct Answer: A
Question 72
What does "The Egregious 11" refer to?
Correct Answer: D
The Egregious 11 refers to a list of top threats to cloud computing, as published by the Cloud Security Alliance (CSA) in 2019. The CSA is a leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment. The Egregious 11 report ranks the most critical and pressing cloud security issues, such as data breaches, misconfigurations, insufficient identity and access management, and account hijacking. The report also provides recommendations for security, compliance, risk and technology practitioners to mitigate these threats. The Egregious 11 is based on a survey of industry experts and a review of current literature and media reports. The report is intended to raise awareness of the risks and challenges associated with cloud computing and promote strong security practices.12 Reference := CCAK Study Guide, Chapter 5: Cloud Auditing, page 961; CSA Top Threats to Cloud Computing: Egregious 11
Question 73
A cloud auditor observed that just before a new software went live, the librarian transferred production data to the test environment to confirm the new software can work in the production environment. What additional control should the cloud auditor check?
Correct Answer: B
The cloud auditor should check if there is explicit documented approval from all customers whose data is affected by the transfer of production data to the test environment. This is because production data may contain sensitive or personal information that is subject to privacy and security regulations, such as the General Data Protection Regulation (GDPR) or the Health Insurance Portability and Accountability Act (HIPAA). Therefore, using production data for testing purposes without the consent of the data owners may violate their rights and expose the organization to legal and reputational risks. This is also stated in the Cloud Controls Matrix (CCM) control DSI-04: Production / Non-Production Environments12, which is part of the Data Security & Information Lifecycle Management domain. The CCM is a cybersecurity control framework for cloud computing that can be used by cloud customers to build an operational cloud risk management program. The other options are not directly related to the question. Option A, approval of the change by the change advisory board, refers to the process of reviewing and authorizing changes to the system or software before they are implemented in the production environment. This is a good practice for ensuring the quality and reliability of the system or software, but it does not address the issue of using production data for testing purposes. Option C, training for the librarian, refers to the process of providing adequate education and awareness to the staff who are responsible for managing and transferring data between different environments. This is a good practice for ensuring the competence and accountability of the staff, but it does not address the issue of obtaining consent from the data owners. Option D, verification that the hardware of the test and production environments are compatible, refers to the process of ensuring that the system or software can run smoothly and consistently on both environments. This is a good practice for ensuring the performance and functionality of the system or software, but it does not address the issue of protecting the privacy and security of the production data. Reference := Certificate of Cloud Auditing Knowledge (CCAK) Study Guide, Chapter 6: Cloud Security Controls Cloud Controls Matrix (CCM) - CSA3 DSI-04: Production / Non-Production Environments - CSF Tools - Identity Digital1 DSI: Data Security & Information Lifecycle Management - CSF Tools - Identity Digital
Question 74
Which of the following is an example of integrity technical impact?
Correct Answer: D
An example of integrity technical impact refers to an event where the accuracy or trustworthiness of data is compromised. Option D, where a hacker uses a stolen administrator identity to alter the discount percentage in the product database, directly affects the integrity of the data. This action leads to unauthorized changes to data, which is a clear violation of data integrity. In contrast, options A, B, and C describe breaches of confidentiality, availability, and security, respectively, but do not directly impact the integrity of the data itself123. Reference = The concept of data integrity in cloud computing is extensively covered in the literature, including the importance of protecting against unauthorized data alteration to maintain the trustworthiness and accuracy of data throughout its lifecycle123.
Question 75
Which of the following attestations allows for immediate adoption of the Cloud Controls Matrix (CCM) as additional criteria to AICPA Trust Service Criteria and provides the flexibility to update the criteria as technology and market requirements change?
Correct Answer: D
The CSA STAR Attestation allows for the immediate adoption of the Cloud Controls Matrix (CCM) as additional criteria alongside the AICPA Trust Service Criteria. It also offers the flexibility to update the criteria as technology and market requirements evolve. This is because the CSA STAR Attestation is a combination of SOC 2 and additional cloud security criteria from the CSA CCM, providing guidelines for CPAs to conduct SOC 2 engagements using criteria from both the AICPA and the CSA Cloud Controls Matrix. References = The information is supported by the Cloud Security Alliance's resources, which explain that the CSA STAR Attestation integrates SOC 2 with additional criteria from the CCM, allowing for a comprehensive approach to cloud security that aligns with evolving technologies and market needs1.
