90 SURGENT MCQS Flashcards
A company is considering a move to a software as a service (SaaS) offering instead of a traditional in-house application. Which of the following concerns is unique to SaaS?
Disaster recovery capabilities and documented recovery procedures
User credential setup and control over the actions that employees can perform
Allocation of software expenses and overhead charged to departments
Ownership of processed data and costs of data migrations
Ownership of processed data and costs of data migrations
In a software as a service (SaaS) model, the company relies on a third-party provider’s infrastructure to host and process its data. This raises unique concerns about the ownership of the processed data since it resides on the SaaS provider’s servers. Additionally, costs associated with migrating data to and from the SaaS offering are critical considerations, as data migrations may incur expenses and require careful planning.
Disaster recovery capabilities and documented recovery procedures
Disaster recovery is a shared concern for in-house applications and SaaS offerings. Both models need robust recovery capabilities to ensure business continuity during a disaster. It is not unique to SaaS and is a standard consideration for any critical IT infrastructure.
User credential setup and control over the actions that employees can perform
User credential setup and access control are general concerns applicable to any IT environment, whether in-house or SaaS-based. Both models require managing user access and control permissions, making this concern not unique to SaaS.
Allocation of software expenses and overhead charged to departments
Allocating software expenses and managing overhead costs is a common consideration for both in-house applications and SaaS offerings. Organizations must understand the cost structure and budgeting for their software solutions, making this concern not unique to SaaS.
Cloud Computing
Relevant Terms
Cloud
Data
Software
Software as a Service (SaaS)
Reference
7111.08
A fintech (financial technology) organization plans to deploy a cloud-based application for employee payroll processing. Which of the following should be the most significant concern for an auditor?
Performance requirements are not specified in the service-level agreement (SLA).
There is no right-to-audit clause in the contract.
The contract does not require the cloud provider to provide its annual penetration testing results.
The cloud provider’s data center is located in a different country.
The cloud provider’s data center is located in a different country.
Data protection regulations are the most important risk to consider due to data residency where different countries have specific regulations about where data can be stored and processed. Depending on your application and its data, you may also need to comply with various data protection laws, such as GDPR, HIPAA, or CCPA. The risks related to not complying can be costly because you can be fined for data breaches.
Performance requirements are not specified in the service-level agreement (SLA).
Service Level Agreements (SLA) related to cloud service providers are formal contracts that outline the performance standards, quality of service, and responsibilities between the cloud service provider and the customer. These agreements define specific metrics related to the service’s performance, availability, and reliability that the provider commits to meet. SLAs are crucial in the cloud computing environment as they offer customers a guarantee regarding the level of service they can expect and provide recourse in case the service levels are not achieved. They are very important, but they do not involve the severity of fines that not complying with laws and regulations result in.
There is no right-to-audit clause in the contract.
A right-to-audit clause in a Service Level Agreement (SLA) is a provision that grants the customer the right to conduct audits on the service provider’s processes, systems, and operations relevant to the services provided under the agreement. This clause is designed to ensure transparency and compliance with the terms of the SLA, allowing the customer to verify that the service provider is fulfilling their obligations, particularly in areas such as performance, security, data protection, and privacy. Again, the possibility of breaking laws and regulations and being fined is more important.
The contract does not require the cloud provider to provide its annual penetration testing results.
Penetration testing by a cloud service provider involves a systematic attempt to evaluate the security of their cloud services by simulating an attack from malicious outsiders (and sometimes insiders). This type of testing is designed to identify vulnerabilities, weaknesses, and potential security gaps within the cloud infrastructure, including hardware, software, networks, and applications. The primary goal is to discover and fix security issues before they can be exploited by attackers, thereby enhancing the overall security posture of the cloud services offered to customers.
Penetration testing in the cloud environment can be more complex than in traditional IT environments due to the shared responsibility model that underpins cloud computing. In this model, the cloud service provider is responsible for securing the infrastructure (hardware, software, networking, and facilities), while the customer is responsible for securing the data and applications they run within the cloud. This division of responsibility means that penetration testing must be carefully planned and coordinated to ensure it does not impact other tenants or violate the cloud provider’s terms of service. Penetration testing is important, but the risk of fines is more important of a consideration.
Cloud Computing
Relevant Terms
Cloud
Cloud Computing
Reference
7111.11
7111.13
A healthcare provider is considering moving its data storage to the cloud. What is the most critical consideration for the healthcare provider?
The backup method used by the cloud provider
The cost of storing in the cloud versus on-premises
The cloud provider’s reputation in the market
Regulatory and compliance requirements
Regulatory and compliance requirements. HIPAA is a huge concern for healthcare providers. There are heavy fines for noncompliance with HIPAA.
- Regulatory compliance:
1. Data protection laws: Adhering to data protection regulations such as GDPR (General Data Protection Regulation) and HIPAA (Health Insurance Portability and Accountability Act of 1996) - Legal documentation:
1. Service-level agreements (SLAs): Clearly defining service levels, responsibilities, and customer rights in legal documents.
2. Privacy policies: Outlining how customer data is handled, used, and protected
The backup method used by the cloud provider.
This is not as critical as regulatory compliance.
The cost of storing in the cloud versus on-premises.
This is not as critical as regulatory compliance.
The cloud provider’s reputation in the market.
This is not as critical as regulatory compliance.
Cloud Computing
What is the most critical factor in a decision for a health provider when considering moving their data to the cloud?
ABC Cloud sells software to watch licensed videos on demand. It follows a subscription-based model whereby the user chooses a subscription plan and pays a fixed sum of money to ABC Cloud monthly or annually. What type of cloud-based service is ABC Cloud providing?
Windows Azure
IaaS
PaaS
SaaS
SaaS
ABC Cloud is providing software as a service (SaaS). Software as a service (SaaS) is software that can be accessed via an internet browser without downloading it onto a computer, laptop, or smartphone. SaaS usually comes as a subscription-based service where the user pays a fixed monthly or annually for using the software. The user’s data is kept in the SaaS provider’s data center. Software as a service (SaaS) provides on‐demand online access to specific software applications or suites without the need for local installation. SaaS can be implemented as a subscription service (for example, Microsoft Office 365).
IaaS
IaaS (infrastructure as a service), the consumer is provided with fundamental computing resources such as processing power, storage, networking components, or middleware. The consumer can control the operating system, storage, deployed applications, and possibly networking components such as firewalls and load balancers, but not the cloud infrastructure beneath them.
PaaS
PaaS (platform as a service) provides consumers a hosting environment for their applications. The consumer controls the applications that run in the environment but does not control the software, hardware, or network infrastructure on which they are running.
Windows Azure
Microsoft’s Windows Azure is IaaS (infrastructure as a service) and PaaS (platform as a service).
Cloud Computing
Relevant Terms
Cloud Computing
Software as a Service (SaaS)
Reference
7111.08
Amanda, an auditor, is reviewing an organization’s agreement with a cloud provider. Which of the following is the most significant concern for Amanda?
The contract prohibits site visits.
Laws and regulations are different in the countries of the organization and the vendor.
The organization uses an older web browser that is highly vulnerable to cyberattacks.
The contract does not state the cloud provider’s responsibility in the event of a data breach.
The contract does not state the cloud provider’s responsibility in the event of a data breach.
Cloud computing involves more than one party, and each party is responsible for maintaining adequate security in their respective IT environments. In the event of a security breach, the party responsible for the breach should be held accountable. Therefore, the contract should state the responsibilities of each party in the case of a data incident.
CHATGPT:
Data Breach Responsibilities: Understanding and clearly defining the responsibilities of each party in the event of a data breach is crucial for managing risk. Without explicit terms regarding the cloud provider’s obligations, the organization may be left vulnerable to significant legal, financial, and reputational damage without recourse or support from the provider.
Compliance and Regulatory Implications: Many industries are subject to strict regulations regarding data protection and breach notification (e.g., GDPR, HIPAA). Failure to ensure that the cloud provider adheres to these regulations can result in hefty fines and penalties for non-compliance. The absence of clear responsibilities in the contract can complicate compliance efforts.
Risk Management: A contract that clearly outlines the provider’s responsibilities is essential for effective risk management. Without this, the organization might not have adequate measures in place to mitigate the impact of a data breach, including incident response, notification processes, and remediation efforts.
While the other concerns are also important—such as the security risks associated with using outdated software, differences in legal jurisdictions, and the prohibition of site visits—the lack of clarity around the cloud provider’s responsibilities in a data breach scenario poses a direct threat to the organization’s security posture and compliance status. It affects the organization’s ability to respond effectively to incidents and manage its overall risk profile.
The contract prohibits site visits.
While site visits act as a helpful oversight and monitoring control, there are alternative procedures to monitor cloud providers such as virtual meetings and performance monitoring reports.
Prohibiting site visits to the cloud provider’s facilities may raise concerns about transparency and the ability to conduct thorough audits of physical and operational security measures. However, many cloud services operate on models that do not easily accommodate physical audits due to the distributed nature of cloud computing. Instead, reliance on third-party certifications and audits (e.g., SOC 2, ISO 27001) can mitigate these concerns. Thus, while this restriction can be a concern, it’s often navigable through other means of assurance.
Laws and regulations are different in the countries of the organization and the vendor.
The auditor should ensure that the contract addresses the differing laws and regulations in the countries of the organization and the vendor, but having different laws and regulations is not a problem.
Differences in laws and regulations across jurisdictions are a common challenge in international business and cloud services. These differences necessitate careful consideration during contract negotiations to ensure compliance with relevant laws in both jurisdictions. However, this issue is not unique to cloud services and can be addressed through legal counsel and compliance efforts, making it a manageable aspect of vendor selection and contract negotiation.
The organization uses an older web browser that is highly vulnerable to cyberattacks.
While highly vulnerable browsers pose a significant risk to the organization’s security, the IS auditor can raise an audit issue for this problem, and IT can acquire and deploy a more secure browser.
Using outdated software that is vulnerable to cyberattacks is indeed a significant security risk. However, this concern is more related to the organization’s internal IT management and cybersecurity practices rather than the specifics of the cloud service provider’s responsibilities. It’s a problem that the organization has direct control over and can remedy by updating or replacing the vulnerable software, thereby mitigating this risk independently of the cloud provider.
Cloud Computing
7221.55
7221.56
An auditor identified personal software installed on some corporate computers. What should the auditor do next?
Review security training content to determine whether end users are educated on the risks of installing personal software on corporate computers.
Determine whether end users obtained approval from IT before installing personal software on corporate computers.
Report a finding and recommend that IT implement logical controls to disable installation of any personal software.
Review the security policy to determine whether installation of personal software is forbidden on corporate computers.
IReview the security policy to determine whether installation of personal software is forbidden on corporate computers.
If the security policy is silent on installing personal software on corporate computers, the auditor should recommend that management update the security policy.
The other answer choices are incorrect. Although these are valid steps that the auditor should take, these should be conducted after the auditor has reviewed the security policy.
IT Infrastructure
Relevant Terms
Software
Reference
7111.06
Ben, an auditor, reviews an organization planning to move a business application to an external cloud service PaaS (platform as a service) vendor. Which of the following is the most crucial security consideration?
Cost of hosting the application externally compared to on-premises
Vendor reputation on the market and references from clients
Degradation of application performance due to use of shared services
Laws and regulations related to data hosting
Laws and regulations related to data hosting
This question is asking about the key security consideration that an auditor, named Ben in this scenario, should prioritize when evaluating an organization’s plan to migrate a business application to an external cloud service that operates on a Platform as a Service (PaaS) model.
In the context of cloud computing, PaaS provides a platform allowing customers to develop, run, and manage applications without the complexity of building and maintaining the infrastructure typically associated with developing and launching an app. Moving to a PaaS vendor involves various security considerations because the organization will be relying on third-party services for critical aspects of its application infrastructure.
The question implies that Ben needs to assess the security implications of this move comprehensively. The most crucial security consideration in such a scenario could involve a range of factors, including but not limited to:
Data Security and Privacy: Ensuring that the PaaS provider has robust mechanisms in place to protect the organization’s data against unauthorized access, breaches, and leaks. This includes encryption of data at rest and in transit, as well as adherence to privacy laws and regulations relevant to the organization’s operations.
Compliance with Relevant Regulations and Standards: Verifying that the PaaS provider complies with industry-specific regulations and standards (such as GDPR for data protection, HIPAA for healthcare information, or PCI DSS for payment card information) that the organization is subject to.
Cost of hosting the application externally compared to on-premises
Cost is an essential factor for the business to consider when moving to the cloud. However, the significant risk is with laws and regulations pertaining to data privacy laws.
Vendor reputation on the market and references from clients
A vendor’s reputation on the market and references from the client are essential factors for an organization to consider when moving to the cloud. However, the significant risk is violating laws and regulations related to data hosting.
Degradation of application performance due to use of shared services
Degradation of application performance due to shared services is an essential factor for an organization to consider during the move to the cloud. However, the highest risk is violating laws and regulations related to data hosting.
Cloud Computing
7111.08
7221.35
Cloud computing provides computer services and information without requiring a specific location or computing infrastructure. Which of the following is an example of a public cloud?
Google Compute Engine
A public university
A local municipality
IBM
Google Compute Engine
Google Compute Engine
Google Compute Engine is an example of a public cloud. Public clouds are services offered over the internet. Customers pay through advertisements or the resources that they consume.
The other answer choices are incorrect because public universities, local municipalities, and private businesses (such as IBM) are examples of private clouds.
Cloud Computing
Relevant Terms
Cloud
Cloud Computing
Reference
7111.13
Ensuring system reliability is a top management issue. To successfully implement systems reliability principles, management must do all of the following except:
design and employ appropriate and cost-beneficial control procedures to implement the policies.
effectively communicate policies to all employees, customers, suppliers, and other authorized users.
monitor the system and take corrective action to maintain compliance with policies.
develop and document a comprehensive set of control policies at the same time that specific control procedures are designed and implemented.
develop and document a comprehensive set of control policies at the same time that specific control procedures are designed and implemented.
Correct
The correct answer is “develop and document a comprehensive set of control policies at the same time that specific control procedures are designed and implemented.” To successfully implement systems reliability principles, a company must develop and document a comprehensive set of control policies before (not at the same time as) designing and implementing specific control procedures.
The other answer choices are incorrect because they are all control procedures that are part of system reliability principles:
Effectively communicate policies to all employees, customers, suppliers, and other authorized users.
Design and employ appropriate and cost-beneficial control procedures to implement the policies.
Monitor the system and take corrective action to maintain compliance with policies.
Extra in Deck 90
Relevant Terms
Reliability
Reference
7113.38
Jennifer, an auditor, is reviewing a hardware maintenance program. Which of the following should Jennifer assess?
The schedule of all unplanned maintenance
Whether it follows historical trends
Approval of the IT steering committee
Conformity with vendor maintenance specifications
Conformity with vendor maintenance specifications
A hardware maintenance schedule should be validated against vendor-provided specifications.
- It is not possible to schedule unplanned maintenance.
- It is not necessary to follow historical trends when developing hardware maintenance programs.
- IT steering committees do not generally approve maintenance schedules.
Cloud Computing
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) studies internal controls. They have defined internal controls to be used by boards of directors, management, and those following their direction. Which of the following is not a control objective of COSO?
Effectiveness and efficiency of operations
Reliability of financial reporting
Compliance with applicable laws and regulations
Guidance for evaluating external review programs
Guidance for evaluating external review programs
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) defines internal controls within its framework as a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:
1.Effectiveness and efficiency of operations: This includes the use of the entity’s resources.
2.Reliability of financial reporting: This involves the preparation of reliable financial statements.
3.Compliance with applicable laws and regulations.
“ORC” Cloud Computing and COSO
Relevant Terms
Control Objective
COSO
Effectiveness
Efficiency
Internal Control
Reliability
Reference
7111.14
What is the best definition of cloud computing?
It allows users to access network resources from remote locations through a virtual private network.
It streamlines business processes onto a well-secured and highly available in-house e-commerce platform to optimize customers’ online experience.
It is designed for rapid application deployment by making several virtual servers run on one physical host.
It allows organizations to use the internet to access and use services and applications that run on remote third-party technology infrastructure.
It allows organizations to use the internet to access and use services and applications that run on remote third-party technology infrastructure.
Cloud computing is best defined as a model that enables organizations to use the internet to access and use services and applications that run on remote third-party technology infrastructure. Cloud computing provides shared resources, software, and information to users as a metered service run on a remote third-party infrastructure via the internet. This definition captures the essence of cloud computing.
It streamlines business processes onto a well-secured and highly available in-house e-commerce platform to optimize customers’ online experience.
This description focuses on streamlining business processes on an in-house platform and optimizing customer experiences, which is not the primary definition of cloud computing.
It is designed for rapid application deployment by making several virtual servers run on one physical host
This option describes virtualization and server deployment but does not capture the full scope of cloud computing.
It allows users to access network resources from remote locations through a virtual private network
This option mentions accessing network resources through a virtual private network, which is not the core concept of cloud computing.
Cloud Computing
Relevant Terms
Application
Cloud Computing
Software
Reference
7111.08
7111.09
7111.10
7111.11
7111.12
What is the most significant reason to create and maintain an asset inventory?
Help the organization to manage software assets
Monitor software licenses to protect against potential lawsuits over unlicensed assets
Allocate operating costs of assets to specific business areas
Protect the assets from internal and external threats
Protect the assets from internal and external threats
The most significant reason to create and maintain an asset inventory is to protect the assets from internal and external threats. Asset inventory allows an organization to have a comprehensive understanding of what assets it owns, where they are located, how they are used, and how they are protected. This information is crucial for implementing effective security measures to safeguard assets against threats, such as cyber attacks, theft, misuse, and unauthorized access.
While managing software assets, monitoring software licenses, and allocating operating costs of assets to specific business areas are important benefits of asset inventory, these activities primarily support operational efficiency, compliance, and financial management. The overarching goal of asset inventory in the context of cybersecurity and asset protection is to ensure that all assets are accounted for, evaluated for vulnerabilities, and adequately protected from potential security threats. This proactive approach to security management helps minimize risk and ensures the integrity, confidentiality, and availability of an organization’s critical assets.
Monitor software licenses to protect against potential lawsuits over unlicensed assets
To effectively monitor software for licensing issues, the organization first needs to create the list of assets. in a IT asset inventory. Cart before the horse.
Help the organization to manage software assets
IT asset inventory helps to manage both hardware and software assets in the organization.
They have left out half.
Allocate operating costs of assets to specific business areas
Allocate operating costs of assets to specific business areas.
This is a secondary advantage.
IT Asset Management
7111.17
7111.18
7111.19
What is the difference between SaaS, PaaS, and IaaS?
Key Differences:
- Control and Flexibility: IaaS offers the most control and flexibility over your environment, followed by PaaS, with SaaS offering the least. This is because IaaS provides the infrastructure components, PaaS adds platform and development tools, and SaaS delivers the entire application stack.
- Management Responsibility: With SaaS, the provider manages everything. PaaS requires users to manage applications and data, whereas IaaS users also need to manage middleware, runtime, and the OS.
- Use Cases: SaaS is ideal for standard applications like email or collaboration tools; PaaS is suited for application development and deployment scenarios; IaaS is targeted at businesses looking for full control over their infrastructure without the costs associated with physical hardware.
What is the primary function of a server in a computer network?
Data encryption
Video editing
Data transmission
Resource sharing
Resource sharing
Servers are primarily used for resource sharing, allowing multiple users to access and utilize shared resources and services in a networked environment.
The primary function of a server in a computer network is to provide services to other computers or devices on the network, known as clients. These services can vary widely depending on the type of server, but generally, they include sharing data, resources, and applications. Servers are designed to process requests from clients and deliver the requested resources or data back to them. This can include serving web pages, handling email traffic, managing databases, providing file storage, executing applications, and facilitating various forms of communication and data exchange between clients.
Servers are powerful computers or computer programs that run continuously and are optimized for their specific tasks, offering high performance, reliability, and scalability to support the needs of multiple clients simultaneously. They play a crucial role in the infrastructure of both local and wide area networks, including the internet, enabling the centralized management of resources and services, which enhances efficiency, security, and control over the networked environment.
Data encryption
While servers can play a role in data encryption as part of security measures, it is not their primary function. Encryption is a specific task aimed at securing data during transmission or storage.
Video editing
Servers are generally not designed for video editing. Video editing is a resource-intensive task often carried out on specialized workstations or computers equipped with high-performance hardware and software.
Data transmission
Servers facilitate data transmission, but this is not their primary purpose. They are responsible for storing, managing, and serving data and resources to clients in a network. Data transmission is a function they support but not their core function.
IT Infrastructure
Relevant Terms
Network
Reference
7111.04
What is the primary purpose of network infrastructure components such as switches and wireless access points (WAP)?
Data storage and backup
Data management
Resource optimization
Establishing connections and facilitating data transmission
Establishing connections and facilitating data transmission
Network infrastructure components (such as switches, routers, firewalls, and wireless access points (WAP)) primarily establish connections between various devices and servers for communication and data sharing. They also facilitate smooth and swift data transmission between connected entities.
Switches are used to connect multiple devices on a wired network, enabling them to communicate and share resources efficiently. They operate at the data link layer (Layer 2) of the OSI model and can also perform some routing functions (Layer 3) in the case of multilayer switches. Switches determine the destination of each data packet and forward it to the appropriate device on the network, using MAC addresses to process and route the data accurately.
Wireless Access Points (WAP) extend the wired network to wireless devices, allowing them to connect to the network without physical cables. WAPs operate by creating a local wireless network, usually based on Wi-Fi technology, enabling mobile devices, laptops, and other wireless-capable devices to access network resources and the internet.
Both switches and WAPs are crucial for establishing network connections and facilitating the efficient transmission of data between devices within a network, supporting communication and access to shared resources, applications, and the internet.
- Data storage and backup are functions typically associated with storage systems and backup solutions, not network infrastructure components.
- Data management involves organizing, storing, and retrieving data, which is a different aspect of IT.
- Resource optimization, particularly in virtualization, is a separate concept and not the primary purpose of network infrastructure components.
IT Infrastructure
Relevant Terms
Data
Network
Reference
7111.05
Which component of the COSO Internal Control Framework is responsible for developing policies and procedures to govern cloud computing services?
Risk assessment
Control environment
Information and communication
Control activities
Control activities
Control activities are responsible for developing policies and procedures to govern cloud computing services, including data protection policies, access control procedures, and incident response plans. They also oversee implementing control activities like encryption, multifactor authentication, and security assessments in cloud computing.
The component of the COSO Internal Control Framework responsible for developing policies and procedures to govern cloud computing services is Control Activities. Control activities are the policies and procedures that help ensure management directives are carried out. They aim to prevent or detect and correct errors or irregularities. This includes a broad range of activities such as approvals, authorizations, verifications, reconciliations, performance reviews, security of assets, and segregation of duties.
Control environment
The control environment within the COSO Internal Control—Integrated Framework focuses on ethical values, integrity, oversight by the board of directors, organizational structure, and human resource policies. It ensures that personnel involved in cloud computing adhere to ethical values and demonstrate integrity, especially when handling sensitive data in the cloud. While it is important for overall governance, it does not specifically deal with developing policies and procedures for cloud computing services.
Risk assessment
Risk assessment involves identifying potential risks associated with cloud computing, analyzing them, and developing strategies to respond to them. It is crucial for understanding and managing risks but does not directly address the development of policies and procedures.
Information and communication
The information and communication component deals with mechanisms for communicating with external parties, such as cloud service providers and internal parties, to ensure that personnel know policies, procedures, and risks associated with cloud computing. While essential for cloud governance, this component is more focused on communication and awareness than on developing policies and procedures.
Cloud Computing
Relevant Terms
Cloud Computing
Control Activities
COSO
Internal Control
Reference
7111.14
Authorities
COSO Internal Control - Integrated Framework
