Domain 4: Compliance and Audit Management Flashcards
__________ existing regulation were written to account for virtualized environments or cloud deployments.
A. Most
B. No
C. Few
D. All
Answer: C
See page 54 of the CSA Cloud Security Guidance v4. Laws (and lawmakers) typically lag several years behind technological innovation and evolution.
Which aspects of cloud computing make traditional audit approaches difficult [select two]?
A. resiliency
B. virtualized
C. self-service
D. metered service
E. distributed
F. physical
Answer: B and E
Because cloud computing resources are typically virtualized and distributed, traditional audit approaches may not be applicable. See page 54 of the CSA Cloud Security Guidance v4.
The self-service, resilient, and metered service aspects of cloud computing do not generally affect audit methodologies. Cloud computing services are not typically “physical” in the manner of traditional IT environments; this is the opposite of the correct answer.
Audits typically may be __________ or __________.
A. fast or slow
B. internal or external
C. nocturnal or diurnal
D. legal or illegal
Answer: B
Typically, organizations might choose internal or external audits, or both.
The speed or hour that audits take place are not typically used to distinguish types of audits. Audits should not be illegal.
In the cloud computing model, who is ultimately responsible for the ensuring customer compliance with a given standard/regulation?
A. the cloud provider
B. the cloud customer
C. the regulator
D. the data subject
Answer: B
The cloud customer is ultimately (legally) responsible for ensuring compliance with a given standard/regulation/law. See page 55 of the CSA Cloud Security Guidance v4.
The provider may perform some compliance actions on behalf of the customer, but the customer retains legal liability/responsibility. Regulators enforce and monitor compliance, but are not ultimately responsible for a customer’s compliance. The data subject is not responsible for compliance.
Cloud customers will typically have to rely on __________ in order to understand a provider’s compliance alignment and gaps.
A. regulator reports
B. public news articles
C. personal investigation
D. third-party attestations
Answer: D
The cloud customer is generally not allowed to perform their own audit of a cloud provider’s environment, and probably should not trust the provider’s self-reporting (as it is inherently biased), so third-party attestation is perhaps the sole method of ensuring compliance in the cloud. See page 56 of the CSA Cloud Security Guidance v4.
Customers also cannot rely on regulators to perform this function on their behalf, nor the efforts of news media.
Alice is the security manager for a mid-sized retail. Alice’s company contracts with a cloud provider for an IaaS environment, then builds an environment of virtual servers and an application to allow clientele to perform online ordering and credit card payment. The cloud provider has documentation proving that the provider is currently compliant with the Payment Card Industry Data Security Standard (PCI-DSS).
What is the term used to describe the relationship between Alice’s company and the provider, in terms of PCI-DSS compliance?
A. compliance inheritance
B. nonregulated inversion
C. regulatory capture
D. essential proffering
Answer: A
This is the definition of compliance inheritance, also known as a pass-through audit. See page 56 of the CSA Cloud Security Guidance v4.
Regulatory capture is the term used to describe conflicts of interest in relationships between regulators and the industry they are meant to regulate. The other two terms are meaningless in this context.
Alice is the security manager for a mid-sized retail. Alice’s company contracts with a cloud provider for an IaaS environment, then builds an environment of virtual servers and an application to allow clientele to perform online ordering and credit card payment. The cloud provider has documentation proving that the provider is currently compliant with the Payment Card Industry Data Security Standard (PCI-DSS).
Who is responsible for ensuring that Alice’s company’s virtual machines and application are compliant with PCI-DSS?
A. the PCI Council
B. Alice’s company
C. the cloud provider
D. Alice’s ISP
Answer: B
The cloud customer remains responsible for regulatory compliance of their own environment/app when using inherited compliance/pass-through audits in the cloud. See page 56 of the CSA Cloud Security Guidance v4.
Which of the following is not typically used for third-party attestation in the cloud?
A. the General Data Protection Regulation (GDPR) of the European Union (EU)
B. the Certified Information System Security Professional (CISSP) certification from ISC2
C. the Payment Card Industry Data Security Standard (PCI DSS)
D. the System and Organization Controls (SOC) reports of the American Institute of Certified Public Accountants (AICPA)
Answer: B
The CISSP is a certification for personnel, not cloud providers. All the others are often used as third-party attestations for pass-through compliance in the cloud. See page 56 of the CSA Cloud Security Guidance v4.
Why is it crucial for cloud customers to understand the scope and limitations of each certification, audit, and attestation report offered by the cloud provider?
A. the customer may determine those are insufficient, and decide to perform their own audit of the cloud provider’s data center
B. some audits may be illegal in the customer’s jurisdiction
C. not all features and services within a given cloud provider are necessarily compliant and certified/audited with respect to all regulations and standards
D. the cloud provider may intend to deceive the customer, and the customer must protect themselves
Answer: C
See page 57 of the CSA Cloud Security Guidance v4.
Customers will not typically be allowed to audit cloud data centers. Audits are not illegal in any jurisdiction I am aware of. Cloud providers do not typically try to deceive customers.
Which of the following is not typically included in an audit report?
A. vendor list for remediations
B. identified issues
C. compliance determination
D. risks
Answer: A
Auditors should, in general, not make vendor recommendations, as that creates the appearance of conflict of interest.
All the other responses are elements included in most audit reports. See page 57 of the CSA Cloud Security Guidance v4.
Audit management typically includes all of the following activities except __________.
A. determining requirements
B. scoping
C. scheduling
D. payment
Answer: D
Payment is typically an accounting function, not usually included in audit management.
All the other responses are functions of audit management. See page 57 of the CSA Cloud Security Guidance v4.
Prospective cloud customers may have to submit __________ in order to gain access to audit reports.
A. payment
B. a surety bond
C. a non-compete statement
D. a non-disclosure agreement
Answer: D
Audit reports may contain sensitive information about the target’s IT environment and/or security measures. See page 58 of the CSA Cloud Security Guidance v4.
Prospective customers should not have to pay to see audit results, and generally are not entering the same market as the provider, so the other answers are incorrect.
If the customer wants to performer certain types of audits/assessments, they might require permission from the cloud provider. This is to distinguish the audit/assessment from __________.
A. competitive influence
B. an attack
C. an internal activity
D. normal customer operations
Answer: B
Some types of audits/assessments (such as vulnerability scans or penetration tests) may be mistaken for an attack if not coordinated with the provider in advance. See page 58 of the CSA Cloud Security Guidance v4.
“Competitive influence” suggests another cloud provider reviewing the target; this would be a form of attack, and B is the better, more general answer. The provider should be able to determine if a particular activity is internal or part of normal customer operations without prior coordination.
What is the term typically used to describe the documents, logs, and other materials used in an audit?
A. stipulations
B. data
C. artifacts
D. ramifications
Answer: C
See page 58 of the CSA Cloud Security Guidance v4.
Compliance, audit, and assurance should be __________.
A. entertaining
B. expensive
C. continuous
D. remote
Answer: C
See page 59 of the CSA Cloud Security Guidance v4.
Not all audits are entertaining, expensive, or remote (some are done on-site, most are dull, and a few are affordable).
