Certificate of Cloud Auditing Knowledge v1.0

An independent contractor is assessing security maturity of a SaaS company against industry standards. The SaaS company has developed and hosted all their products using the cloud services provided by a third-party cloud service provider (CSP). What is the optimal and most efficient mechanism to assess the controls CSP is responsible for?

What areas should be reviewed when auditing a public cloud?

Which of the following key stakeholders should be identified the earliest when an organization is designing a cloud compliance program?

Which of the following CSP activities requires a client’s approval?

A cloud service provider does not allow audits using automated tools as these tools could be considered destructive techniques for the cloud environment. Which of the following aspects of the audit will be constrained?

An organization has an ISMS implemented, following ISO 27001 and Annex A controls. The CIO would like to migrate some of the infrastructure to the cloud. Which of the following standards would BEST assist in identifying controls to consider for this migration?

An organization is in the initial phases of cloud adoption. It is not very knowledgeable about cloud security and cloud shared responsibility models. Which of the following approaches is BEST suited for such an organization to evaluate its cloud security?

Which of the following controls framework should the cloud customer use to assess the overall security risk of a cloud provider?

Which of the following aspects of risk management involves identifying the potential reputational harm and/or financial harm when an incident occurs?

When using a SaaS solution, who is responsible for application security?

Which of the following would be the GREATEST governance challenge to an organization where production is hosted in a public cloud and backups are held on the premises?

What aspect of SaaS functionality and operations would the cloud customer be responsible for and should be audited?

The Open Certification Framework is structured on three levels of trust. Those three levels of trust are:

Which of the following is a fundamental concept of FedRAMP that intends to save costs, time, and staff conducting superfluous agency security assessments?