Page traduite et vérifiée automatiquement. La version anglaise fait foi.Certaines parties restent en anglais le temps que leur traduction soit vérifiée.Voir en anglais · Signaler une erreur de traduction
What is the auditor's concern about shadow IT in the cloud?
Cloud services adopted without approval skip risk assessment, contract review, security controls and monitoring, so the organization cannot show it governs the data placed in them. The customer stays accountable for its data whether or not a service was approved. The concern is missing oversight, not the quality of the provider's infrastructure, and cost misallocation is a finance issue rather than the main audit risk.
Question 2 of 10 · Cloud Compliance Program
What is a compliance concern with subprocessors?
Subprocessors are fourth parties that may store or process the customer's data, yet the customer has no direct contract with them, so it must rely on the provider to flow down obligations and disclose changes. Subprocessors are usually bound through the provider's contracts, not the customer's. Data protection laws such as the GDPR expressly cover subprocessors, and many subprocessors do have access to customer data.
Question 3 of 10 · CCM and CAIQ: Goals, Objectives and Structure
What does the Cloud Controls Matrix provide?
The Cloud Controls Matrix is CSA's control framework for cloud computing, organized into domains and mapped to standards such as ISO/IEC 27001 and NIST frameworks. The provider self-assessment questionnaire is the CAIQ. The public registry is the STAR program, and the auditor credential is the CCAK.
Question 4 of 10 · A Threat Analysis Methodology for Cloud Using CCM
What does a cloud threat analysis using the CCM identify?
A CCM-based threat analysis lists relevant cloud threats, maps each to the CCM controls that mitigate it, and shows where no adequate control exists. It does not predict breach likelihood for a specific provider. Finding workload vulnerabilities needs scanning or testing, and annualized loss expectancy is a quantitative risk calculation that needs financial data.
Question 5 of 10 · Evaluating a Cloud Compliance Program
What is a limitation of evaluating a program at one point in time?
Point-in-time evaluation can miss later drift, which continuous assurance addresses.
Question 6 of 10 · Cloud Auditing
What should a cloud audit report include about limitations?
The audit report must disclose scope limitations and areas not tested, such as provider controls that could not be assessed, so readers do not assume assurance that was never given. Reporting only high-rated findings leaves out information users need. Disclosure of limitations does not depend on the auditee's agreement, and keeping them only in the working papers hides them from report users.
Question 7 of 10 · CCM: Auditing Controls
What does testing operating effectiveness confirm?
Testing operating effectiveness confirms that the control worked as intended, consistently, across the whole period under review. Whether it is suitably designed is a test of design effectiveness, done first. A named owner supports the control but is not proof it operated, and being in place on one date is a point-in-time check.
Question 8 of 10 · Continuous Assurance and Compliance
What does continuous monitoring provide auditors?
Continuous monitoring produces a record of control status across the whole period, which helps the auditor judge operating effectiveness over time rather than at a single moment. Auditors still validate the tooling and perform their own procedures. Monitoring shows whether controls meet set conditions, not whether those conditions are well designed, and certification lists come from registries such as STAR.
Question 9 of 10 · STAR Program
Why should a customer not treat a STAR entry as a guarantee?
A STAR entry describes the provider's controls, so it says nothing about how the customer has configured its services or about the customer's own risks and obligations under the shared responsibility model. STAR does not certify a breach-free history. STAR entries cover IaaS, PaaS and SaaS providers, and the customer's obligations remain the customer's to meet.
Question 10 of 10 · Cloud Governance
Who is accountable for cloud risk decisions?
Risk decisions belong to the business owner who is accountable for the service or data, with security advising on the risk and its treatment. The provider is responsible for its share of controls but not for the customer's risk acceptance. The CISO advises and oversees but does not own every business risk, and an external auditor must stay independent of the decisions it audits.
0 of 10
Cloud Governance
Cloud Compliance Program
CCM and CAIQ: Goals, Objectives and Structure
A Threat Analysis Methodology for Cloud Using CCM
Evaluating a Cloud Compliance Program
Cloud Auditing
CCM: Auditing Controls
Continuous Assurance and Compliance
STAR Program
Which domains cost you the points? Members see a breakdown by domain and a study plan built from it.