What areas should be reviewed when auditing a public cloud?

The correct answer is B. Identity and access management, data protection. In a public cloud model, the cloud service provider owns and manages the physical infrastructure, hypervisor, networking, and operating system (in IaaS/PaaS/SaaS). The cloud customer's audit scope is limited to what the customer actually controls. Under the shared…

Cloud Security Auditing

Question

Options

APatching, source code reviews, hypervisor, access controls
BIdentity and access management, data protection
CPatching, configuration, hypervisor, backups
DVulnerability management, cyber security reviews, patching

How the community answered

(23 responses)

A
4% (1)
B
91% (21)
C
4% (1)

Explanation

In a public cloud model, the cloud service provider owns and manages the physical infrastructure, hypervisor, networking, and operating system (in IaaS/PaaS/SaaS). The cloud customer's audit scope is limited to what the customer actually controls. Under the shared responsibility model, customers are responsible for Identity and Access Management (IAM) and data protection - who can access what and how data is classified, encrypted, and handled. Options A, C, and D include areas like hypervisor management, patching of underlying infrastructure, and source code reviews - all of which are the CSP's responsibility and are not accessible to a customer's auditor. Auditing beyond your responsibility boundary is both impractical and outside the scope of a customer's audit rights.

Topics

#Cloud auditing#Identity and access management#Data protection#Security controls

Community Discussion

No community discussion yet for this question.

Full CCAK Practice