Which of the following would give an auditor the BEST view of design and implementation decisions when an organization uses programmatic automation for Infrastructure as a Service (IaaS)…

The correct answer is A. output from threat modeling exercises. Threat modeling exercises are the best source for understanding both design and implementation decisions in IaaS programmatic automation (e.g., Infrastructure as Code using Terraform or CloudFormation). Threat modeling outputs document the security architecture decisions - what…

Cloud Auditing for Infrastructure, Platform, and Software as a Service (IaaS, PaaS, SaaS)

Question

Which of the following would give an auditor the BEST view of design and implementation decisions when an organization uses programmatic automation for Infrastructure as a Service (IaaS) deployments? The visibility of:

Options

Aoutput from threat modeling exercises.
Bresults from automated testing.
Csource code within build scripts.
Dservice level agreements.

How the community answered

(30 responses)

A
73% (22)
B
17% (5)
C
3% (1)
D
7% (2)

Explanation

Threat modeling exercises are the best source for understanding both design and implementation decisions in IaaS programmatic automation (e.g., Infrastructure as Code using Terraform or CloudFormation). Threat modeling outputs document the security architecture decisions - what threats were identified, what mitigations were chosen, and why specific design choices were made. This provides insight into the reasoning behind implementation decisions, not just what was built. Source code in build scripts (C) shows what was implemented but not the design rationale. Automated testing results (B) confirm behavior but don't explain design intent. SLAs (D) define service commitments, not architectural decisions.

Topics

#Threat Modeling#IaaS Auditing#Design Review#Security Controls

Community Discussion

No community discussion yet for this question.

Full CCAK Practice