Which of the following configuration change controls is acceptable to a cloud auditor?

Question

Options

• ADevelopment, test and production are hosted in the same network environment.
• BProgrammers have permanent access to production software.
• CThe Head of Development approves changes requested to production.
• DProgrammers cannot make uncontrolled changes to the source code production version.

• A
  17% (4)
• B
  8% (2)
• C
  4% (1)
• D
  71% (17)

Explanation

Option D is correct because a fundamental principle of change control is that programmers must be prevented from making uncontrolled, unauthorized changes to production source code - this ensures all changes go through an approval, testing, and auditing process, which is exactly what a cloud auditor looks for.

Why the distractors fail:

• A violates environment separation: dev, test, and production must be isolated to prevent accidental or malicious contamination of live systems.
• B is a critical red flag - permanent production access for programmers bypasses change control entirely and creates an unacceptable risk of unauthorized modifications.
• C sounds plausible but is wrong because the Head of Development has a conflict of interest; production change approvals should come from an independent authority (e.g., a Change Advisory Board or operations manager), not the development chain of command.

Memory tip: Think "S.O.D." - Separation of Duties and Environments. Auditors always check that developers can't touch production uncontrolled, that environments are isolated, and that approvers are independent of the team making changes. Any answer that blurs these lines is wrong.

No community discussion yet for this question.