An IS auditor is reviewing the operational database management of an organization that uses cloud systems for hosting. Which of the following should be the auditor's PRIMARY area of focus?

The correct answer is A. Security settings configuration. When an organization hosts databases in the cloud, the primary audit concern is security settings configuration-including access controls, encryption settings, network exposure, authentication mechanisms, and patch levels. These directly determine whether data is protected from…

Submitted by priya_blr· Apr 18, 2026Information Systems Operations and Business Resilience

Question

An IS auditor is reviewing the operational database management of an organization that uses cloud systems for hosting. Which of the following should be the auditor’s PRIMARY area of focus?

Options

ASecurity settings configuration
BCloud vendor security certifications
CAuto-scaling of provisioning costs
DLarge-scale data transfers

How the community answered

(54 responses)

A
78% (42)
B
4% (2)
C
6% (3)
D
13% (7)

Explanation

When an organization hosts databases in the cloud, the primary audit concern is security settings configuration-including access controls, encryption settings, network exposure, authentication mechanisms, and patch levels. These directly determine whether data is protected from unauthorized access or breach. Cloud vendor security certifications (B) are third-party attestations that provide some assurance but do not replace direct configuration review. Auto-scaling costs (C) are operational and financial concerns. Large-scale data transfers (D) are a specific scenario that is secondary to the foundational security configuration of the database environment.

Topics

#Cloud Security#Database Security#Security Configuration#IS Audit

Community Discussion

No community discussion yet for this question.

Full CISA Practice