Isaca Updated CCAK Exam Questions and Answers by inara

When auditing a public cloud, it is essential to review areas such as Identity and Access Management (IAM) and data protection. IAM involves ensuring that only authorized individuals have access to the cloud resources, and that their access is appropriately managed and monitored. This includes reviewing user authentication methods, access control policies, role-based access controls, and user activity monitoring1.

Data protection is another critical area to review. It involves ensuring that the data stored in the public cloud is secure from unauthorized access, breaches, and leaks. This includes reviewing data encryption methods, data backup and recovery processes, data privacy policies, and compliance with relevant data protection regulations1.

While the other options may also be relevant in certain contexts, they are not as universally applicable as IAM and data protection for auditing a public cloud. Source code reviews and hypervisor (option B), patching and configuration (option C), and vulnerability management and cybersecurity reviews (option D) are important but are more specific to certain types of cloud services or deployment models. References:

Cloud Computing — What IT Auditors Should Really Know - ISACA

The Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing that can be used by cloud customers to build an operational cloud risk management program. The CCM provides guidance on which security controls should be implemented by which actor within the cloud supply chain, and maps the controls to industry-accepted security standards, regulations, and frameworks. The CCM can help cloud customers to assess the security posture of their cloud service providers, document their own responsibilities and requirements, and establish a baseline for cloud security assurance and compliance. References :=

Cloud Controls Matrix (CCM) - CSA1

What is the Cloud Controls Matrix (CCM)? - Cloud Security Alliance2

Certificate of Cloud Auditing Knowledge (CCAK) Study Guide, Chapter 5: Cloud Assurance Frameworks

ISO/IEC 27017:2015 is a standard that provides guidelines for information security controls applicable to the provision and use of cloud services by providing additional implementation guidance for relevant controls specified in ISO/IEC 27002, as well as additional controls with implementation guidance that specifically relate to cloud services1. ISO/IEC 27017:2015 is designed to be used by organizations for cloud services that intend to select controls within the process of implementing an information security management system based on ISO/IEC 27001, which is the international standard for information security management systems1. ISO/IEC 27017:2015 can help organizations to establish, implement, maintain and continually improve their information security in the cloud environment, as well as to demonstrate compliance with contractual and legal obligations1.

ISO/IEC 27002 is a code of practice for information security controls that provides best practice recommendations on information security management for use by those who are responsible for initiating, implementing or maintaining information security management systems2. However, ISO/IEC 27002 does not provide specific guidance for cloud services, which is why ISO/IEC 27017:2015 was developed as an extension to ISO/IEC 27002 for cloud services1.

Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) is a set of security controls that provides organizations with a detailed understanding of security concepts and principles that are aligned to the cloud model. The CCM is not a standard, but rather a framework that can be used to assess the overall security risk of a cloud provider. The CCM can also be mapped to other standards, such as ISO/IEC 27001 and ISO/IEC 27017:2015, to facilitate compliance and assurance activities.

NIST SP 800-146 is a publication from the National Institute of Standards and Technology (NIST) that provides an overview of cloud computing, its characteristics, service models, deployment models, benefits, challenges and considerations. NIST SP 800-146 is not a standard, but rather a reference document that can help organizations to understand the basics of cloud computing and its implications for information security. NIST SP 800-146 does not provide specific guidance or controls for cloud services, but rather refers to other standards and frameworks, such as ISO/IEC 27001 and CSA CCM, for more detailed information on cloud security. References :=

ISO/IEC 27017:2015 - Information technology — Security techniques …

ISO/IEC 27017:2015(en), Information technology ? Security techniques …

ISO 27017 Certification - Cloud Security Services | NQA

An introduction to ISO/IEC 27017:2015 - 6clicks

ISO/IEC 27017:2015 - Information technology — Security techniques …

[Cloud Controls Matrix | Cloud Security Alliance]

[NIST Cloud Computing Synopsis and Recommendations]

To qualify for CSA STAR attestation, the SOC 2 report must cover both the Cloud Controls Matrix (CCM) and ISO/IEC 27001:2013 controls. The CSA STAR Attestation integrates SOC 2 reporting with additional cloud security criteria from the CSA CCM. This combination provides a comprehensive framework for assessing the security and privacy controls of cloud services, ensuring that they meet the rigorous standards required for STAR attestation. References = The information is supported by the Cloud Security Alliance’s resources, which outline the STAR program’s emphasis on transparency, rigorous auditing, and harmonization of standards as per the CCM. Additionally, the CSA STAR Certification process leverages the requirements of the ISO/IEC 27001:2013 management system standard together with the CSA Cloud Controls Matrix