CCAK Leak Questions

The auditor’s next course of action should be to review the contract and DR capability of the cloud service provider. The contract should specify the roles and responsibilities of both parties regarding disaster recovery, as well as the service level agreements (SLAs) and recovery time objectives (RTOs) for the critical application. The DR capability should demonstrate that the cloud service provider has a plan that is aligned with the organization’s requirements and expectations, and that it is tested annually and validated by independent auditors. The auditor should also verify that the organization has a process to monitor and review the cloud service provider’s performance and compliance with the contract and SLAs.

Planning an audit of the provider (B) may not be feasible or necessary, as the auditor may not have access to the provider’s environment or data, and may not have the authority or expertise to conduct such an audit. The auditor should rely on the provider’s audit reports and certifications to assess their compliance with relevant standards and regulations.

Reviewing the security white paper of the provider © may not be sufficient or relevant, as the security white paper may not cover the specific aspects of disaster recovery for the critical application, or may not reflect the current state of the provider’s security controls and practices. The security white paper may also be biased or outdated, as it is produced by the provider themselves.

Reviewing the provider’s audit reports (D) may be helpful, but not enough, as the audit reports may not address the specific requirements and expectations of the organization for disaster recovery, or may not cover the latest changes or incidents that may affect the provider’s DR capability. The audit reports may also have limitations or qualifications that may affect their reliability or validity. References :=

Audit a Disaster Recovery Plan | AlertFind

ISACA Introduces New Audit Programs for Business Continuity/Disaster …

How to Maintain and Test a Business Continuity and Disaster Recovery Plan

Rotating cryptographic keys regularly is a security best practice that helps to mitigate the risk of unauthorized access to encrypted data. When keys are rotated, old keys are retired and replaced with new ones, making any compromised keys useless to an attacker. This process helps to limit the time window during which a stolen key can be used to breach data. Key rotation is a fundamental aspect of key management lifecycle best practices, which include generating new key pairs, rotating keys at set intervals, revoking access to keys, and destroying out-of-date or compromised keys.

References = The importance of key rotation is supported by various security standards and best practices, including recommendations from the National Institute of Standards and Technology (NIST)1 and the Cloud Security Alliance (CSA)23. These sources emphasize the need for periodic renewal and decommissioning of old keys as part of a comprehensive key management strategy.

 According to the ISACA Cloud Auditing Knowledge Certificate Study Guide, the primary objective for an auditor to understand the organization’s context for a cloud audit is to validate an understanding of the organization’s current state and how the cloud audit plan fits into the existing audit approach1. The auditor should consider the organization’s business objectives, strategies, risks, and opportunities, as well as the regulatory and contractual requirements that apply to the organization’s use of cloud services. The auditor should also assess the organization’s cloud maturity level, governance structure, policies and procedures, roles and responsibilities, and existing controls related to cloud services. The auditor should then align the cloud audit plan with the organization’s context and ensure that it covers the relevant scope, objectives, criteria, and methodology.

The other options are not the primary objective for an auditor to understand the organization’s context for a cloud audit. Option A is a possible audit procedure, but not the main goal of understanding the organization’s context. Option C is a possible audit outcome, but not the main purpose of understanding the organization’s context. Option D is a possible audit finding, but not the main reason for understanding the organization’s context. References:

ISACA Cloud Auditing Knowledge Certificate Study Guide, page 12-13.