CCAK Question 22

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  A. Highlighting the gap to the audit sponsor at the sponsor’s earliest possible availability The study guide explicitly states that when an auditor finds a publicly readable S3 bucket containing PII, the auditor must communicate this issue to the client. Client = audit sponsor or primary audit contact, NOT the cloud administrator (technical staff) Directly fixing the issue could violate policies or introduce unintended consequences. Auditor’s responsibility is to escalate The cloud administrator is not the escalation point; they may be informed later by the client.

• Chose D2

  As auditors, we must preserve independence and avoid taking or directing management actions. The internal audit manager coordinates the urgent response with the right stakeholders (e.g., CISO, Privacy Officer/DPO, Cloud Ops, Legal/Compliance) and triggers the organization’s incident response process.

• Chose B3

  When an auditor discovers a significant security issue, such as an object storage bucket containing PII being accessible to anyone on the Internet, the priority is to ensure the issue is addressed promptly to mitigate any potential risks. The most appropriate action for the auditor to perform in this situation is: B. Asking the organization’s cloud administrator to immediately close the gap by updating the configuration settings and making the object storage bucket private and hence inaccessible from the Internet. This action directly addresses the security risk, protecting the sensitive data from unauthorized access. After ensuring that the immediate risk is mitigated, the auditor should then proceed to document the finding, inform relevant stakeholders, and include it in the audit report for further analysis and preventive measures.