Exam CCAK topic 1 question 191 discussion

C. The audit logs are overwritten every 30 days, and all past audit trail is lost. Losing logs every 30 days means no forensic capability, no evidence for incidents, no ability to prove compliance, no ability to reconstruct events SaaS customer often cannot directly access low-level logs. SaaS customer often cannot directly access low-level logs. Logs are typically low-sensitivity compared to production data, encryption issues are not as catastrophic as permanent log loss

C. The audit logs are overwritten every 30 days, and all past audit trail is lost. The greatest concern for the auditor should be the fact that audit logs are overwritten every 30 days, leading to the loss of past audit trails. This issue poses a significant risk to accountability, traceability, and compliance, as maintaining a historical record of events is crucial for forensic investigations, monitoring, and compliance with regulatory requirements. Without adequate retention of audit logs, the organization may be unable to detect or respond to security incidents effectively, and it could face challenges in demonstrating compliance during audits. While options A, B, and D present concerns, they do not pose as immediate and critical a risk as the complete loss of audit trails due to short retention periods.

Answer is C

CCAK P# 197 Cloud infrastructures are rapidly evolving, and new concepts and technologies, such as serverless, are being adopted. Serverless technologies have redefined the attribution of the security responsibilities between IaaS and PaaS and SaaS, and between the CSP and customer. Following are examples of measures an organization should have in place to mitigate the risk related to infrastructure and virtualization management. Establish, implement, enforce and maintain policies and procedures to ensure the security, retention and access control of audit logs. Continuously monitor security audit logs to detect anomalies, and take appropriate action. Monitor, encrypt and restrict communications between environments to authenticated and authorized connections.