Exam CCAK topic 1 question 181 discussion

A. Approval of the change by the change advisory board B is less likely, cuz question does not specify PII sensitive or regulated data

In the scenario described, transferring production data to a test environment introduces risks related to data privacy, security, and compliance. The most pertinent control the cloud auditor should check is: B. Explicit documented approval from all customers whose data is affected This control is essential to ensure data protection and compliance with privacy regulations. It addresses concerns related to unauthorized access or use of customer data, which could lead to breaches of confidentiality or violations of data protection laws. It is also important to ensure that any use of customer data is conducted with proper consent and transparency.

CCAK P# 191 When considering change and configuration management, following are some key questions that any cloud actor (CSP, customer or auditor) should keep in mind: • Who can request changes? Who can approve changes? • Who can develop changes? • Who can test the changes for compliance with approved specifications? • Who can move the changes into production?

Answer should be A: The cloud auditor should check for approval of the change by the change advisory board. The board ensures that changes are made in a controlled and coordinated manner, minimizing the risk of disruption to the IT service.