Certified Information Systems Auditor (CISA) — Question 1267

A configuration management audit identified that predefined automated procedures are used when deploying and configuring application infrastructure in a cloud-based environment. Which of the following is MOST important for the IS auditor to review?

Answer options

• A. Contracts of vendors responsible for maintaining provisioning tools
• B. Number of administrators with access to cloud management consoles
• C. Processes for making changes to cloud environment specifications
• D. Storage location of configuration management documentation

Correct answer: C

Explanation

The correct answer is C because reviewing the processes for changing cloud environment specifications ensures that any modifications are controlled and documented, which is crucial for maintaining compliance and security. Options A and D, while important, do not directly impact the deployment and configuration processes. Option B is relevant but does not address the procedural integrity of the cloud environment as effectively as option C.