CCAK: Certificate of Cloud Auditing Knowledge

By Isaca · Question Mode

QuestionQ54

VerifiedCloud Auditing

A cloud service provider contracts for a penetration test of its infrastructure. The auditor engages the target without prior knowledge of its defenses, assets, or channels. The provider's security operations center is not notified beforehand of the audit's scope and test vectors.

Which mode has the provider selected?

Explanation

A double-blind test combines limited prior knowledge for the tester with no advance disclosure of the test details to the defending security team. This assesses both the tester’s ability to discover weaknesses and the security team’s ability to detect and respond to an unexpected attack. (eccouncil.org)

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!