CompTIA Cloud+ (CV0-004)SecurityMedium
A cloud security team is establishing a baseline for security configurations across their multi-cloud environment. They need to identify deviations from established security policies, such as open storage ports, unencrypted volumes, or unpatched operating systems, to ensure continuous compliance. Which type of security audit is best suited for this ongoing, automated assessment?
- AExternal Audit
- BPenetration Test
- CFinancial Audit
- DConfiguration Audit
Show answer & explanationAnswer & explanation
Correct answer: D. Configuration Audit
A configuration audit specifically focuses on evaluating the security settings and configurations of systems and services against established baselines and policies. This type of audit is ideal for continuously identifying deviations like open ports, unencrypted volumes, or unpatched OS, ensuring ongoing compliance.
Why the other options are wrong
- A. An external audit is typically performed by independent third parties for compliance reporting, but 'configuration audit' is the specific type of audit described.
- B. A penetration test simulates an attack and is a point-in-time assessment to find exploitable vulnerabilities, not an ongoing configuration compliance check.
- C. A financial audit focuses on the accuracy of financial records and statements, which is irrelevant to security configurations.
Configuration Audit
A systematic review of security settings, configurations, and baselines to ensure compliance with established policies and identify deviations.
- Reviews system configurations
- Compares against baselines/policies
- Identifies compliance deviations
Memory trick: Configuration Audit: The detailed checklist for cloud settings.