Exam Bundle

An ownership review identifies each control and a backup recovery rehearsal meets the documented objective. This would be relevant evidence for a different failure: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload, usually addressed by Define workload-specific customer and provider responsibility for resilience, encryption, and recovery. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A control map reflects correct PaaS ownership and tests the customer's application controls.

An audit traces required safeguards to named customer and service-provider evidence owners. This would be relevant evidence for a different failure: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor, usually addressed by Document customer accountability for data classification, lawful processing, and chosen configurations. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A control map reflects correct PaaS ownership and tests the customer's application controls.

An unauthorized principal cannot read the data even though the underlying storage service is managed. This would be relevant evidence for a different failure: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies, usually addressed by Enforce customer-owned access controls, encryption choices, and bucket exposure policies. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A control map reflects correct PaaS ownership and tests the customer's application controls.

Enforce customer-owned access controls, encryption choices, and bucket exposure policies. That action fits another problem: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies. It does not directly remediate the current finding at Bluewater Technology: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control. The relevant corrective control for this case is: Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration.

Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities. That action fits another problem: A virtual machine owner assumes the IaaS provider patches guest operating systems. It does not directly remediate the current finding at Bluewater Technology: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control. The relevant corrective control for this case is: Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration.

Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model. That action fits another problem: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities. It does not directly remediate the current finding at Bluewater Technology: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control. The relevant corrective control for this case is: Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration.

The VM patch record shows approved guest updates while provider-owned hardware remains separately assigned. This would be relevant evidence for a different failure: A virtual machine owner assumes the IaaS provider patches guest operating systems, usually addressed by Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities. It does not demonstrate that the current problem at Bluewater Technology was resolved. The specific required evidence is: A control map reflects correct PaaS ownership and tests the customer's application controls.

An unauthorized principal cannot read the data even though the underlying storage service is managed. This would be relevant evidence for a different failure: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies, usually addressed by Enforce customer-owned access controls, encryption choices, and bucket exposure policies. It does not demonstrate that the current problem at Bluewater Technology was resolved. The specific required evidence is: A control map reflects correct PaaS ownership and tests the customer's application controls.

A responsibility matrix shows customer-owned access controls tested independently of provider infrastructure. This would be relevant evidence for a different failure: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities, usually addressed by Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model. It does not demonstrate that the current problem at Bluewater Technology was resolved. The specific required evidence is: A control map reflects correct PaaS ownership and tests the customer's application controls.

Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model. That action fits another problem: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities. It does not directly remediate the current finding at Ridgeview Finance: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload. The relevant corrective control for this case is: Define workload-specific customer and provider responsibility for resilience, encryption, and recovery.

Enforce customer-owned access controls, encryption choices, and bucket exposure policies. That action fits another problem: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies. It does not directly remediate the current finding at Ridgeview Finance: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload. The relevant corrective control for this case is: Define workload-specific customer and provider responsibility for resilience, encryption, and recovery.

Document customer accountability for data classification, lawful processing, and chosen configurations. That action fits another problem: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor. It does not directly remediate the current finding at Ridgeview Finance: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload. The relevant corrective control for this case is: Define workload-specific customer and provider responsibility for resilience, encryption, and recovery.

An audit traces required safeguards to named customer and service-provider evidence owners. This would be relevant evidence for a different failure: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor, usually addressed by Document customer accountability for data classification, lawful processing, and chosen configurations. It does not demonstrate that the current problem at Ridgeview Finance was resolved. The specific required evidence is: An ownership review identifies each control and a backup recovery rehearsal meets the documented objective.

An unauthorized principal cannot read the data even though the underlying storage service is managed. This would be relevant evidence for a different failure: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies, usually addressed by Enforce customer-owned access controls, encryption choices, and bucket exposure policies. It does not demonstrate that the current problem at Ridgeview Finance was resolved. The specific required evidence is: An ownership review identifies each control and a backup recovery rehearsal meets the documented objective.

A responsibility matrix shows customer-owned access controls tested independently of provider infrastructure. This would be relevant evidence for a different failure: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities, usually addressed by Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model. It does not demonstrate that the current problem at Ridgeview Finance was resolved. The specific required evidence is: An ownership review identifies each control and a backup recovery rehearsal meets the documented objective.

Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities. That action fits another problem: A virtual machine owner assumes the IaaS provider patches guest operating systems. It does not directly remediate the current finding at Pinecrest Research: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload. The relevant corrective control for this case is: Define workload-specific customer and provider responsibility for resilience, encryption, and recovery.

Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model. That action fits another problem: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities. It does not directly remediate the current finding at Pinecrest Research: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload. The relevant corrective control for this case is: Define workload-specific customer and provider responsibility for resilience, encryption, and recovery.

Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration. That action fits another problem: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control. It does not directly remediate the current finding at Pinecrest Research: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload. The relevant corrective control for this case is: Define workload-specific customer and provider responsibility for resilience, encryption, and recovery.

A control map reflects correct PaaS ownership and tests the customer's application controls. This would be relevant evidence for a different failure: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control, usually addressed by Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration. It does not demonstrate that the current problem at Pinecrest Research was resolved. The specific required evidence is: An ownership review identifies each control and a backup recovery rehearsal meets the documented objective.

A responsibility matrix shows customer-owned access controls tested independently of provider infrastructure. This would be relevant evidence for a different failure: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities, usually addressed by Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model. It does not demonstrate that the current problem at Pinecrest Research was resolved. The specific required evidence is: An ownership review identifies each control and a backup recovery rehearsal meets the documented objective.

The VM patch record shows approved guest updates while provider-owned hardware remains separately assigned. This would be relevant evidence for a different failure: A virtual machine owner assumes the IaaS provider patches guest operating systems, usually addressed by Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities. It does not demonstrate that the current problem at Pinecrest Research was resolved. The specific required evidence is: An ownership review identifies each control and a backup recovery rehearsal meets the documented objective.

Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model. That action fits another problem: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities. It does not directly remediate the current finding at Summit Logistics: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor. The relevant corrective control for this case is: Document customer accountability for data classification, lawful processing, and chosen configurations.

Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities. That action fits another problem: A virtual machine owner assumes the IaaS provider patches guest operating systems. It does not directly remediate the current finding at Summit Logistics: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor. The relevant corrective control for this case is: Document customer accountability for data classification, lawful processing, and chosen configurations.

Enforce customer-owned access controls, encryption choices, and bucket exposure policies. That action fits another problem: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies. It does not directly remediate the current finding at Summit Logistics: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor. The relevant corrective control for this case is: Document customer accountability for data classification, lawful processing, and chosen configurations.

An unauthorized principal cannot read the data even though the underlying storage service is managed. This would be relevant evidence for a different failure: A cloud administrator believes the provider's physical security eliminates the need to restrict object-storage policies, usually addressed by Enforce customer-owned access controls, encryption choices, and bucket exposure policies. It does not demonstrate that the current problem at Summit Logistics was resolved. The specific required evidence is: An audit traces required safeguards to named customer and service-provider evidence owners.

The VM patch record shows approved guest updates while provider-owned hardware remains separately assigned. This would be relevant evidence for a different failure: A virtual machine owner assumes the IaaS provider patches guest operating systems, usually addressed by Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities. It does not demonstrate that the current problem at Summit Logistics was resolved. The specific required evidence is: An audit traces required safeguards to named customer and service-provider evidence owners.

A responsibility matrix shows customer-owned access controls tested independently of provider infrastructure. This would be relevant evidence for a different failure: A SaaS company assumes the cloud vendor owns employee account access and fails to manage privileged tenant identities, usually addressed by Assign tenant identity configuration and access policy to the customer within the SaaS shared responsibility model. It does not demonstrate that the current problem at Summit Logistics was resolved. The specific required evidence is: An audit traces required safeguards to named customer and service-provider evidence owners.

Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration. That action fits another problem: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control. It does not directly remediate the current finding at Maple Creek Agriculture: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor. The relevant corrective control for this case is: Document customer accountability for data classification, lawful processing, and chosen configurations.

Define workload-specific customer and provider responsibility for resilience, encryption, and recovery. That action fits another problem: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload. It does not directly remediate the current finding at Maple Creek Agriculture: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor. The relevant corrective control for this case is: Document customer accountability for data classification, lawful processing, and chosen configurations.

Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities. That action fits another problem: A virtual machine owner assumes the IaaS provider patches guest operating systems. It does not directly remediate the current finding at Maple Creek Agriculture: A migration project claims purchasing cloud service automatically transfers regulatory accountability to the vendor. The relevant corrective control for this case is: Document customer accountability for data classification, lawful processing, and chosen configurations.

An ownership review identifies each control and a backup recovery rehearsal meets the documented objective. This would be relevant evidence for a different failure: An organization has multiple public cloud accounts but cannot determine who owns backup recovery for each workload, usually addressed by Define workload-specific customer and provider responsibility for resilience, encryption, and recovery. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: An audit traces required safeguards to named customer and service-provider evidence owners.

A control map reflects correct PaaS ownership and tests the customer's application controls. This would be relevant evidence for a different failure: A team deploys a managed platform runtime but takes responsibility for host hypervisor maintenance it cannot control, usually addressed by Distinguish provider-controlled PaaS infrastructure from customer-managed code, identity, data, and configuration. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: An audit traces required safeguards to named customer and service-provider evidence owners.

The VM patch record shows approved guest updates while provider-owned hardware remains separately assigned. This would be relevant evidence for a different failure: A virtual machine owner assumes the IaaS provider patches guest operating systems, usually addressed by Keep guest OS hardening, patching, and application security under the customer's IaaS responsibilities. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: An audit traces required safeguards to named customer and service-provider evidence owners.