Cloud Security Knowledge CCSK Book

Auditing is an independent review process that validates adherence to policies, regulations, and standards. It is essential in assessing security posture. Reference: [Security Guidance v5, Domain 3 - Compliance][16†source].

The correct answer isD. Cloud systems automatically monitor resource usage and provide billing based on actual consumption.

Measured Service is one of theessential characteristics of cloud computingas defined by theNIST (National Institute of Standards and Technology). It implies that cloud systems automatically control and optimize resource usage by leveraging ametering capability. This capability tracks and reports resource consumption (such as CPU, storage, or bandwidth), which is used for billing, monitoring, and planning.

Key Characteristics:

Automatic Monitoring:Cloud platforms continuously track resource usage without manual intervention.

Billing Based on Usage:Customers are billed based on the actual consumption of resources (pay-as-you-go model).

Transparency:Users can view detailed usage reports to understand their resource utilization and associated costs.

Resource Optimization:Providers use these metrics to optimize resource allocation and improve efficiency.

Why Other Options Are Incorrect:

A. Fixed immutable set of measured services:This contradicts the concept of elasticity and resource pooling in cloud computing.

B. Elastic resources:While elasticity is a cloud characteristic, it does not directly define measured service.

C. Manual reporting:Measured service is aboutautomated, real-time monitoring and billing, not manual data gathering.

Real-World Example:

In AWS, services likeAmazon CloudWatchautomatically collect and provide usage metrics, and the AWS Billing Console shows the cost associated with each resource.

Cloud security control objectives are designed to provide outcome-focused guidelines that help organizations achieve specific security goals in the cloud. These objectives are typically high-level and focused on the desired security outcomes, rather than dictating the exact technical implementation methods. This allows the security measures to be adaptable and applicable across different cloud environments and service models, while also being measurable to ensure effectiveness.