Which of the following approaches encompasses social engineering of staff, bypassing of physical access controls and penetration testing?

An IS auditor is a member of an application development team that is selecting software. Which of the following would impair the auditor's independence?

In all three cloud deployment models, (IaaS, PaaS, and SaaS), who is responsible for the patching of the hypervisor layer?

A CSP contracts for a penetration test to be conducted on its infrastructures. The auditor engages the target with no prior knowledge of its defenses, assets, or channels. The CSP's security operation center is not notified in advance of the scope of the audit and the test vectors. Which mode is selected by the CSP?

Which of the following is a perceived advantage or disadvantage of managing enterprise risk for cloud deployments?