Exam CCAK topic 1 question 32 discussion

A. Review third-party audit reports. Reviewing third-party audit reports, such as SOC 2 or ISO 27001 certification reports, is the optimal and most efficient mechanism to assess the controls that the CSP is responsible for. These reports are conducted by independent auditors and provide a comprehensive assessment of the CSP's controls, saving time and resources compared to directly auditing the CSP or sending questionnaires.

Page 272 - In SaaS, the customer is responsible only for the security of data, therefore the assessors will largely focus on the compliance offered by the CSP via third-party reports, certifications and attestations.

To assess the controls that the third-party cloud service provider (CSP) is responsible for, the optimal and most efficient mechanism is to review third-party audit reports. These reports provide an independent assessment of the CSP’s security controls and can help the independent contractor evaluate the effectiveness of the CSP’s security program. Reviewing the CSP’s published questionnaires can also provide valuable insights into the CSP’s security controls. However, these questionnaires may not provide a comprehensive view of the CSP’s security program.

Sounds to be B

Page 272 says for SaaS auditors can review third party audit reports.

Should be A