Section: Protection of Information Assets
Explanation:
To ensure authenticity and confidentiality, a message must be encrypted twice: first with the sender's
private key, and then with the receiver's public key. The receiver can decrypt the message, thus ensuring
confidentiality of the message. Thereafter, the decrypted message can be decrypted with the public key of
the sender, ensuring authenticity of the message. Encrypting the message with the sender's private key
enables anyone to decrypt it.

The organization is primarily responsible for the security configurations of the deployed application's operating system when migrating its HR application to an Infrastructure as a Service (IaaS) model in a private cloud. This is because in an IaaS model, the cloud provider is responsible for the security of the underlying infrastructure that they lease to their customers, such as servers, storage, and networks, while the customer is responsible for the security of the areas of the cloud infrastructure over which they have control, such as operating systems, middleware, and applications. Therefore, the organization needs to ensure that the operating system is properly configured, patched, hardened, and monitored to protect the HR application from unauthorized access or malicious attacks.
The other options are not primarily responsible for the security configurations of the deployed application's operating system. The cloud provider's external auditor is not responsible for any security configurations, but rather for verifying and reporting on the cloud provider's compliance with relevant standards and regulations.
The cloud provider is responsible for the security of the underlying infrastructure, but not for the operating system or any software installed on it by the customer. The operating system vendor is responsible for providing updates and patches for the operating system, but not for configuring or securing it according to the customer's needs.
References:
* 11: What Is IaaS (Infrastructure As A Service)? - Forbes
* 12: What is Shared Responsibility Model? - Check Point Software
* 13: Who Is Responsible for Cloud Security? - Security Intelligence

Section: Protection of Information Assets
Explanation:
Lack of reporting of a successful attack on the network is a great concern to an IS auditor.