Free CCAK Exam Dumps PDF Preview

Question 1

Single choice

Which of the following are independent assessment organizations that verify cloud providers' security implementations and provide the overall risk posture of a cloud environment for a FedRAMP security authorization decision?

A
FedRAMP Program Management Office (FedRAMP PMO)
B
American Association of Laboratory Accreditation (A2LA)
C
Third-party Assessment Organizations (3PAOs)
D
FedRAMP Joint Authorization Boards (JABs)

Reveal answer details Close answer details

Correct answerC

Question 2

Single choice

Market share and geolocation are aspects PRIMARILY related to:

A
business perspective.
B
cloud perspective.
C
risk perspective.
D
governance perspective.

Reveal answer details Close answer details

Correct answerA

Question 3

Single choice

The MOST important goal of regression testing is to ensure:

A
the expected outputs are provided by the new features.
B
the system can handle a high number of users.
C
the system can be restored after a technical issue.
D
new releases do not impact previous stable features.

Reveal answer details Close answer details

Correct answerD

Question 4

Single choice

Cloud Control Matrix (CCM) controls can be used by cloud customers to:

A
develop new security baselines for the industry.
B
define different control frameworks for different cloud service providers.
C
facilitate communication with their legal department.
D
build an operational cloud risk management program.

Reveal answer details Close answer details

Correct answerB

Question 5

Single choice

An auditor examining a cloud service provider's service level agreement (SLA) should be MOST concerned about whether:

A
the agreement includes any operational matters that are material to the service operations.
B
the agreement excludes any sourcing and financial matters that are material in meeting the service level agreement (SLA).
C
the agreement includes any service availability matters that are material to the service operations.
D
the agreement excludes any operational matters that are material to the service operations

Reveal answer details Close answer details

Correct answerD

Question 6

Single choice

What should be the control audit frequency for an organization's business continuity management and operational resilience strategy?

A
Annually
B
Biannually
C
Quarterly
D
Monthly

Reveal answer details Close answer details

Correct answerA

Question 7

Single choice

Which of the following BEST ensures adequate restriction on the number of people who can access the pipeline production environment?

A
Ensuring segregation of duties in the production and development pipelines.
B
Role-based access controls in the production and development pipelines.
C
Separation of production and development pipelines.
D
Periodic review of the Cl/CD pipeline audit logs to identify any access violations.

Reveal answer details Close answer details

Correct answerC

Question 8

Single choice

What aspect of SaaS functionality and operations would the cloud customer be responsible for and should be audited?

A
Access controls
B
Vulnerability management
C
Source code reviews
D
Patching

Reveal answer details Close answer details

Correct answerA

Question 9

Single choice

Which of the following helps an organization to identify control gaps and shortcomings in the context of cloud computing?

A
Walk-through peer review
B
Periodic documentation review
C
User security awareness training
D
Monitoring effectiveness

Reveal answer details Close answer details

Correct answerB

Question 10

Single choice

How should controls be designed by an organization?

A
By the internal audit team
B
Using the ISO27001 framework
C
By the cloud provider
D
Using the organization's risk management framework

Reveal answer details Close answer details

Correct answerA

Question 11

Single choice

Which of the following cloud environments should be a concern to an organization s cloud auditor?

A
The cloud service provider s data center is more than 100 miles away.
B
The technical team is trained on only one vendor Infrastructure as a Service (laaS) platform, but the organization has subscribed to another vendor's laaS platform as an alternative.
C
The organization entirely depends on several proprietary Software as a Service (SaaS) applications.
D
The failover region of the cloud service provider is on another continent.

Reveal answer details Close answer details

Correct answerC

Question 12

Single choice

What type of termination occurs at the initiative of one party, and without the fault of the other party?

A
Termination for cause
B
Termination for convenience
C
Termination at the end of the term
D
Termination without the fault

Reveal answer details Close answer details

Correct answerC

Question 13

Single choice

Due to cloud audit team resource constraints, an audit plan as initially approved cannot be completed.
Assuming that the situation is communicated in the cloud audit report which course of action is MOST relevant?

A
Focusing on auditing high-risk areas
B
Testing the adequacy of cloud controls design
C
Relying on management testing of cloud controls
D
Testing the operational effectiveness of cloud controls

Reveal answer details Close answer details

Correct answerA

Question 14

Single choice

Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, ports, and by compensating controls.

Which of the following controls BEST matches this control description?

A
Network Security
B
Change Detection
C
Virtual Instance and OS Hardening
D
Network Vulnerability Management

Reveal answer details Close answer details

Correct answerA

Question 15

Single choice

An auditor wants to get information about the operating effectiveness of controls addressing privacy, availability, and confidentiality of a service organization.

Which of the following can BEST help to gain the required information?

A
ISAE 3402 report
B
ISO/IEC 27001 certification
C
SOC1 Type 1 report
D
SOC2 Type 2 report

Reveal answer details Close answer details

Correct answerD

Question 16

Single choice

An auditor is assessing a European organization's compliance.

Which regulation is suitable if health information needs to be protected?

A
GDPR
B
DPIA
C
DPA
D
HIPAA

Reveal answer details Close answer details

Correct answerA

Question 17

Single choice

After finding a vulnerability in an internet-facing server of an organization, a cybersecurity criminal is able to access an encrypted file system and successfully manages to overwrite part of some files with random data.
In reference to the Top Threats Analysis methodology, how would you categorize the technical impact of this incident?

A
As an integrity breach
B
As control breach
C
As an availability breach
D
As a confidentiality breach

Reveal answer details Close answer details

Correct answerB

Question 18

Single choice

An organization should document the compliance responsibilities and ownership of accountability in a RACI chart or its informational equivalent in order to:

A
Provide a holistic and seamless view of the cloud service provider's responsibility for compliance with prevailing laws and regulations.
B
Provide a holistic and seamless view of the enterprise's responsibility for compliance with prevailing laws and regulations.
C
Conform to the organization's governance model.
D
Define the cloud compliance requirements and how they interplay with the organization's business strategy, goals, and other compliance requirements.

Reveal answer details Close answer details

Correct answerB

Question 19

Single choice

The BEST way to deliver continuous compliance in a cloud environment is to:

A
decrease the interval between attestations of compliance.
B
combine point-in-time assurance approaches with continuous monitoring.
C
increase the frequency of external audits from annual to quarterly.
D
combine point-in-time assurance approaches with continuous auditing.

Reveal answer details Close answer details

Correct answerB

Question 20

Single choice

An auditor is performing an audit on behalf of a cloud customer. For assessing security awareness, the auditor should:

A
assess the existence and adequacy of a security awareness training program at the cloud service provider's organization as the cloud customer hired the auditor to review and cloud service.
B
assess the existence and adequacy of a security awareness training program at both the cloud customer's organization and the cloud service provider's organization.
C
assess the existence and adequacy of a security awareness training program at the cloud customer's organization as they hired the auditor.
D
not assess the security awareness training program as it is each organization's responsibility

Reveal answer details Close answer details

Correct answerD

Question 21

Single choice

To promote the adoption of secure cloud services across the federal government by

A
To providing a standardized approach to security and risk assessment
B
To provide agencies of the federal government a dedicated tool to certify Authority to Operate (ATO)
C
To enable 3PAOs to perform independent security assessments of cloud service providers
D
To publish a comprehensive and official framework for the secure implementation of controls for cloud security

Reveal answer details Close answer details

Correct answerA

Question 22

Single choice

Which of the following activities are part of the implementation phase of a cloud assurance program during a cloud migration?

A
Development of the monitoring goals and requirements
B
Identification of processes, functions, and systems
C
Identification of the relevant laws, regulations, and standards
D
Identification of roles and responsibilities

Reveal answer details Close answer details

Correct answerB

Question 23

Single choice

In a multi-level supply chain structure where cloud service provider A relies on other sub cloud services, the provider should ensure that any compliance requirements relevant to the provider are:

A
passed to the sub cloud service providers based on the sub cloud service providers' geographic location.
B
passed to the sub cloud service providers.
C
treated as confidential information and withheld from all sub cloud service providers.
D
treated as sensitive information and withheld from certain sub cloud service providers.

Reveal answer details Close answer details

Correct answerA

Question 24

Single choice

Regarding suppliers of a cloud service provider, it is MOST important for the auditor to be aware that the:

A
client organization has a clear understanding of the provider s suppliers.
B
suppliers are accountable for the provider's service that they are providing.
C
client organization does not need to worry about the provider's suppliers, as this is the provider's responsibility.
D
client organization and provider are both responsible for the provider's suppliers.

Reveal answer details Close answer details

Correct answerA

Question 25

Single choice

You have been assigned the implementation of an ISMS, whose scope must cover both on premise and cloud infrastructure.

Which of the following is your BEST option?

A
Implement ISO/IEC 27002 and complement it with additional controls from the CCM.
B
Implement ISO/IEC 27001 and complement it with additional controls from ISO/IEC 27017.
C
Implement ISO/IEC 27001 and complement it with additional controls from ISO/IEC 27002.
D
Implement ISO/IEC 27001 and complement it with additional controls from the NIST SP 800-145.

Reveal answer details Close answer details

Correct answerB

Question 26

Single choice

Which of the following is a detective control that may be identified in a Software as a Service (SaaS) service provider?

A
Data encryption
B
Incident management
C
Network segmentation
D
Privileged access monitoring

Reveal answer details Close answer details

Correct answerD

Question 27

Single choice

Organizations maintain mappings between the different control frameworks they adopt to:

A
help identify controls with common assessment status.
B
avoid duplication of work when assessing compliance.
C
help identify controls with different assessment status.
D
start a compliance assessment using latest assessment.

Reveal answer details Close answer details

Correct answerC

Question 28

Single choice

From a compliance perspective, which of the following artifacts should an assessor review when evaluating the effectiveness of Infrastructure as Code deployments?

A
Evaluation summaries
B
logs
C
SOC reports
D
Interviews

Reveal answer details Close answer details

Correct answerB

Question 29

Single choice

Which of the following is a category of trust in cloud computing?

A
Loyalty-based trust
B
Background-based trust
C
Reputation-based trust
D
Transparency-based trust

Reveal answer details Close answer details

Correct answerC

Question 30

Single choice

The PRIMARY purpose of Open Certification Framework (OCF) for the CSA STAR program is to:

A
facilitate an effective relationship between the cloud service provider and cloud client.
B
ensure understanding of true risk and perceived risk by the cloud service users.
C
provide global, accredited, and trusted certification of the cloud service provider.
D
enable the cloud service provider to prioritize resources to meet its own requirements.

Reveal answer details Close answer details

Correct answerC

Question 31

Single choice

Which audit report provides an attestation of audit results that cloud service providers will make available for public consumption?

A
SOC1 Type1
B
SOC2 Type2
C
SOC 3
D
SOC1

Reveal answer details Close answer details

Correct answerC

Question 32

Single choice

During the planning phase of a cloud audit, the primary goal of a cloud auditor is to:

A
specify appropriate tests.
B
address audit objectives.
C
minimize audit resources.
D
collect sufficient evidence.

Reveal answer details Close answer details

Correct answerB

Question 33

Single choice

Which of the following is the PRIMARY component to determine the success or failure of an organization's cloud compliance program?

A
Defining the metrics and indicators to monitor the implementation of the compliance program
B
Determining the risk treatment options to be used in the compliance program
C
Mapping who possesses the information and data that should drive the compliance goals
D
Selecting the external frameworks that will be used as reference

Reveal answer details Close answer details

Correct answerC

Question 34

Single choice

Which of the following is MOST important to consider when an organization is building a compliance program for the cloud?

A
The rapidly changing service portfolio and architecture of the cloud.
B
Cloud providers should not be part of the compliance program.
C
The fairly static nature of the service portfolio and architecture of the cloud.
D
The cloud is similar to the on-premise environment in terms of compliance.

Reveal answer details Close answer details

Correct answerA

Question 35

Single choice

An organization that is utilizing a community cloud is contracting an auditor to conduct a review on behalf of the group of organizations within the cloud community.
From the following, to whom should the auditor report the findings?

A
Public
B
Management of organization being audited
C
Shareholders/interested parties
D
Cloud service provider

Reveal answer details Close answer details

Correct answerD

Free CCAK Exam Dumps Preview

Certificate of Cloud Auditing Knowledge

PREVIEW CONTENTS · 1 VOLUME

QUESTION 1

QUESTION 2

QUESTION 3

QUESTION 4

QUESTION 5

QUESTION 6

QUESTION 7

QUESTION 8

QUESTION 9

QUESTION 10

QUESTION 11

QUESTION 12

QUESTION 13

QUESTION 14

QUESTION 15

QUESTION 16

QUESTION 17

QUESTION 18

QUESTION 19

QUESTION 20

QUESTION 21

QUESTION 22

QUESTION 23

QUESTION 24

QUESTION 25

QUESTION 26

QUESTION 27

QUESTION 28

QUESTION 29

QUESTION 30

QUESTION 31

QUESTION 32

QUESTION 33

QUESTION 34

QUESTION 35