Isaca CCAK Online Practice Questions and Exam Preparation

Isaca CCAK Online Questions & Answers

• Question 1:

  The BEST way to deliver continuous compliance in a cloud environment is to:

  A. decrease the interval between attestations of compliance.
  B. combine point-in-time assurance approaches with continuous monitoring.
  C. increase the frequency of external audits from annual to quarterly.
  D. combine point-in-time assurance approaches with continuous auditing.
  B. combine point-in-time assurance approaches with continuous monitoring.

• Question 2:

  Which of the following key stakeholders should be identified the earliest when an organization is designing a cloud compliance program?

  A. Cloud process owners
  B. Internal control function
  C. Legal functions
  D. Cloud strategy owners
  A. Cloud process owners

• Question 3:

  Cloud Control Matrix (CCM) controls can be used by cloud customers to:

  A. develop new security baselines for the industry.
  B. define different control frameworks for different cloud service providers.
  C. facilitate communication with their legal department.
  D. build an operational cloud risk management program.
  B. define different control frameworks for different cloud service providers.

• Question 4:

  In an organization, how are policy violations MOST likely to occur?

  A. By accident
  B. Deliberately by the ISP
  C. Deliberately
  D. Deliberately by the cloud provider
  A. By accident

• Question 5:

  An organization should document the compliance responsibilities and ownership of accountability in a RACI chart or its informational equivalent in order to:

  A. Provide a holistic and seamless view of the cloud service provider's responsibility for compliance with prevailing laws and regulations.
  B. Provide a holistic and seamless view of the enterprise's responsibility for compliance with prevailing laws and regulations.
  C. Conform to the organization's governance model.
  D. Define the cloud compliance requirements and how they interplay with the organization's business strategy, goals, and other compliance requirements.
  B. Provide a holistic and seamless view of the enterprise's responsibility for compliance with prevailing laws and regulations.

• Question 6:

  To BEST prevent a data breach from happening, cryptographic keys should be: A. distributed in public-facing repositories.

  B. embedded in source code.

  C. rotated regularly.

  D. transmitted in clear text.

  Correct Answer. C
  C

• Question 7:

  Which of the following BEST ensures adequate restriction on the number of people who can access the pipeline production environment?

  A. Ensuring segregation of duties in the production and development pipelines.
  B. Role-based access controls in the production and development pipelines.
  C. Separation of production and development pipelines.
  D. Periodic review of the Cl/CD pipeline audit logs to identify any access violations.
  C. Separation of production and development pipelines.

• Question 8:

  When a client's business process changes, the CSP SLA should:

  A. be reviewed, but the SLA cannot be updated.
  B. not be reviewed, but the cloud contract should be cancelled immediately.
  C. not be reviewed as the SLA cannot be updated.
  D. be reviewed and updated if required.
  D. be reviewed and updated if required.

• Question 9:

  What aspect of SaaS functionality and operations would the cloud customer be responsible for and should be audited?

  A. Access controls
  B. Vulnerability management
  C. Source code reviews
  D. Patching
  A. Access controls

• Question 10:

  Which of the following contract terms is necessary to meet a company's requirement that needs to move data from one CSP to another?

  A. Drag and Drop
  B. Lift and shift
  C. Flexibility to move
  D. Transition and data portability
  D. Transition and data portability