Isaca CCAK Online Practice Questions and Exam Preparation

Isaca CCAK Online Questions & Answers

• Question 91:

  A cloud auditor observed that just before a new software went live, the librarian transferred production data to the test environment to confirm the new software can work in the production environment. What additional control should the cloud auditor check?

  A. Approval of the change by the change advisory board
  B. Explicit documented approval from all customers whose data is affected
  C. Training for the librarian
  D. Verification that the hardware of the test and production environments are compatible
  B. Explicit documented approval from all customers whose data is affected

• Question 92:

  To support customer's verification of the CSP claims regarding their responsibilities according to the shared responsibility model, which of the following tools and techniques is appropriate?

  A. Contractual agreement
  B. Internal audit
  C. External audit
  D. Security assessment
  D. Security assessment

• Question 93:

  The PRIMARY purpose of Open Certification Framework (OCF) for the CSA STAR program is to:

  A. facilitate an effective relationship between the cloud service provider and cloud client.
  B. enable the cloud service provider to prioritize resources to meet its own requirements.
  C. provide global, accredited, and trusted certification of the cloud service provider.
  D. ensure understanding of true risk and perceived risk by the cloud service users
  C. provide global, accredited, and trusted certification of the cloud service provider.

• Question 94:

  Which of the following data destruction methods is the MOST effective and efficient?

  A. Crypto-shredding
  B. Degaussing
  C. Multi-pass wipes
  D. Physical destruction
  B. Degaussing

• Question 95:

  A CSP providing cloud services currently being used by the United States federal government should obtain which of the following to assure compliance to stringent government standards?

  A. Multi-Tier Cloud Security (MTCS) Attestation
  B. FedRAMP Authorization
  C. ISO/IEC 27001:2013 Certification
  D. CSA STAR Level Certificate
  B. FedRAMP Authorization

• Question 96:

  An organization employing the Cloud Controls Matrix (CCM) to perform a compliance assessment leverages the Scope Applicability direct mapping to:

  A. Obtain the ISO/IEC 27001 certification from an accredited certification body (CB) following the ISO/IEC 17021-1 standard.
  B. Determine whether the organization can be considered fully compliant with the mapped standards because of the implementation of every CCM Control Specification.
  C. Understand which controls encompassed by the CCM may already be partially or fully implemented because of compliance with other standards.
  C. Understand which controls encompassed by the CCM may already be partially or fully implemented because of compliance with other standards.

• Question 97:

  Which of the following quantitative measures is KEY for an auditor to review when assessing the implementation of continuous auditing of performance on a cloud system?

  A. Service Level Objective (SLO)
  B. Recovery Point Objectives (RPO)
  C. Service Level Agreement (SLA)
  D. Recovery Time Objectives (RTO)
  C. Service Level Agreement (SLA)

• Question 98:

  The CSA STAR Certification is based on criteria outlined the Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) in addition to:

  A. GDPR CoC certification.
  B. GB/T 22080-2008.
  C. SOC 2 Type 1 or 2 reports.
  D. ISO/IEC 27001 implementation.
  D. ISO/IEC 27001 implementation.

• Question 99:

  An auditor is performing an audit on behalf of a cloud customer. For assessing security awareness, the auditor should:

  A. assess the existence and adequacy of a security awareness training program at the cloud service provider's organization as the cloud customer hired the auditor to review and cloud service.
  B. assess the existence and adequacy of a security awareness training program at both the cloud customer's organization and the cloud service provider's organization.
  C. assess the existence and adequacy of a security awareness training program at the cloud customer's organization as they hired the auditor.
  D. not assess the security awareness training program as it is each organization's responsibility
  D. not assess the security awareness training program as it is each organization's responsibility

• Question 100:

  Which of the following MOST enhances the internal stakeholder decision-making process for the remediation of risks identified from an organization's cloud compliance program?

  A. Establishing ownership and accountability
  B. Reporting emerging threats to senior stakeholders
  C. Monitoring key risk indicators (KRIs) for multi-cloud environments
  D. Automating risk monitoring and reporting processes
  A. Establishing ownership and accountability