Isaca CCAK Online Practice Questions and Exam Preparation

Isaca CCAK Online Questions & Answers

• Question 111:

  Which of the following metrics are frequently immature?

  A. Metrics around Infrastructure as a Service (IaaS) storage and network environments
  B. Metrics around Platform as a Service (PaaS) development environments
  C. Metrics around Infrastructure as a Service (IaaS) computing environments
  D. Metrics around specific Software as a Service (SaaS) application services
  A. Metrics around Infrastructure as a Service (IaaS) storage and network environments

• Question 112:

  An auditor is auditing the services provided by a cloud service provider. When evaluating the security of the cloud customer's data in the cloud, which of the following should be of GREATEST concern to the auditor?

  A. Personally identifiable information (Pll) is pseudonymized but not fully encrypted.
  B. The cloud customer has encrypted the confidential data in the cloud using its own encryption keys.
  C. The confidential data stored in the cloud is encrypted using encryption keys that are managed by the provider.
  D. According to the cloud customer's data handling policy, all confidential data should be encrypted, but the confidential data stored in the cloud is well segmented but not encrypted.
  A. Personally identifiable information (Pll) is pseudonymized but not fully encrypted.

• Question 113:

  To promote the adoption of secure cloud services across the federal government by

  A. To providing a standardized approach to security and risk assessment
  B. To provide agencies of the federal government a dedicated tool to certify Authority to Operate (ATO)
  C. To enable 3PAOs to perform independent security assessments of cloud service providers
  D. To publish a comprehensive and official framework for the secure implementation of controls for cloud security
  A. To providing a standardized approach to security and risk assessment

• Question 114:

  Who is accountable for the use of a cloud service?

  A. The cloud access security broker (CASB)
  B. The supplier
  C. The cloud service provider
  D. The organization (client)
  D. The organization (client)

• Question 115:

  During the cloud service provider evaluation process, which of the following BEST helps identify baseline configuration requirements?

  A. Vendor requirements
  B. Product benchmarks
  C. Benchmark controls lists
  D. Contract terms and conditions
  C. Benchmark controls lists

• Question 116:

  Which of the following MOST enhances the internal stakeholder decision-making process for the remediation of risks identified from an organization's cloud compliance program?

  A. Automating risk monitoring and reporting processes
  B. Reporting emerging threats to senior stakeholders
  C. Establishing ownership and accountability
  D. Monitoring key risk indicators (KRIs) for multi-cloud environments
  C. Establishing ownership and accountability

• Question 117:

  When developing a cloud compliance program, what is the PRIMARY reason for a cloud customer to review which cloud services will be deployed?

  A. To determine how those services will fit within its policies and procedures
  B. To determine the total cost of the cloud services to be deployed
  C. To confirm which vendor will be selected based on the compliance with security requirements
  D. To confirm if the compensating controls implemented are sufficient for the cloud services
  A. To determine how those services will fit within its policies and procedures

• Question 118:

  How should controls be designed by an organization?

  A. By the internal audit team
  B. Using the ISO27001 framework
  C. By the cloud provider
  D. Using the organization's risk management framework
  A. By the internal audit team

• Question 119:

  The Cloud Octagon Model was developed to support organizations:

  A. risk assessment methodology.
  B. risk treatment methodology.
  C. incident response methodology.
  D. incident detection methodology.
  A. risk assessment methodology.

• Question 120:

  DevSecOps aims to integrate security tools and processes directly into the software development life cycle and should be done:

  A. at the end of the development cycle.
  B. after go-live.
  C. in all development steps.
  D. at the beginning of the development cycle.
  C. in all development steps.