Isaca CCAK Online Practice Questions and Exam Preparation

Isaca CCAK Online Questions & Answers

• Question 131:

  Why should the results of third-party audits and certification be relied on when analyzing and assessing the cybersecurity risks in the cloud?

  A. To establish an audit mindset within the organization
  B. To contrast the risk generated by the loss of control
  C. To reinforce the role of the internal audit function
  D. To establish an accountability culture within the organization
  B. To contrast the risk generated by the loss of control

• Question 132:

  Which of the following would be the MOST critical finding of an application security and DevOps audit?

  A. The organization is not using a unified framework to integrate cloud compliance with regulatory requirements.
  B. Application architecture and configurations did not consider security measures.
  C. Outsourced cloud service interruption, breach or loss of data stored at the cloud service provider.
  D. Certifications with global security standards specific to cloud are not reviewed and the impact of noted findings are not assessed.
  B. Application architecture and configurations did not consider security measures.

• Question 133:

  Which of the following is the BEST way for a client to enforce a policy violation committed by a cloud service provider (CSP)?

  A. The violation is agreed upon and documented.
  B. Nothing can be done to enforce violations as this is a cloud service.
  C. The violation is agreed to verbally by the CSP.
  D. Violations will be automatically enforced so no action is needed.
  A. The violation is agreed upon and documented.

• Question 134:

  Which of the following would be a logical starting point for an auditor who has been engaged to assess the security of an organization's DevOps pipeline?

  A. Verify the inclusion of security gates in the pipeline.
  B. Conduct an architectural assessment.
  C. Review the CI/CD pipeline audit logs.
  D. Verify separation of development and production pipelines.
  C. Review the CI/CD pipeline audit logs.

• Question 135:

  Supply chain agreements between CSP and cloud customers should, at minimum, include:

  A. Organization chart of the CSP
  B. Policies and procedures of the cloud customer
  C. Audits, assessments and independent verification of compliance certifications with agreement terms
  D. Regulatory guidelines impacting the cloud customer
  C. Audits, assessments and independent verification of compliance certifications with agreement terms

• Question 136:

  When establishing cloud governance, an organization should FIRST test by migrating:

  A. all applications at once to the cloud.
  B. complex applications to the cloud.
  C. legacy applications to the cloud.
  D. a few applications to the cloud.
  D. a few applications to the cloud.

• Question 137:

  Which of the following is the BEST method to demonstrate assurance in the cloud services to multiple cloud customers?

  A. Provider's financial stability report and market value
  B. Reputation of the service provider in the industry
  C. Provider self-assessment and technical documents
  D. External attestation and certification audit reports
  D. External attestation and certification audit reports

• Question 138:

  Which of the following is a tool that visually depicts the gaps in an organization's security capabilities?

  A. Cloud security alliance (CSA) cloud control matrix
  B. Requirements traceability matrix
  C. Cloud security alliance (CSA) enterprise architecture (EA)
  D. Colored impact and likelihood risk matrix
  C. Cloud security alliance (CSA) enterprise architecture (EA)

• Question 139:

  In the context of Infrastructure as a Service (IaaS), a vulnerability assessment will scan virtual machines to identify vulnerabilities in:

  A. both operating system and application infrastructure contained within the CSP's instances.
  B. both operating system and application infrastructure contained within the customer's instances
  C. only application infrastructure contained within the CSP's instances.
  D. only application infrastructure contained within the customer's instances.
  C. only application infrastructure contained within the CSP's instances.

• Question 140:

  The three layers of Open Certification Framework (OCF) primarily help cloud service providers and cloud clients improve the level of:

  A. legal and regulatory compliance.
  B. risk and controls.
  C. audit structure and formats.
  D. transparency and assurance.
  D. transparency and assurance.