Isaca CCAK Online Practice Questions and Exam Preparation

Isaca CCAK Online Questions & Answers

• Question 151:

  What is the advantage of using dynamic application security testing (DAST) over static application security testing (SAST) methodology?

  A. Unlike SAST, DAST is a blackbox and programming language agnostic.
  B. DAST can dynamically integrate with most CI/CD tools.
  C. DAST delivers more false positives than SAST.
  D. DAST is slower but thorough.
  A. Unlike SAST, DAST is a blackbox and programming language agnostic.

• Question 152:

  SAST testing is performed by:

  A. scanning the application source code.
  B. scanning the application interface.
  C. scanning all infrastructure components.
  D. performing manual actions to gain control of the application.
  A. scanning the application source code.

• Question 153:

  A cloud customer configured and developed a solution on top of the certified cloud services. Building on top of a compliant CSP:

  A. means that the cloud customer is also compliant.
  B. means that the cloud customer and client are both compliant.
  C. means that the cloud customer is compliant but their client is not compliant.
  D. does not necessarily mean that the cloud customer is also compliant.
  D. does not necessarily mean that the cloud customer is also compliant.

• Question 154:

  Which of the following is the MOST important audit scope document when conducting a review of a cloud service provider?

  A. Updated audit/work program
  B. Documentation criteria for the audit evidence
  C. Processes and systems to be audited
  D. Testing procedure to be performed
  B. Documentation criteria for the audit evidence

• Question 155:

  When using a SaaS solution, who is responsible for application security?

  A. The cloud service provider only
  B. The cloud service consumer only
  C. Both cloud consumer and the enterprise
  D. Both cloud provider and the consumer
  A. The cloud service provider only

• Question 156:

  As Infrastructure as a Service (laaS) cloud service providers often do not allow the cloud service customers to perform on-premise audits, the BEST approach for the auditor should be to:

  A. use other sources of available data for evaluating the customer's controls.
  B. recommend that the customer not use the services provided by the provider.
  C. refrain from auditing the provider's security controls due to lack of cooperation.
  D. escalate the lack of support from the provider to the regulatory authority.
  A. use other sources of available data for evaluating the customer's controls.

• Question 157:

  An organization is using the Cloud Controls Matrix (CCM) to extend its IT governance in the cloud. Which of the following is the BEST way for the organization to take advantage of the supplier relationship feature?

  A. Filter out only those controls directly influenced by contractual agreements.
  B. Leverage this feature to enable the adoption of the Shared Responsibility Model.
  C. Filter out only those controls having a direct impact on current terms of service (TOS) and service level agreement (SLA).
  D. Leverage this feature to enable a smarter selection of the next cloud provider.
  D. Leverage this feature to enable a smarter selection of the next cloud provider.

• Question 158:

  Application programming interfaces (APIs) are likely to be attacked continuously by bad actors because they:

  A. are the asset with private IP addresses.
  B. are generally the most exposed part.
  C. could be poorly designed.
  D. act as a very effective backdoor.
  B. are generally the most exposed part.

• Question 159:

  Prioritizing assurance activities for an organization's cloud services portfolio depends PRIMARILY on an organization's ability to:

  A. schedule frequent reviews with high-risk cloud service providers.
  B. develop plans using a standardized risk-based approach.
  C. maintain a comprehensive cloud service inventory.
  D. collate views from various business functions using cloud services.
  A. schedule frequent reviews with high-risk cloud service providers.

• Question 160:

  The FINAL decision to include a material finding in a cloud audit report should be made by the:

  A. auditee's senior management.
  B. organization's chief executive officer (CEO).
  C. cloud auditor.
  D. organization's chief information security officer (CISO)
  C. cloud auditor.