Isaca CCAK Online Practice Questions and Exam Preparation

Isaca CCAK Online Questions & Answers

• Question 181:

  A cloud service provider does not allow audits using automated tools as these tools could be considered destructive techniques for the cloud environment. Which of the following aspects of the audit will be constrained?

  A. Purpose
  B. Objectives
  C. Nature of relationship
  D. Scope
  B. Objectives

• Question 182:

  Which of the following has been provided by the Federal Office for Information Security in Germany to support customers in selecting, controlling, and monitoring their cloud service providers?

  A. BSI IT-basic protection catalogue
  B. Multi-Tier Cloud Security (MTCS)
  C. German IDW PS 951
  D. BSI Criteria Catalogue C5
  D. BSI Criteria Catalogue C5

• Question 183:

  A contract containing the phrase "You automatically consent to these terms by using or logging into the service to which they pertain" is establishing a contract of:

  A. exclusivity.
  B. adhesion.
  C. execution.
  D. exclusion.
  B. adhesion.

• Question 184:

  Which of the following are independent assessment organizations that verify cloud providers' security implementations and provide the overall risk posture of a cloud environment for a FedRAMP security authorization decision?

  A. FedRAMP Program Management Office (FedRAMP PMO)
  B. American Association of Laboratory Accreditation (A2LA)
  C. Third-party Assessment Organizations (3PAOs)
  D. FedRAMP Joint Authorization Boards (JABs)
  C. Third-party Assessment Organizations (3PAOs)

• Question 185:

  Which of the following is the MOST relevant question in the cloud compliance program design phase?

  A. Who owns the cloud services strategy?
  B. Who owns the cloud strategy?
  C. Who owns the cloud governance strategy?
  D. Who owns the cloud portfolio strategy?
  B. Who owns the cloud strategy?

• Question 186:

  In relation to testing business continuity management and operational resilience, an auditor should review which of the following database documentation?

  A. Database backup and replication guidelines
  B. System backup documentation
  C. Incident management documentation
  D. Operational manuals
  A. Database backup and replication guidelines

• Question 187:

  What type of termination occurs at the initiative of one party, and without the fault of the other party?

  A. Termination for cause
  B. Termination for convenience
  C. Termination at the end of the term
  D. Termination without the fault
  C. Termination at the end of the term

• Question 188:

  Account design in the cloud should be driven by:

  A. security requirements.
  B. organizational structure.
  C. business continuity policies.
  D. management structure.
  A. security requirements.

• Question 189:

  Which of the following standards is designed to be used by organizations for cloud services that intend to select controls within the process of implementing an Information Security Management System based on ISO/IEC 27001?

  A. ISO/IEC 27017:2015
  B. CSA Cloud Control Matrix (CCM)
  C. NIST SP 800-146
  D. ISO/IEC 27002
  D. ISO/IEC 27002

• Question 190:

  When mapping controls to architectural implementations, requirements define:

  A. control objectives.
  B. control activities.
  C. guidelines.
  D. policies.
  B. control activities.