Isaca CCAK Online Practice Questions and Exam Preparation

Isaca CCAK Online Questions & Answers

• Question 11:

  To ensure that integration of security testing is implemented on large code sets in environments where time to completion is critical, what form of validation should an auditor expect?

  A. Parallel testing
  B. Full application stack unit testing
  C. Regression testing
  D. Functional verification
  B. Full application stack unit testing

• Question 12:

  What should be the control audit frequency for an organization's business continuity management and operational resilience strategy?

  A. Annually
  B. Biannually
  C. Quarterly
  D. Monthly
  A. Annually

• Question 13:

  An organization currently following the ISO/IEC 27002 control framework has been charged by a new CIO to switch to the NIST 800-53 control framework. Which of the following is the FIRST step to this change?

  A. Discard all work done and start implementing NIST 800-53 from scratch.
  B. Recommend no change, since the scope of ISO/IEC 27002 is broader.
  C. Recommend no change, since NIST 800-53 is a US-scoped control framework.
  D. Map ISO/IEC 27002 and NIST 800-53 and detect gaps and commonalities.
  D. Map ISO/IEC 27002 and NIST 800-53 and detect gaps and commonalities.

• Question 14:

  While performing the audit, the auditor found that an object storage bucket containing PII could be accessed by anyone on the Internet. Given this discovery, what should be the most appropriate action for the auditor to perform?

  A. Highlighting the gap to the audit sponsor at the sponsor's earliest possible availability
  B. Asking the organization's cloud administrator to immediately close the gap by updating the configuration settings and making the object storage bucket private and hence inaccessible from the Internet
  C. Documenting the finding in the audit report and sharing the gap with the relevant stakeholders
  D. Informing the organization's internal audit manager immediately about the gap
  C. Documenting the finding in the audit report and sharing the gap with the relevant stakeholders

• Question 15:

  To assist an organization with planning a cloud migration strategy to execution, an auditor should recommend the use of:

  A. object-oriented architecture.
  B. software architecture.
  C. service-oriented architecture.
  D. enterprise architecture.
  C. service-oriented architecture.

• Question 16:

  Due to cloud audit team resource constraints, an audit plan as initially approved cannot be completed. Assuming that the situation is communicated in the cloud audit report which course of action is MOST relevant?

  A. Focusing on auditing high-risk areas
  B. Testing the adequacy of cloud controls design
  C. Relying on management testing of cloud controls
  D. Testing the operational effectiveness of cloud controls
  A. Focusing on auditing high-risk areas

• Question 17:

  The rapid and dynamic rate of changes found in a cloud environment affects the organization's:

  A. risk profile.
  B. risk appetite.
  C. risk scoring.
  D. risk communication.
  B. risk appetite.

• Question 18:

  Which of the following aspects of risk management involves identifying the potential reputational harm and/or financial harm when an incident occurs?

  A. Mitigations
  B. Residual risk
  C. Likelihood
  D. Impact Analysis
  D. Impact Analysis

• Question 19:

  Which of the following is the BEST control framework for a European manufacturing corporation that is migrating to the cloud?

  A. NIST SP 800-53
  B. CSA's GDPR CoC
  C. PCI-DSS
  D. EU GDPR
  D. EU GDPR

• Question 20:

  Which of the following is a fundamental concept of FedRAMP that intends to save costs, time, and staff conducting superfluous agency security assessments?

  A. Use often, provide many times
  B. Be economical, act deliberately
  C. Use existing, provide many times
  D. Do once, use many times
  D. Do once, use many times