Isaca CCAK Online Practice Questions and Exam Preparation

Isaca CCAK Online Questions & Answers

• Question 201:

  What should be an organization's control audit schedule of a cloud service provider's business continuity plan and operational resilience policy?

  A. Annual
  B. Quarterly
  C. Monthly
  D. Semi-annual
  A. Annual

• Question 202:

  Which of the following controls framework should the cloud customer use to assess the overall security risk of a cloud provider?

  A. SOC3 - Type2
  B. Cloud Control Matrix (CCM)
  C. SOC2 - Type1
  D. SOC1 - Type1
  C. SOC2 - Type1

• Question 203:

  Which of the following cloud service models creates a cloud version of a contract template?

  A. Platform as a Service (PaaS)
  B. Infrastructure as a Service (laaS)
  C. Software as a Service (SaaS)
  D. Security as a Service (SecaaS)
  C. Software as a Service (SaaS)

• Question 204:

  Which of the following would be considered as a factor to trust in a cloud service provider?

  A. The level of exposure for public information
  B. The level of proved technical skills
  C. The level of willingness to cooperate
  D. The level of open source evidence available
  C. The level of willingness to cooperate

• Question 205:

  The criteria for limiting services allowing non-critical services or services requiring high availability and resilience to be moved to the cloud is an important consideration to be included PRIMARILY in the:

  A. risk management policy.
  B. cloud policy.
  C. business continuity plan.
  D. information security standard for cloud technologies.
  C. business continuity plan.

• Question 206:

  Regarding suppliers of a cloud service provider, it is MOST important for the auditor to be aware that the:

  A. client organization has a clear understanding of the provider s suppliers.
  B. suppliers are accountable for the provider's service that they are providing.
  C. client organization does not need to worry about the provider's suppliers, as this is the provider's responsibility.
  D. client organization and provider are both responsible for the provider's suppliers.
  A. client organization has a clear understanding of the provider s suppliers.

• Question 207:

  The Cloud Computing Compliance Controls Catalogue (C5) framework is maintained by which of the following agencies?

  A. National Institute of Standards and Technology (NIST)
  B. National Security Agency (NSA)

• Question 208:

  When performing audits in relation to the organizational strategy and governance, what should be requested from the cloud service provider?

  A. Enterprise cloud security strategy
  B. Enterprise cloud strategy and policy
  C. Attestation reports
  D. Policies and procedures
  C. Attestation reports

• Question 209:

  Which of the following enables auditors to conduct gap analyses of what a cloud service provider offers versus what the customer requires?

  A. Using a standardized control framework
  B. The experience gained over the years
  C. Understanding the customer risk profile
  D. The as-is and to-be enterprise architecture (EA)
  A. Using a standardized control framework

• Question 210:

  As part of continuous auditing, which of the following should a third-party auditor verify on a regular basis?

  A. Reporting tools are reliable and based on defined objectives.
  B. The cloud service provider is compliant.
  C. Assessment tools are configured based on cloud security best practices.
  D. Application programming interfaces (APIs) implemented are appropriate.
  C. Assessment tools are configured based on cloud security best practices.