Isaca CCAK Online Practice Questions and Exam Preparation

Isaca CCAK Online Questions & Answers

• Question 221:

  Which audit report provides an attestation of audit results that cloud service providers will make available for public consumption?

  A. SOC1 Type1
  B. SOC2 Type2
  C. SOC 3
  D. SOC1
  C. SOC 3

• Question 222:

  Which of the following attestation allows for immediate adoption of the Cloud Control Matrix (CCM) as additional criteria to AICPA Trust Service Criteria and provides the flexibility to update the criteria as technology and market requirements change?

  A. PC-IDSS
  B. CSA STAR Attestation
  C. MTCS
  D. BSI Criteria Catalogue C5
  B. CSA STAR Attestation

• Question 223:

  An auditor is assessing a European organization's compliance. Which regulation is suitable if health information needs to be protected?

  A. GDPR
  B. DPIA
  C. DPA
  D. HIPAA
  A. GDPR

• Question 224:

  Which plan will guide an organization on how to react to a security incident that might occur on the organization's systems, or that might be affecting one of their service providers?

  A. Incident Response Plans
  B. Security Incident Plans
  C. Unexpected Event Plans
  D. Emergency Incident Plans
  A. Incident Response Plans

• Question 225:

  What should be the control audit frequency for Business Continuity Management?

  A. Quarterly
  B. Annually
  C. Monthly
  D. Semi-annually
  B. Annually

• Question 226:

  A large organization with subsidiaries in multiple locations has a business requirement to organize IT systems to have identified resources reside in particular locations with organizational personnel. Which access control method will allow IT personnel to be segregated across the various locations?

  A. Role Based Access Control
  B. Attribute Based Access Control
  C. Policy Based Access Control
  D. Rule Based Access Control
  A. Role Based Access Control

• Question 227:

  Which of the following is MOST useful for an auditor to review when seeking visibility into the cloud supply chain for a newly acquired Software as a Service (SaaS) solution?

  A. SaaS provider contract
  B. Payments made by the service owner
  C. SaaS vendor white papers
  D. Cloud compliance obligations register
  A. SaaS provider contract

• Question 228:

  The MAIN difference between Cloud Control Matrix (CCM) and Consensus Assessment Initiative Questionnaire (CAIQ) is that:

  A. CCM assesses the presence of controls, whereas CAIQ assesses overall security of a service.
  B. CCM has a set of security questions, whereas CAIQ has a set of security controls.
  C. CCM has 14 domains and CAIQ has 16 domains.
  D. CCM provides a controls framework, whereas CAIQ provides industry-accepted ways to document which security controls exist in IaaS, PaaS, and SaaS offerings.
  D. CCM provides a controls framework, whereas CAIQ provides industry-accepted ways to document which security controls exist in IaaS, PaaS, and SaaS offerings.

• Question 229:

  What legal documents should be provided to the auditors in relation to risk management?

  A. Enterprise cloud strategy and policy
  B. Contracts and service level agreements (SLAs) of cloud service providers
  C. Policies and procedures established around third-party risk assessments
  D. Inventory of third-party attestation reports
  B. Contracts and service level agreements (SLAs) of cloud service providers

• Question 230:

  When applying the Top Threats Analysis methodology following an incident, what is the scope of the technical impact identification step?

  A. Determine the impact on the controls that were selected by the organization to respond to identified risks.
  B. Determine the impact on confidentiality, integrity and availability of the information system.
  C. Determine the impact on the financial, operational, compliance and reputation of the organization.
  D. Determine the impact on the physical and environmental security of the organization, excluding informational assets.
  D. Determine the impact on the physical and environmental security of the organization, excluding informational assets.