Isaca Cloud Security Alliance CCAK Questions & Answers

• Question 21:

  Which of the following parties should have accountability for cloud compliance requirements?

  A. Customer

  B. Equally shared between customer and provider

  C. Provider

  D. Either customer or provider, depending on requirements

  Correct Answer: B

• Question 22:

  As a developer building codes into a container in a DevSecOps environment, which of the following is the appropriate place(s) to perform security tests?

  A. Within developer's laptop

  B. Within the CI/CD server

  C. Within version repositories

  D. Within the CI/CD pipeline

  Correct Answer: D

• Question 23:

  You have been assigned the implementation of an ISMS, whose scope must cover both on premise and cloud infrastructure. Which of the following is your BEST option?

  A. Implement ISO/IEC 27002 and complement it with additional controls from the CCM.

  B. Implement ISO/IEC 27001 and complement it with additional controls from ISO/IEC 27017.

  C. Implement ISO/IEC 27001 and complement it with additional controls from ISO/IEC 27002.

  D. Implement ISO/IEC 27001 and complement it with additional controls from the NIST SP 800-145.

  Correct Answer: B

• Question 24:

  Which best describes the difference between a type 1 and a type 2 SOC report?

  A. A type 2 SOC report validates the operating effectiveness of controls whereas a type 1 SOC report validates the suitability of the design of the controls.

  B. A type 2 SOC report validates the suitability of the design of the controls whereas a type 1 SOC report validates the operating effectiveness of controls.

  C. A type 1 SOC report provides an attestation whereas a type 2 SOC report offers a certification.

  D. There is no difference between a type 2 and type 1 SOC report.

  Correct Answer: C

  Reference: https://www.accountingtools.com/articles/2019/8/30/the-difference-between-soc-type-1-andtype-2-reports

• Question 25:

  If the degree of verification for information shared with the auditor during an audit is low, the auditor should:

  A. reject the information as audit evidence.

  B. stop evaluating the requirement altogether and review other audit areas.

  C. delve deeper to obtain the required information to decide conclusively.

  D. use professional judgment to determine the degree of reliance that can be placed on the information as evidence.

  Correct Answer: D

• Question 26:

  When building a cloud governance model, which of the following requirements will focus more on the cloud service provider's evaluation and control checklist?

  A. Security requirements

  B. Legal requirements

  C. Compliance requirements

  D. Operational requirements

  Correct Answer: D

• Question 27:

  A. schedule frequent reviews with high-risk cloud service providers.

  B. develop plans using a standardized risk-based approach.

  C. maintain a comprehensive cloud service inventory.

  D. collate views from various business functions using cloud services.

  Correct Answer: A

• Question 28:

  In the context of Infrastructure as a Service (IaaS), a vulnerability assessment will scan virtual machines to identify vulnerabilities in:

  A. both operating system and application infrastructure contained within the CSP's instances.

  B. both operating system and application infrastructure contained within the customer's instances

  C. only application infrastructure contained within the CSP's instances.

  D. only application infrastructure contained within the customer's instances.

  Correct Answer: C

• Question 29:

  One of the Cloud Control Matrix's (CCM's) control specifications states that “Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations.” Which of the following controls under the Audit Assurance and Compliance domain does this match to?

  A. Audit planning

  B. Information system and regulatory mapping

  C. GDPR auditing

  D. Independent audits

  Correct Answer: B

• Question 30:

  To ensure that integration of security testing is implemented on large code sets in environments where time to completion is critical, what form of validation should an auditor expect?

  A. Parallel testing

  B. Full application stack unit testing

  C. Regression testing

  D. Functional verification

  Correct Answer: B

  Reference: https://www.sciencedirect.com/topics/computer-science/black-box-testing