Isaca CCAK Online Practice Questions and Exam Preparation

Isaca CCAK Online Questions & Answers

• Question 21:

  From an auditor perspective, which of the following BEST describes shadow IT?

  A. An opportunity to diversify the cloud control approach
  B. A weakness in the cloud compliance posture
  C. A strength of disaster recovery (DR) planning
  D. A risk that jeopardizes business continuity planning
  D. A risk that jeopardizes business continuity planning

• Question 22:

  During the planning phase of a cloud audit, the primary goal of a cloud auditor is to:

  A. specify appropriate tests.
  B. address audit objectives.
  C. minimize audit resources.
  D. collect sufficient evidence.
  B. address audit objectives.

• Question 23:

  What is the FIRST thing to define when an organization is moving to the cloud?

  A. Goals of the migration
  B. Internal service level agreements (SLAs)
  C. Specific requirements
  D. Provider evaluation criteria
  A. Goals of the migration

• Question 24:

  A CSP contracts for a penetration test to be conducted on its infrastructures. The auditor engages the target with no prior knowledge of its defenses, assets, or channels. The CSP's security operation center is not notified in advance of the scope of the audit and the test vectors. Which mode is selected by the CSP?

  A. Double gray box
  B. Tandem
  C. Reversal
  D. Double blind
  D. Double blind

• Question 25:

  Which statement about compliance responsibilities and ownership of accountability is correct?

  A. Organizations may be able to transfer their accountability for compliance with various regulatory requirements to their CSPs, but they retain the ownership of responsibility.
  B. Organizations may be able to transfer their responsibility for compliance with various regulatory requirements to their CSPs, but they retain the ownership of accountability.
  C. Organizations may transfer their responsibility and accountability for compliance with various regulatory requirements to their CSPs.
  D. Organizations are not able to transfer their responsibility nor accountability for compliance with various regulatory requirements to their CSPs.
  D. Organizations are not able to transfer their responsibility nor accountability for compliance with various regulatory requirements to their CSPs.

• Question 26:

  An organization that is utilizing a community cloud is contracting an auditor to conduct a review on behalf of the group of organizations within the cloud community. From the following, to whom should the auditor report the findings?

  A. Public
  B. Management of organization being audited
  C. Shareholders/interested parties
  D. Cloud service provider
  D. Cloud service provider

• Question 27:

  A business unit introducing cloud technologies to the organization without the knowledge or approval of the appropriate governance function is an example of:

  A. IT exception
  B. Threat
  C. Shadow IT
  D. Vulnerability
  C. Shadow IT

• Question 28:

  The effect of which of the following should have priority in planning the scope and objectives of a cloud audit?

  A. Applicable industry good practices
  B. Applicable statutory requirements
  C. Organizational policies and procedures
  D. Applicable corporate standards
  B. Applicable statutory requirements

• Question 29:

  Which of the following cloud models prohibits penetration testing?

  A. Hybrid Cloud
  B. Private Cloud
  C. Public Cloud
  D. Community Cloud
  B. Private Cloud

• Question 30:

  An auditor identifies that a CSP received multiple customer inquiries and RFPs during the last month. Which of the following should be the BEST recommendation to reduce the CSP burden?

  A. CSP can share all security reports with customers to streamline the process.
  B. CSP can schedule a call with each customer.
  C. CSP can answer each customer individually.
  D. CSP can direct all customers' inquiries to the information in the CSA STAR registry.
  D. CSP can direct all customers' inquiries to the information in the CSA STAR registry.