Isaca Cloud Security Alliance CCAK Questions & Answers

• Question 31:

  Which of the following is the common cause of misconfiguration in a cloud environment?

  A. Absence of effective change control

  B. Using multiple cloud service providers

  C. New cloud computing techniques

  D. Traditional change process mechanisms

  Correct Answer: A

  Reference: https://businessinsights.bitdefender.com/the-top-5-cloud-threats-that-smbs-need-to-address

• Question 32:

  Which of the following standards is designed to be used by organizations for cloud services that intend to select controls within the process of implementing an Information Security Management System based on ISO/IEC 27001?

  A. ISO/IEC 27017:2015

  B. CSA Cloud Control Matrix (CCM)

  C. NIST SP 800-146

  D. ISO/IEC 27002

  Correct Answer: D

  Reference: https://cyber.gc.ca/en/guidance/guidance-cloud-security-assessment-and-authorizationitsp50105

• Question 33:

  A. Cloud service provider, internal and external audit perspectives

  B. Business/organizational, governance, cloud and risk perspectives

  C. Enterprise risk management, data protection, privacy and legal perspectives

  D. Key stakeholders, enterprise risk management, and Internal audit perspectives

  Correct Answer: B

• Question 34:

  The BEST way to deliver continuous compliance in a cloud environment is to:

  A. decrease the interval between attestations of compliance.

  B. combine point-in-time assurance approaches with continuous monitoring.

  C. increase the frequency of external audits from annual to quarterly.

  D. combine point-in-time assurance approaches with continuous auditing.

  Correct Answer: B

• Question 35:

  When establishing cloud governance, an organization should FIRST test by migrating:

  A. all applications at once to the cloud.

  B. complex applications to the cloud.

  C. legacy applications to the cloud.

  D. a few applications to the cloud.

  Correct Answer: D

• Question 36:

  When reviewing a third-party agreement with a cloud service provider, which of the following should be

  the GREATEST concern regarding customer data privacy?

  A. Data retention, backup, and recovery

  B. Patch management process

  C. Return or destruction of information

  D. Network intrusion detection

  Correct Answer: A

  Reference: https://arxiv.org/pdf/1303.4814.pdf

• Question 37:

  A. Updated audit/work program

  B. Documentation criteria for the audit evidence

  C. Processes and systems to be audited

  D. Testing procedure to be performed

  Correct Answer: B

• Question 38:

  A. Cloud compliance program

  B. Legacy IT compliance program

  C. Internal audit program

  D. Service organization controls report

  Correct Answer: D

• Question 39:

  What data center and physical security measures should a cloud customer consider when assessing a cloud service provider?

  A. Assess use of monitoring systems to control ingress and egress points of entry to the data center.

  B. Implement physical security perimeters to safeguard personnel, data and information systems.

  C. Conduct a due diligence to verify the cloud provider applies adequate physical security measures.

  D. Review internal policies and procedures for relocation of hardware and software to an offsite location.

  Correct Answer: C

  Reference: https://www.omg.org/cloud/deliverables/CSCC-Security-for-Cloud-Computing-10-Steps-toEnsure-Success.pdf

• Question 40:

  A large organization with subsidiaries in multiple locations has a business requirement to organize IT systems to have identified resources reside in particular locations with organizational personnel. Which access control method will allow IT personnel to be segregated across the various locations?

  A. Role Based Access Control

  B. Attribute Based Access Control

  C. Policy Based Access Control

  D. Rule Based Access Control

  Correct Answer: A