Isaca CCAK Online Practice Questions and Exam Preparation

Isaca CCAK Online Questions & Answers

• Question 31:

  The MAIN limitation of relying on traditional cloud compliance assurance approaches such as SOC2 attestations is that:

  A. they can only be performed by skilled cloud audit service providers.
  B. they are subject to change when the regulatory climate changes.
  C. they provide a point-in-time snapshot of an organization's compliance posture.
  D. they place responsibility for demonstrating compliance on the vendor organization.
  C. they provide a point-in-time snapshot of an organization's compliance posture.

• Question 32:

  Market share and geolocation are aspects PRIMARILY related to:

  A. business perspective.
  B. cloud perspective.
  C. risk perspective.
  D. governance perspective.
  A. business perspective.

• Question 33:

  A certification target helps in the formation of a continuous certification framework by incorporating:

  A. CSA STAR level 2 attestation.
  B. service level objective and service qualitative objective.
  C. frequency of evaluating security attributes.
  D. scope description and security attributes to be tested.
  B. service level objective and service qualitative objective.

• Question 34:

  One of the Cloud Control Matrix's (CCM's) control specifications states that "Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations." Which of the following controls under the Audit Assurance and Compliance domain does this match to?

  A. Audit planning
  B. Information system and regulatory mapping
  C. GDPR auditing
  D. Independent audits
  B. Information system and regulatory mapping

• Question 35:

  Which of the following types of SOC reports BEST helps to ensure operating effectiveness of controls in a cloud service provider offering?

  A. SOC 3 Type 2
  B. SOC 2 Type 2
  C. SOC 1 Type 1
  D. SOC 2 Type 1
  B. SOC 2 Type 2

• Question 36:

  Which of the following helps an organization to identify control gaps and shortcomings in the context of cloud computing?

  A. Walk-through peer review
  B. Periodic documentation review
  C. User security awareness training
  D. Monitoring effectiveness
  B. Periodic documentation review

• Question 37:

  Which of the following is the reason for designing the Consensus Assessments Initiative Questionnaire (CAIQ)?

  A. Cloud service providers need the CAIQ to improve quality of customer service.
  B. Cloud service providers can document their security and compliance controls.
  C. Cloud service providers can document roles and responsibilities for cloud security.
  D. Cloud users can use CAIQ to sign statement of work (SOW) with cloud access security
  B. Cloud service providers can document their security and compliance controls.

• Question 38:

  Changes to which of the following will MOST likely influence the expansion or reduction of controls required to remediate the risk arising from changes to an organization's SaaS vendor?

  A. Risk exceptions policy
  B. Contractual requirements
  C. Risk appetite
  D. Board oversight
  C. Risk appetite

• Question 39:

  Which of the following is a detective control that may be identified in a Software as a Service (SaaS) service provider?

  A. Data encryption
  B. Incident management
  C. Network segmentation
  D. Privileged access monitoring
  D. Privileged access monitoring

• Question 40:

  To identify key actors and requirements, which of the following MUST be considered when designing a cloud compliance program?

  A. Cloud service provider, internal and external audit perspectives
  B. Business/organizational, governance, cloud and risk perspectives
  C. Enterprise risk management, data protection, privacy and legal perspectives
  D. Key stakeholders, enterprise risk management, and Internal audit perspectives
  B. Business/organizational, governance, cloud and risk perspectives