Isaca CCAK Online Practice Questions and Exam Preparation

Isaca CCAK Online Questions & Answers

• Question 41:

  An organization is in the initial phases of cloud adoption. It is not very knowledgeable about cloud security and cloud shared responsibility models. Which of the following approaches is BEST suited for such an organization to evaluate its cloud security?

  A. Use of an established standard/regulation to map controls and use as the audit criteria
  B. For efficiency reasons, use of its on-premises systems' audit criteria to audit the cloud environment
  C. As this is the initial stage, the ISO/IEC 27001 certificate shared by the cloud service provider is sufficient for audit and compliance purposes.
  D. Development of the cloud security audit criteria based on its own internal audit test plans to ensure appropriate coverage
  A. Use of an established standard/regulation to map controls and use as the audit criteria

• Question 42:

  Since CCM allows cloud customers to build a detailed list of requirements and controls to be implemented by the CSP as part of their overall third-party risk management and procurement program, will CCM alone be enough to define all the items to be considered when operating/using cloud services?

  A. No. CCM must be completed with definitions established by the CSP because of its relevance to service continuity.
  B. Yes. CCM suffices since it maps a huge library of widely accepted frameworks.
  C. Yes. When implemented in the right manner. CCM alone can help to measure, assess and monitor the risk associated with a CSP or a particular service.
  D. No. CCM can serve as a foundation for a cloud assessment program, but it needs to be completed with requirements applicable to each company.
  A. No. CCM must be completed with definitions established by the CSP because of its relevance to service continuity.

• Question 43:

  Which of the following is a category of trust in cloud computing?

  A. Loyalty-based trust
  B. Background-based trust
  C. Reputation-based trust
  D. Transparency-based trust
  C. Reputation-based trust

• Question 44:

  Which of the following is the PRIMARY area for an auditor to examine in order to understand the criticality of the cloud services in an organization, along with their dependencies and risks?

  A. Contractual documents of the cloud service provider
  B. Heat maps
  C. Data security process flow
  D. Turtle diagram
  B. Heat maps

• Question 45:

  Which of the following is MOST important to consider when developing an effective threat model during the introduction of a new SaaS service into a customer organization's architecture? The threat model:

  A. recognizes the shared responsibility for risk management between the customer and the CSP.
  B. leverages SaaS threat models developed by peer organizations.
  C. is developed by an independent third-party with expertise in the organization's industry sector.
  D. considers the loss of visibility and control from transitioning to the cloud.
  A. recognizes the shared responsibility for risk management between the customer and the CSP.

• Question 46:

  Regarding cloud service provider agreements and contracts, unless otherwise stated, the provider is:

  A. responsible to the cloud customer and its clients.
  B. responsible only to the cloud customer.
  C. not responsible at all to any external parties.
  D. responsible to the cloud customer and its end users
  B. responsible only to the cloud customer.

• Question 47:

  Which of the following types of risk is associated specifically with the use of multi-cloud environments in an organization?

  A. Risk of supply chain visibility and validation
  B. Risk of reduced visibility and control
  C. Risk of service reliability and uptime
  D. Risk of unauthorized access to customer and business data
  B. Risk of reduced visibility and control

• Question 48:

  To ensure a cloud service provider is complying with an organization's privacy requirements, a cloud auditor should FIRST review:

  A. organizational policies, standards, and procedures.
  B. adherence to organization policies, standards, and procedures.
  C. legal and regulatory requirements.
  D. the IT infrastructure.
  A. organizational policies, standards, and procedures.

• Question 49:

  What is a sign of an organization that has adopted a shift-left concept of code release cycles?

  A. A waterfall model to move resources through the development to release phases
  B. Incorporation of automation to identify and address software code problems early
  C. Maturity of start-up entities with high-iteration to low-volume code commits
  D. Large entities with slower release cadences and geographical dispersed systems
  B. Incorporation of automation to identify and address software code problems early

• Question 50:

  The Open Certification Framework is structured on three levels of trust. Those three levels of trust are:

  A. CSA STAR Self-Assessment, STAR Certification and Attestation (Third-party Assessment), STAR Compliance
  B. CSA STAR Audit, STAR Certification and Attestation (Third-party Assessment), STAR Continuous
  C. CSA STAR Self-Assessment, STAR Certification and Attestation (Third-party Assessment), STAR Monitoring and Control
  D. CSA STAR Self-Assessment, STAR Certification and Attestation (Third-party Assessment), STAR Continuous
  D. CSA STAR Self-Assessment, STAR Certification and Attestation (Third-party Assessment), STAR Continuous