Isaca CCAK Online Practice Questions and Exam Preparation

Isaca CCAK Online Questions & Answers

• Question 71:

  Which of the following is the reason for designing the Consensus Assessments Initiative Questionnaire (CAIQ)?

  A. Cloud users can use CAIQ to sign statement of work (SOW) with cloud access security brokers (CASBs).
  B. Cloud service providers can document roles and responsibilities for cloud security.
  C. Cloud service providers can document their security and compliance controls.
  D. Cloud service providers need the CAIQ to improve quality of customer service
  C. Cloud service providers can document their security and compliance controls.

• Question 72:

  Which of the following activities is performed outside information security monitoring?

  A. Management review of the information security framework
  B. Monitoring the effectiveness of implemented controls
  C. Collection and review of security events before escalation
  D. Periodic review of risks, vulnerabilities, likelihoods, and threats
  A. Management review of the information security framework

• Question 73:

  Which of the following provides the BEST evidence that a cloud service provider's continuous integration and continuous delivery (CI/CD) development pipeline includes checks for compliance as new features are added to its Software as a Service (SaaS) applications?

  A. Compliance tests are automated and integrated within the Cl tool.
  B. Developers keep credentials outside the code base and in a secure repository.
  C. Frequent compliance checks are performed for development environments.
  D. Third-party security libraries are continuously kept up to date.
  A. Compliance tests are automated and integrated within the Cl tool.

• Question 74:

  Which of the following is the PRIMARY component to determine the success or failure of an organization's cloud compliance program?

  A. Defining the metrics and indicators to monitor the implementation of the compliance program
  B. Determining the risk treatment options to be used in the compliance program
  C. Mapping who possesses the information and data that should drive the compliance goals
  D. Selecting the external frameworks that will be used as reference
  C. Mapping who possesses the information and data that should drive the compliance goals

• Question 75:

  Which of the following is a KEY benefit of using the Cloud Controls Matrix (CCM)?

  A. CCM utilizes an ITIL framework to define the capabilities needed to manage the IT services and security services.
  B. CCM maps to existing security standards, best practices, and regulations.
  C. CCM uses a specific control for Infrastructure as a Service (laaS).
  D. CCM V4 is an improved version from CCM V3.0.1.
  B. CCM maps to existing security standards, best practices, and regulations.

• Question 76:

  An auditor is reviewing an organization's virtual machines (VMs) hosted in the cloud. The organization utilizes a configuration management (CM) tool to enforce password policies on its VMs. Which of the following is the BEST approach for the auditor to use to review the operating effectiveness of the password requirement?

  A. The auditor should not rely on the CM tool and its settings, and for thoroughness should review the password configuration on the set of sample VMs.
  B. Review the relevant configuration settings on the CM tool and check whether the CM tool agents are operating effectively on the sample VMs.
  C. As it is an automated environment, reviewing the relevant configuration settings on the CM tool would be sufficient.
  D. Review the incident records for any incidents relating to brute force attacks or password compromise in the last 12 months and investigate whether the root cause of the incidents was due to in appropriate password policy configured on the VMs.
  B. Review the relevant configuration settings on the CM tool and check whether the CM tool agents are operating effectively on the sample VMs.

• Question 77:

  Which of the following is a direct benefit of mapping the Cloud Control Matrix (CCM) to other international standards and regulations?

  A. CCM mapping entitles cloud service providers to be listed as an approved supplier for tenders and government contracts.
  B. CCM mapping enables cloud service providers and customers alike to streamline their own compliance and security efforts.
  C. CCM mapping enables an uninterrupted data flow and, in particular, the export of personal data across different jurisdictions.
  D. CCM mapping entitles cloud service providers to be certified under the CSA STAR program.
  B. CCM mapping enables cloud service providers and customers alike to streamline their own compliance and security efforts.

• Question 78:

  Which of the following has the MOST substantial impact on how aggressive or conservative the cloud approach of an organization will be?

  A. Internal policies and technical standards
  B. Risk scoring criteria
  C. Applicable laws and regulations
  D. Risk appetite and budget constraints
  C. Applicable laws and regulations

• Question 79:

  In audit parlance, what is meant by "management representation"?

  A. A person or group of persons representing executive management during audits.
  B. A mechanism to represent organizational structure.
  C. A project management technique to demonstrate management's involvement in key project stages.
  D. Statements made by management in response to specific inquiries.
  D. Statements made by management in response to specific inquiries.

• Question 80:

  A cloud service customer is looking to subscribe to a finance solution provided by a cloud service provider. The provider has clarified that the audit logs cannot be taken out of the cloud environment by the customer to its security information and event management (SIEM) solution for monitoring purposes. Which of the following should be the GREATEST concern to the auditor?

  A. The audit logs are overwritten every 30 days, and all past audit trail is lost.
  B. The audit trails are backed up regularly, but the backup is not encrypted.
  C. The provider does not maintain audit logs in their environment.
  D. The customer cannot monitor its cloud subscription on its own and must rely on the provider for monitoring purposes.
  D. The customer cannot monitor its cloud subscription on its own and must rely on the provider for monitoring purposes.