Which of the following metrics are frequently immature?

Metrics around Infrastructure as a Service (IaaS) storage and network environments

Metrics around Platform as a Service (PaaS) development environments

Metrics around Infrastructure as a Service (IaaS) computing environments

Metrics around specific Software as a Service (SaaS) application services

From the perspective of a senior cloud security audit practitioner in an organization of a mature security program with cloud adoption, which of the following statements BEST describes the DevSecOps concept?

Development standards for addressing integration, testing, and deployment issues

Process of security integration using automation in software development

Development standards for addressing integration, testing, and deployment issues

Operational framework that promotes software consistency through automation

Making software development simpler, faster, and easier using automation

The Open Certification Framework is structured on three levels of trust. Those three levels of trust are:

CSA STAR Self-Assessment, STAR Certification & Attestation (Third-party Assessment), STAR Continuous

CSA STAR Self-Assessment, STAR Certification & Attestation (Third-party Assessment), STAR Compliance

CSA STAR Audit, STAR Certification & Attestation (Third-party Assessment), STAR Continuous

CSA STAR Self-Assessment, STAR Certification & Attestation (Third-party Assessment), STAR Monitoring and Control

CSA STAR Self-Assessment, STAR Certification & Attestation (Third-party Assessment), STAR Continuous

Due to cloud audit team resource constraints, an audit plan as initially approved cannot be completed. Assuming that the situation is communicated in the cloud audit report, which course of action is MOST relevant?

Focusing on auditing high-risk areas

Testing the adequacy of cloud controls design

Relying on management testing of cloud controls

Testing the operational effectiveness of cloud controls

The criteria for limiting services allowing non-critical services or services requiring high availability and resilience to be moved to the cloud is an important consideration to be included PRIMARILY in the:

information security standard for cloud technologies.

When applying the Top Threats Analysis methodology following an incident, what is the scope of the technical impact identification step?

Determine the impact on the physical and environmental security of the organization, excluding informational assets.

Determine the impact on the controls that were selected by the organization to respond to identified risks.

Determine the impact on confidentiality, integrity and availability of the information system.

Determine the impact on the financial, operational, compliance and reputation of the organization.

Determine the impact on the physical and environmental security of the organization, excluding informational assets.

An organization deploying the Cloud Control Matrix (CCM) to perform a compliance assessment will encompass the use of the "Corporate GovernanceRelevance" feature to filter out those controls:

relating to policies, processes, laws, regulations, and institutions conditioning the way an organization is managed, directed, or controlled.

that can be either of a management or of a legal nature, therefore requiring an approval from the Change Advisory Board.

that require the prior approval from the Board of Directors to be funded (for either make or buy), implemented, and reported on.

that can be either of an administrative or of a technical nature, therefore requiring an approval from the Change Advisory Board.

Which of the following is the BEST tool to perform cloud security control audits?

General Data Protection Regulation (GDPR)

Federal Information Processing Standard (FIPS) 140-2

Which of the following is an example of a corrective control?

Privileged access to critical information systems requiring a second factor of authentication using soft token

A central anti-virus system installing the latest signature files before allowing a connection to the network

Unsuccessful access attempts being automatically logged for investigation

Privileged access to critical information systems requiring a second factor of authentication using soft token

All new employees having standard access rights until their manager approves privileged rights

When developing a cloud compliance program, what is the PRIMARY reason for a cloud customer to review which cloud services will be deployed?

To determine how those services will fit within its policies and procedures

To determine the total cost of the cloud services to be deployed

To confirm which vendor will be selected based on the compliance with security requirements

To confirm if the compensating controls implemented are sufficient for the cloud

The Cloud Computing Compliance Controls Catalogue (C5) framework is maintained by which of the following agencies?

Bundesamt für Sicherheit in der Informationstechnik (BSI)

Agence nationale de la sécurité des systèmes d'information (ANSSI)

National Institute of Standards and Technology (NIST)

Bundesamt für Sicherheit in der Informationstechnik (BSI)

Which of the following is the MOST feasible way to validate the performance of CSPs for the delivery of technology resources?

Service organization controls report

Which of the following would be the MOST critical finding of an application security and DevOps audit?

Application architecture and configurations did not consider security measures.

The organization is not using a unified framework to integrate cloud compliance with regulatory requirements.

Application architecture and configurations did not consider security measures.

Outsourced cloud service interruption, breach or loss of data stored at the cloud service provider.

Certifications with global security standards specific to cloud are not reviewed and the impact of noted findings are not assessed.

During an audit it was identified that a critical application hosted in an off-premises cloud is not part of the organization's DRP (Disaster Recovery Plan).Management stated that it is responsible for ensuring that the cloud service provider (CSP) has a plan that is tested annually. What should be the auditor's NEXT course of action?

Review the security white paper of the CSP.

Review the contract and DR capability.

Organizations maintain mappings between the different control frameworks they adopt to:

help identify controls with different assessment status.

help identify controls with common assessment status.

avoid duplication of work when assessing compliance.

help identify controls with different assessment status.

start a compliance assessment using latest assessment.

Which of the following defines the criteria designed by the American Institute of Certified Public Accountants (AICPA) to specify trusted services?

Security, confidentiality, availability, privacy and processing integrity

Security, applicability, availability, privacy and processing integrity

Security, confidentiality, availability, privacy and trustworthiness

Security, data integrity, availability, privacy and processing integrity

While performing the audit, the auditor found that an object storage bucket containing PII could be accessed by anyone on the Internet. Given this discovery, what should be the most appropriate action for the auditor to perform?

Documenting the finding in the audit report and sharing the gap with the relevant stakeholders

Highlighting the gap to the audit sponsor at the sponsor's earliest possible availability

Asking the organization's cloud administrator to immediately close the gap by updating the configuration settings and making the object storage bucket private and hence inaccessible from the Internet

Documenting the finding in the audit report and sharing the gap with the relevant stakeholders

Informing the organization's internal audit manager immediately about the gap

Which of the following is the common cause of misconfiguration in a cloud environment?

Absence of effective change control

Using multiple cloud service providers

Traditional change process mechanisms

The BEST method to report continuous assessment of a cloud provider's services to the CSA is through:

CCM assessment by a third-party auditor on a periodic basis.

a set of dedicated application programming interfaces (APIs).

CCM assessment by a third-party auditor on a periodic basis.

tools selected by the third-party auditor.

Which of the following is the MOST important audit scope document when conducting a review of a cloud service provider?

Documentation criteria for the audit evidence

Processes and systems to be audited

Testing procedure to be performed

Prioritizing assurance activities for an organization's cloud services portfolio depends PRIMARILY on an organization's ability to:

schedule frequent reviews with high-risk cloud service providers.

develop plans using a standardized risk-based approach.

maintain a comprehensive cloud service inventory.

collate views from various business functions using cloud services.

Which of the following has the MOST substantial impact on how aggressive or conservative the cloud approach of an organization will be?

Applicable laws and regulations

Internal policies and technical standards

Applicable laws and regulations

Risk appetite and budget constraints

Which of the following is the BEST way for a client to enforce a policy violation committed by a cloud service provider (CSP)?

The violation is agreed upon and documented.

Nothing can be done to enforce violations as this is a cloud service.

The violation is agreed to verbally by the CSP.

Violations will be automatically enforced so no action is needed.

With regard to the Cloud Control Matrix (CCM), the 'Architectural Relevance' is a feature that enables the filtering of security controls by:

relevant architectural components such as Physical, Network, Compute, Storage, Application, and Data.

relevant architecture frameworks such as the NIST Enterprise Architecture Model, the Federal Enterprise Architecture Framework (FEAF), The Open GroupArchitecture Framework (TOGAF), and the Zachman Framework for Enterprise Architecture.

relevant delivery models such as Software as a Service, Platform as a Service, Infrastructure as a Service.

relevant architectural paradigms such as Client-Server, Mainframe, Peer-to-Peer, and SmartClient-Backend.

relevant architectural components such as Physical, Network, Compute, Storage, Application, and Data.

The PRIMARY objective of an audit initiation meeting with a cloud audit client is to:

discuss the scope of the cloud audit.

select the methodology of the audit.

review requested evidence provided by the audit client.

discuss the scope of the cloud audit.

identify resource requirements of the cloud audit.

Customer management interface, if compromised over public internet, can lead to:

customer's computing and data compromise.

access to the RAM of neighboring cloud computer.

ease of acquisition of cloud services.

Which of the following is the BEST recommendation to offer an organization's HR department planning to adopt a new public SaaS application to ease the recruiting process?

Implement a cloud access security broker

Do not allow data to be in cleratext

An organization is in the initial phases of cloud adoption. It is not very knowledgeable about cloud security and cloud shared responsibility models. Which of the following approaches is BEST suited for such an organization to evaluate its cloud security?

Use of an established standard/regulation to map controls and use as the audit criteria

For efficiency reasons, use of its on-premises systems' audit criteria to audit the cloud environment

As this is the initial stage, the ISO/IEC 27001 certificate shared by the cloud service provider is sufficient for audit and compliance purposes.

Development of the cloud security audit criteria based on its own internal audit test plans to ensure appropriate coverage

Isaca CCAK Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

Which of the following BEST ensures adequate restriction on the number of people who can access the pipeline production environment?

Ensuring segregation of duties in the production and development pipelines.

Role-based access controls in the production and development pipelines.

Separation of production and development pipelines.

Periodic review of the Cl/CD pipeline audit logs to identify any access violations.

Comment (0)

Isaca CCAK Practice Test 1

Question

Isaca CCAK Practice Tests

Practice Tests