Which best describes the difference between a type 1 and a type 2 SOC report?

A type 1 SOC report provides an attestation whereas a type 2 SOC report offers a certification.

A type 2 SOC report validates the operating effectiveness of controls whereas a type 1 SOC report validates the suitability of the design of the controls.

A type 2 SOC report validates the suitability of the design of the controls whereas a type 1 SOC report validates the operating effectiveness of controls.

A type 1 SOC report provides an attestation whereas a type 2 SOC report offers a certification.

There is no difference between a type 2 and type 1 SOC report.

Which of the following parties should have accountability for cloud compliance requirements?

Equally shared between customer and provider

Either customer or provider, depending on requirements

A cloud customer configured and developed a solution on top of the certified cloud services. Building on top of a compliant CSP:

does not necessarily mean that the cloud customer is also compliant.

means that the cloud customer is also compliant.

means that the cloud customer and client are both compliant.

means that the cloud customer is compliant but their client is not compliant.

does not necessarily mean that the cloud customer is also compliant.

An independent contractor is assessing security maturity of a SaaS company against industry standards. The SaaS company has developed and hosted all their products using the cloud services provided by a third-party cloud service provider (CSP). What is the optimal and most efficient mechanism to assess the controlsCSP is responsible for?

Review CSP's published questionnaires.

Review third-party audit reports.

Review CSP's published questionnaires.

Send supplier questionnaire to the CSP.

One of the Cloud Control Matrix's (CCM's) control specifications states that "Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations." Which of the following controls under the Audit Assurance and Compliance domain does this match to?

Information system and regulatory mapping

What data center and physical security measures should a cloud customer consider when assessing a cloud service provider?

Conduct a due diligence to verify the cloud provider applies adequate physical security measures.

Assess use of monitoring systems to control ingress and egress points of entry to the data center.

Implement physical security perimeters to safeguard personnel, data and information systems.

Conduct a due diligence to verify the cloud provider applies adequate physical security measures.

Review internal policies and procedures for relocation of hardware and software to an offsite location.

An auditor identifies that a CSP received multiple customer inquiries and RFPs during the last month. Which of the following should be the BEST recommendation to reduce the CSP burden?

CSP can direct all customers' inquiries to the information in the CSA STAR registry.

CSP can share all security reports with customers to streamline the process.

CSP can schedule a call with each customer.

CSP can answer each customer individually.

CSP can direct all customers' inquiries to the information in the CSA STAR registry.

How should controls be designed by an organization?

Using the organization's risk management framework

Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, ports, and by compensating controls. Which of the following controls BEST matches this control description?

Virtual Instance and OS Hardening

Network Vulnerability Management

Which of the following is a direct benefit of mapping the Cloud Control Matrix (CCM) to other international standards and regulations?

CCM mapping enables cloud service providers and customers alike to streamline their own compliance and security efforts.

CCM mapping entitles cloud service providers to be listed as an approved supplier for tenders and government contracts.

CCM mapping enables cloud service providers and customers alike to streamline their own compliance and security efforts.

CCM mapping enables an uninterrupted data flow and, in particular, the export of personal data across different jurisdictions.

CCM mapping entitles cloud service providers to be certified under the CSA STAR program.

An auditor is performing an audit on behalf of a cloud customer. For assessing security awareness, the auditor should:

not assess the security awareness training program as it is each organization's responsibility

assess the existence and adequacy of a security awareness training program at the cloud service provider's organization as the cloud customer hired the auditor to review and cloud service.

assess the existence and adequacy of a security awareness training program at both the cloud customer's organization and the cloud service provider's organization.

assess the existence and adequacy of a security awareness training program at the cloud customer's organization as they hired the auditor.

not assess the security awareness training program as it is each organization's responsibility

Which of the following would give an auditor the BEST view of design and implementation decisions when an organization uses programmatic automation forInfrastructure as a Service (IaaS) deployments? The visibility of:

output from threat modeling exercises.

results from automated testing.

source code within build scripts.

If the degree of verification for information shared with the auditor during an audit is low, the auditor should:

use professional judgment to determine the degree of reliance that can be placed on the information as evidence.

reject the information as audit evidence.

stop evaluating the requirement altogether and review other audit areas.

delve deeper to obtain the required information to decide conclusively.

use professional judgment to determine the degree of reliance that can be placed on the information as evidence.

Which of the following would be a logical starting point for an auditor who has been engaged to assess the security of an organization's DevOps pipeline?

Review the CI/CD pipeline audit logs.

Verify the inclusion of security gates in the pipeline.

Conduct an architectural assessment.

Review the CI/CD pipeline audit logs.

Verify separation of development and production pipelines.

Which of the following CSP activities requires a client's approval?

Delete the test accounts or destroy test data

Delete the guest account or test accounts

Delete the master account or subscription owner accounts

Delete the guest account or destroy test data

Delete the test accounts or destroy test data

SAST testing is performed by:

scanning the application source code.

scanning the application interface.

scanning all infrastructure components.

performing manual actions to gain control of the application.

When reviewing a third-party agreement with a cloud service provider, which of the following should be the GREATEST concern regarding customer data privacy?

Data retention, backup, and recovery

Return or destruction of information

The MAIN difference between Cloud Control Matrix (CCM) and Consensus Assessment Initiative Questionnaire (CAIQ) is that:

CCM provides a controls framework, whereas CAIQ provides industry-accepted ways to document which security controls exist in IaaS, PaaS, and SaaS offerings.

CCM assesses the presence of controls, whereas CAIQ assesses overall security of a service.

CCM has a set of security questions, whereas CAIQ has a set of security controls.

CCM has 14 domains and CAIQ has 16 domains.

CCM provides a controls framework, whereas CAIQ provides industry-accepted ways to document which security controls exist in IaaS, PaaS, and SaaS offerings.

Which objective is MOST appropriate to measure the effectiveness of password policy?

The number of related incidents decreases.

The number of related incidents increases.

Attempts to log with weak credentials increases.

Newly created account credentials satisfy requirements.

The number of related incidents decreases.

Supply chain agreements between CSP and cloud customers should, at minimum, include:

Audits, assessments and independent verification of compliance certifications with agreement terms

Policies and procedures of the cloud customer

Audits, assessments and independent verification of compliance certifications with agreement terms

Regulatory guidelines impacting the cloud customer

Which of the following is an example of financial business impact?

A DDoS attack renders the customer's cloud inaccessible for 24 hours resulting in millions in lost sales.

A hacker using a stolen administrator identity brings down the SaaS sales and marketing systems, resulting in the inability to process customer orders or manage customer relationships.

While the breach was reported in a timely manner to the CEO, the CFO and CISO blamed each other in public, resulting in a loss of public confidence that led the board to replace all three.

A DDoS attack renders the customer's cloud inaccessible for 24 hours resulting in millions in lost sales.

The cloud provider fails to report a breach of customer personal data from an unsecured server, resulting in GDPR fines of 10 million euro.

What should be the auditor's PRIMARY objective while examining a cloud service provider's (CSP's) SLA?

Verifying whether the SLA caters to the availability requirements of the cloud service customer (CSC)

Verifying whether commensurate compensation in the form of service credits is factored in if the CSC is unable to match its SLA obligations

Verifying whether the SLA includes all the operational matters which are material to the operation of the service

Verifying whether the SLA caters to the availability requirements of the cloud service customer (CSC)

Verifying whether the SLAs are well-defined and measurable

Which of the following contract terms is necessary to meet a company's requirement that needs to move data from one CSP to another?

Transition and data portability

What is the advantage of using dynamic application security testing (DAST) over static application security testing (SAST) methodology?

Unlike SAST, DAST is a blackbox and programming language agnostic.

DAST can dynamically integrate with most CI/CD tools.

DAST delivers more false positives than SAST.

Cloud Control Matrix (CCM) controls can be used by cloud customers to:

define different control frameworks for different cloud service providers.

develop new security baselines for the industry.

define different control frameworks for different cloud service providers.

facilitate communication with their legal department.

build an operational cloud risk management program.

In the context of Infrastructure as a Service (IaaS), a vulnerability assessment will scan virtual machines to identify vulnerabilities in:

only application infrastructure contained within the CSP's instances.

both operating system and application infrastructure contained within the CSP's instances.

both operating system and application infrastructure contained within the customer's instances

only application infrastructure contained within the CSP's instances.

only application infrastructure contained within the customer's instances.

When using a SaaS solution, who is responsible for application security?

The cloud service provider only

The cloud service consumer only

Both cloud consumer and the enterprise

Both cloud provider and the consumer

The PRIMARY objective for an auditor to understand the organization's context for a cloud audit is to:

validate an understanding of the organization's current state and how the cloud audit plan fits into the existing audit approach.

determine whether the organization has carried out control self-assessment and validated audit reports of the cloud service providers (CSP).

validate an understanding of the organization's current state and how the cloud audit plan fits into the existing audit approach.

validate whether an organization has a cloud audit plan in place.

validate the organization's performance effectiveness utilizing cloud service providers (CSP) solutions.

When establishing cloud governance, an organization should FIRST test by migrating:

a few applications to the cloud.

all applications at once to the cloud.

complex applications to the cloud.

legacy applications to the cloud.

a few applications to the cloud.

Isaca CCAK Practice Test 3 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Isaca CCAK Practice Test 3

Question

Isaca CCAK Practice Tests

Practice Tests