An auditor is reviewing an organization's virtual machines (VMs) hosted in the cloud. The organization utilizes a configuration management (CM) tool to enforce password policies on its VMs. Which of the following is the BEST approach for the auditor to use to review the operating effectiveness of the password requirement?

Review the relevant configuration settings on the CM tool and check whether the CM tool agents are operating effectively on the sample VMs.

The auditor should not rely on the CM tool and its settings, and for thoroughness should review the password configuration on the set of sample VMs.

Review the relevant configuration settings on the CM tool and check whether the CM tool agents are operating effectively on the sample VMs.

As it is an automated environment, reviewing the relevant configuration settings on the CM tool would be sufficient.

Review the incident records for any incidents relating to brute force attacks or password compromise in the last 12 months and investigate whether the root cause of the incidents was due to in appropriate password policy configured on the VMs.

Which of the following is the MOST important strategy and governance documents to provide to the auditor prior to a cloud service provider review?

Enterprise cloud strategy and policy, as well as the enterprise cloud security strategy

Enterprise cloud strategy and policy, as well as inventory of third-party attestation reports

Policies and procedures established around third-party risk assessments, including questionnaires that are required to be completed to assess risk associated with use of third-party services

Enterprise cloud strategy and policy, as well as the enterprise cloud security strategy

Inventory of third-party attestation reports and enterprise cloud security strategy

From the perspective of a senior cloud security audit practitioner in an organization with a mature security program and cloud adoption, which of the following statements BEST describes the DevSecOps concept?

Process of security integration using automation in software development

Operational framework that promotes software consistency through automation

Development standards for addressing integration, testing, and deployment issues

Making software development simpler, faster, and easier using automation

Which of the following BEST describes the difference between a Type 1 and a Type 2 SOC report?

A Type 2 SOC report validates the operating effectiveness of controls, whereas a Type 1 SOC report validates the suitability of the design of the controls.

A Type 1 SOC report provides an attestation, whereas a Type 2 SOC report offers a certification.

A Type 2 SOC report validates the suitability of the control design, whereas a Type 1 SOC report validates the operating effectiveness of controls.

There is no difference between a Type 2 and a Type 1 SOC report.

Which of the following is a KEY benefit of using the Cloud Controls Matrix (CCM)?

CCM maps to existing security standards, best practices, and regulations.

CCM uses a specific control for Infrastructure as a Service (IaaS).

CCM maps to existing security standards, best practices, and regulations.

CCM V4 is an improved version from CCM V3.0.1.

CCM utilizes an ITIL framework to define the capabilities needed to manage the IT services and security services.

A cloud service customer is looking to subscribe to a finance solution provided by a cloud service provider. The provider has clarified that the audit logs cannot be taken out of the cloud environment by the customer to its security information and event management (SIEM) solution for monitoring purposes. Which of the following should be the GREATEST concern to the auditor?

The customer cannot monitor its cloud subscription on its own and must rely on the provider for monitoring purposes.

The audit logs are overwritten every 30 days, and all past audit trail is lost.

The audit trails are backed up regularly, but the backup is not encrypted.

The provider does not maintain audit logs in their environment.

The customer cannot monitor its cloud subscription on its own and must rely on the provider for monitoring purposes.

As Infrastructure as a Service (laaS) cloud service providers often do not allow the cloud service customers to perform on-premise audits, the BEST approach for the auditor should be to:

use other sources of available data for evaluating the customer's controls.

recommend that the customer not use the services provided by the provider.

refrain from auditing the provider's security controls due to lack of cooperation.

escalate the lack of support from the provider to the regulatory authority.

Which of the following is MOST important to ensure effective cloud application controls are maintained in an organization?

Application team internal review

To ensure that cloud audit resources deliver the best value to the organization, the FIRST step is to:

develop a cloud audit plan on the basis of a detailed risk assessment.

schedule the audits and monitor the time spent on each audit.

monitor progress of audits and initiate cost control measures.

develop a cloud audit plan on the basis of a detailed risk assessment.

train the cloud audit staff on current technology used in the organization.

An auditor is auditing the services provided by a cloud service provider. When evaluating the security of the cloud customer's data in the cloud, which of the following should be of GREATEST concern to the auditor?

Personally identifiable information (Pll) is pseudonymized but not fully encrypted.

The cloud customer has encrypted the confidential data in the cloud using its own encryption keys.

The confidential data stored in the cloud is encrypted using encryption keys that are managed by the provider.

According to the cloud customer's data handling policy, all confidential data should be encrypted, but the confidential data stored in the cloud is well segmented but not encrypted.

When performing audits in relation to the organizational strategy and governance, what should be requested from the cloud service provider?

Enterprise cloud security strategy

Enterprise cloud strategy and policy

What should be the auditor's PRIMARY objective when examining a cloud service provider's service level agreement (SLA)?

Verifying whether the SLAs are well defined and measurable

Verifying whether the SLA includes all the operational matters that are material to the operation of the service

Verifying whether the SLAs are well defined and measurable

Verifying whether commensurate compensation in the form of service credits are factored in if the customer is unable to match its SLA obligations

Verifying whether the SLA caters to the availability requirements of the cloud service customer

For an auditor auditing an organization's cloud resources, which of the following should be of GREATEST concern?

The organization does not perform periodic reviews or control monitoring for its cloud environment, but it has a documented audit plan and performs an audit for its cloud environment every alternate year.

The organization does not have separate policies for governing its cloud environment.

The organization's IT team does not include resources with cloud certifications.

The organization does not perform periodic reviews or control monitoring for its cloud environment, but it has a documented audit plan and performs an audit for its cloud environment every alternate year.

The risk management team reports to the head of audit.

Which of the following cloud service models creates a cloud version of a contract template?

Infrastructure as a Service (laaS)

To ensure that compliance obligations for data residency in the cloud are aligned with an organization's risk appetite, which of the following activities is MOST important to perform?

Manage compliance obligations through a structured risk management process.

Communicate the organization's risk appetite across cloud service providers.

Perform a cloud vendor assessment every time there is a change to data flows.

Develop risk metrics to show how the organization is meeting the obligations.

The Cloud Computing Compliance Controls Catalogue (C5) framework is maintained by which of the following agencies?

Federal Office for Information Security in Germany (BSI) / Bundesamt fur Sicherheit in der Informationstechnik (BSI)

National Institute of Standards and Technology (NIST)

National Cybersecurity Agency of France (ANSSI) / Agency national de la securite des systems information (ANSSI)

Federal Office for Information Security in Germany (BSI) / Bundesamt fur Sicherheit in der Informationstechnik (BSI)

Which of the following are independent assessment organizations that verify cloud providers' security implementations and provide the overall risk posture of a cloud environment for a FedRAMP security authorization decision?

Third-party Assessment Organizations (3PAOs)

FedRAMP Program Management Office (FedRAMP PMO)

American Association of Laboratory Accreditation (A2LA)

Third-party Assessment Organizations (3PAOs)

FedRAMP Joint Authorization Boards (JABs)

Which of the following is a tool that visually depicts the gaps in an organization's security capabilities?

Cloud security alliance (CSA) enterprise architecture (EA)

Cloud security alliance (CSA) cloud control matrix

Requirements traceability matrix

Cloud security alliance (CSA) enterprise architecture (EA)

Colored impact and likelihood risk matrix

Which of the following configuration change controls is acceptable to a cloud auditor?

Programmers cannot make uncontrolled changes to the source code production version.

Programmers have permanent access to production software.

Programmers cannot make uncontrolled changes to the source code production version.

Development, test, and production are hosted in the same network environment.

The head of development approves changes requested to production.

The MAIN difference between the Cloud Controls Matrix (CCM) and the Consensus Assessment Initiative Questionnaire (CAIQ) is that:

CCM provides a controls framework, whereas CAIQ provides industry-accepted ways to document which security controls exist in Infrastructure as a Service (laaS), Platform as a Service (PaaS), and Software as a Service (SaaS) offerings.

CCM assesses the presence of controls, whereas CAIQ assesses the overall security of a service.

CCM has 14 domains, whereas CAIQ has 16 domains.

CCM provides a controls framework, whereas CAIQ provides industry-accepted ways to document which security controls exist in Infrastructure as a Service (laaS), Platform as a Service (PaaS), and Software as a Service (SaaS) offerings.

CCM has a set of security questions, whereas CAIQ has a set of security controls.

The control domain feature within a Cloud Controls Matrix (CCM) represents:

a logical grouping of security controls addressing the same category of IT risks or information security concerns.

CCM's ability to scan and check Active Directory, LDAP, and x.500 directories for suspicious and/or privileged user accounts.

a logical grouping of security controls addressing the same category of IT risks or information security concerns.

a set of application programming interfaces (APIs) that allows a cloud consumer to restrict the replication area within a well-defined jurisdictional perimeter.

CCM's ability to scan for anomalies in DNS zones in order to detect DNS spoofing, DNS hijacking, DNS cache poisoning, and similar threats.

Which of the following is MOST important for an auditor to understand regarding cloud security controls?

Controls adapt to changes in the threat landscape.

Controls are the responsibility of the cloud service provider.

Controls are the responsibility of the internal audit team.

Controls are static and do not change.

Which of the following is MOST important to consider when an organization is building a compliance program for the cloud?

The rapidly changing service portfolio and architecture of the cloud

The similarity of the cloud to the on-premise environment in terms of compliance

The fairly static nature of the service portfolio and architecture of the cloud

The rapidly changing service portfolio and architecture of the cloud

That cloud providers should not be part of the compliance program

As part of continuous auditing, which of the following should a third-party auditor verify on a regular basis?

Assessment tools are configured based on cloud security best practices.

Reporting tools are reliable and based on defined objectives.

The cloud service provider is compliant.

Assessment tools are configured based on cloud security best practices.

Application programming interfaces (APIs) implemented are appropriate.

Which of the following is the BEST recommendation to offer an organization's HR department planning to adopt a new public Software as a Service (SaaS) application to ease the recruiting process?

Implement a cloud access security broker (CASB).

Do not allow data to be in clear text.

Which of the following is a PRIMARY benefit of using a standardized control framework?

It enables auditors to assess an information system based on a well-defined set of controls.

It enables senior management to receive regular and detailed executive reports easily.

It enables the organization to implement an effective process of control measurement.

It enables auditors to assess an information system based on a well-defined set of controls.

It enables consultants to speed up the implementation of management systems, thus reducing costs.

Isaca CCAK Practice Test 5 - Free Online Exam Prep & Questions

Which of the following provides the BEST evidence that a cloud service provider's continuous integration and continuous delivery (CI/CD) development pipeline includes checks for compliance as new features are added to its Software as a Service (SaaS) applications?

Become a Premium Member for full access

Unlock Premium Member

Isaca CCAK Practice Test 5

Question

Isaca CCAK Practice Tests

Practice Tests