Home / Isaca / CCAK

Isaca CCAK Practice Test - Questions Answers, Page 10

Question list

List of questions

Question 91

(0)

Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least

Question 92

(0)

Which of the following is a direct benefit of mapping the Cloud Control Matrix (CCM) to other international standards and regulations?

Question 93

(0)

An auditor is performing an audit on behalf of a cloud customer. For assessing security awareness, the auditor should:

Question 94

(0)

Which of the following would give an auditor the BEST view of design and implementation decisions when an organization uses programmatic automation for Infrastructure as a Service (IaaS) deployment

Question 95

(0)

If the degree of verification for information shared with the auditor during an audit is low, the auditor should:

Question 96

(0)

What should be an organization's control audit schedule of a cloud service provider's business continuity plan and operational resilience policy?

Question 97

(0)

Which of the following would be a logical starting point for an auditor who has been engaged to assess the security of an organization's DevOps pipeline?

Question 98

(0)

Which of the following CSP activities requires a client's approval?

Question 99

(0)

An organization has an ISMS implemented, following ISO 27001 and Annex A controls. The CIO would like to migrate some of the infrastructure to the cloud. Which of the following standards would BEST

Question 100

(0)

SAST testing is performed by:

Question 91

Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, ports, and by compensating controls. Which of the following controls BEST matches this control description?

Network Security

Change Detection

Virtual Instance and OS Hardening

Network Vulnerability Management

Show Answer Comment (0)

Question 92

Which of the following is a direct benefit of mapping the Cloud Control Matrix (CCM) to other international standards and regulations?

CCM mapping entitles cloud service providers to be listed as an approved supplier for tenders and government contracts.

CCM mapping enables cloud service providers and customers alike to streamline their own compliance and security efforts.

CCM mapping enables an uninterrupted data flow and, in particular, the export of personal data across different jurisdictions.

CCM mapping entitles cloud service providers to be certified under the CSA STAR program.

Show Answer Comment (0)

Question 93

An auditor is performing an audit on behalf of a cloud customer. For assessing security awareness, the auditor should:

assess the existence and adequacy of a security awareness training program at the cloud service provider's organization as the cloud customer hired the auditor to review and cloud service.

assess the existence and adequacy of a security awareness training program at both the cloud customer's organization and the cloud service provider's organization.

assess the existence and adequacy of a security awareness training program at the cloud customer's organization as they hired the auditor.

not assess the security awareness training program as it is each organization's responsibility

Show Answer Comment (0)

Question 94

Which of the following would give an auditor the BEST view of design and implementation decisions when an organization uses programmatic automation for

Infrastructure as a Service (IaaS) deployments? The visibility of:

output from threat modeling exercises.

results from automated testing.

source code within build scripts.

service level agreements.

Show Answer Comment (0)

Question 95

If the degree of verification for information shared with the auditor during an audit is low, the auditor should:

reject the information as audit evidence.

stop evaluating the requirement altogether and review other audit areas.

delve deeper to obtain the required information to decide conclusively.

use professional judgment to determine the degree of reliance that can be placed on the information as evidence.

Show Answer Comment (0)

Question 96

What should be an organization's control audit schedule of a cloud service provider's business continuity plan and operational resilience policy?

Annual

Quarterly

Monthly

Semi-annual

Show Answer Comment (0)

Question 97

Which of the following would be a logical starting point for an auditor who has been engaged to assess the security of an organization's DevOps pipeline?

Verify the inclusion of security gates in the pipeline.

Conduct an architectural assessment.

Review the CI/CD pipeline audit logs.

Verify separation of development and production pipelines.

Show Answer Comment (0)

Question 98

Which of the following CSP activities requires a client's approval?

Delete the guest account or test accounts

Delete the master account or subscription owner accounts

Delete the guest account or destroy test data

Delete the test accounts or destroy test data

Show Answer Comment (0)

Question 99

An organization has an ISMS implemented, following ISO 27001 and Annex A controls. The CIO would like to migrate some of the infrastructure to the cloud.

Which of the following standards would BEST assist in identifying controls to consider for this migration?

ISO/IEC 27701

ISO/IEC 22301

ISO/IEC 27002

ISO/IEC 27017

Show Answer Comment (0)