Home / Isaca / CCAK

Isaca CCAK Practice Test - Questions Answers, Page 11

Question list

List of questions

Question 101

(0)

A large organization with subsidiaries in multiple locations has a business requirement to organize IT systems to have identified resources reside in particular locations with organizational personn

Question 102

(0)

When reviewing a third-party agreement with a cloud service provider, which of the following should be the GREATEST concern regarding customer data privacy?

Question 103

(0)

The MAIN difference between Cloud Control Matrix (CCM) and Consensus Assessment Initiative Questionnaire (CAIQ) is that:

Question 104

(0)

Which objective is MOST appropriate to measure the effectiveness of password policy?

Question 105

(0)

Supply chain agreements between CSP and cloud customers should, at minimum, include:

Question 106

(0)

Which of the following is an example of financial business impact?

Question 107

(0)

What should be the auditor's PRIMARY objective while examining a cloud service provider's (CSP's) SLA?

Question 108

(0)

The MOST critical concept of managing the build and test of code in DevOps is:

Question 109

(0)

A CSP contracts for a penetration test to be conducted on its infrastructures. The auditor engages the target with no prior knowledge of its defenses, assets, or channels. The CSP's security operati

Question 110

(0)

Which of the following contract terms is necessary to meet a company's requirement that needs to move data from one CSP to another?

Question 101

A large organization with subsidiaries in multiple locations has a business requirement to organize IT systems to have identified resources reside in particular locations with organizational personnel. Which access control method will allow IT personnel to be segregated across the various locations?

Role Based Access Control

Attribute Based Access Control

Policy Based Access Control

Rule Based Access Control

Show Answer Comment (0)

Question 102

When reviewing a third-party agreement with a cloud service provider, which of the following should be the GREATEST concern regarding customer data privacy?

Data retention, backup, and recovery

Patch management process

Return or destruction of information

Network intrusion detection

Show Answer Comment (0)

Question 103

The MAIN difference between Cloud Control Matrix (CCM) and Consensus Assessment Initiative Questionnaire (CAIQ) is that:

CCM assesses the presence of controls, whereas CAIQ assesses overall security of a service.

CCM has a set of security questions, whereas CAIQ has a set of security controls.

CCM has 14 domains and CAIQ has 16 domains.

CCM provides a controls framework, whereas CAIQ provides industry-accepted ways to document which security controls exist in IaaS, PaaS, and SaaS offerings.

Show Answer Comment (0)

Question 104

Which objective is MOST appropriate to measure the effectiveness of password policy?

The number of related incidents increases.

Attempts to log with weak credentials increases.

Newly created account credentials satisfy requirements.

The number of related incidents decreases.

Show Answer Comment (0)

Question 105

Supply chain agreements between CSP and cloud customers should, at minimum, include:

Organization chart of the CSP

Policies and procedures of the cloud customer

Audits, assessments and independent verification of compliance certifications with agreement terms

Regulatory guidelines impacting the cloud customer

Show Answer Comment (0)

Question 106

Which of the following is an example of financial business impact?

A hacker using a stolen administrator identity brings down the SaaS sales and marketing systems, resulting in the inability to process customer orders or manage customer relationships.

While the breach was reported in a timely manner to the CEO, the CFO and CISO blamed each other in public, resulting in a loss of public confidence that led the board to replace all three.

A DDoS attack renders the customer's cloud inaccessible for 24 hours resulting in millions in lost sales.

The cloud provider fails to report a breach of customer personal data from an unsecured server, resulting in GDPR fines of 10 million euro.

Show Answer Comment (0)

Question 107

What should be the auditor's PRIMARY objective while examining a cloud service provider's (CSP's) SLA?

Verifying whether commensurate compensation in the form of service credits is factored in if the CSC is unable to match its SLA obligations

Verifying whether the SLA includes all the operational matters which are material to the operation of the service

Verifying whether the SLA caters to the availability requirements of the cloud service customer (CSC)

Verifying whether the SLAs are well-defined and measurable

Show Answer Comment (0)

Question 108

The MOST critical concept of managing the build and test of code in DevOps is:

continuous build.

continuous delivery.

continuous deployment.

continuous integration.

Show Answer Comment (0)

Question 109

A CSP contracts for a penetration test to be conducted on its infrastructures. The auditor engages the target with no prior knowledge of its defenses, assets, or channels. The CSP's security operation center is not notified in advance of the scope of the audit and the test vectors. Which mode is selected by the CSP?

Double gray box

Tandem

Reversal

Double blind

Show Answer Comment (0)