Home / Isaca / CCAK

Isaca CCAK Practice Test - Questions Answers, Page 12

Question list

List of questions

Question 111

(0)

What is the advantage of using dynamic application security testing (DAST) over static application security testing (SAST) methodology?

Question 112

(0)

Which of the following is a cloud-specific security standard?

Question 113

(0)

Cloud Control Matrix (CCM) controls can be used by cloud customers to:

Question 114

(0)

Account design in the cloud should be driven by:

Question 115

(0)

In the context of Infrastructure as a Service (IaaS), a vulnerability assessment will scan virtual machines to identify vulnerabilities in:

Question 116

(0)

When using a SaaS solution, who is responsible for application security?

Question 117

(0)

The PRIMARY objective for an auditor to understand the organization's context for a cloud audit is to:

Question 118

(0)

A cloud service provider does not allow audits using automated tools as these tools could be considered destructive techniques for the cloud environment. Which of the following aspects of the audit

Question 119

(0)

When establishing cloud governance, an organization should FIRST test by migrating:

Question 120

(0)

When building a cloud governance model, which of the following requirements will focus more on the cloud service provider's evaluation and control checklist?

Question 111

What is the advantage of using dynamic application security testing (DAST) over static application security testing (SAST) methodology?

Unlike SAST, DAST is a blackbox and programming language agnostic.

DAST can dynamically integrate with most CI/CD tools.

DAST delivers more false positives than SAST.

DAST is slower but thorough.

Show Answer Comment (0)

Question 112

Which of the following is a cloud-specific security standard?

ISO27017

ISO27701

ISO22301

ISO14001

Show Answer Comment (0)

Question 113

Cloud Control Matrix (CCM) controls can be used by cloud customers to:

develop new security baselines for the industry.

define different control frameworks for different cloud service providers.

facilitate communication with their legal department.

build an operational cloud risk management program.

Show Answer Comment (0)

Question 114

Account design in the cloud should be driven by:

security requirements.

organizational structure.

business continuity policies.

management structure.

Show Answer Comment (0)

Question 115

In the context of Infrastructure as a Service (IaaS), a vulnerability assessment will scan virtual machines to identify vulnerabilities in:

both operating system and application infrastructure contained within the CSP's instances.

both operating system and application infrastructure contained within the customer's instances

only application infrastructure contained within the CSP's instances.

only application infrastructure contained within the customer's instances.

Show Answer Comment (0)

Question 116

When using a SaaS solution, who is responsible for application security?

The cloud service provider only

The cloud service consumer only

Both cloud consumer and the enterprise

Both cloud provider and the consumer

Show Answer Comment (0)

Question 117

The PRIMARY objective for an auditor to understand the organization's context for a cloud audit is to:

determine whether the organization has carried out control self-assessment and validated audit reports of the cloud service providers (CSP).

validate an understanding of the organization's current state and how the cloud audit plan fits into the existing audit approach.

validate whether an organization has a cloud audit plan in place.

validate the organization's performance effectiveness utilizing cloud service providers (CSP) solutions.

Show Answer Comment (0)

A cloud service provider does not allow audits using automated tools as these tools could be considered destructive techniques for the cloud environment. Which of the following aspects of the audit will be constrained?

Purpose

Objectives

Nature of relationship

Scope

Show Answer Comment (0)

Question 119

When establishing cloud governance, an organization should FIRST test by migrating:

all applications at once to the cloud.

complex applications to the cloud.

legacy applications to the cloud.

a few applications to the cloud.

Show Answer Comment (0)

Question 120

When building a cloud governance model, which of the following requirements will focus more on the cloud service provider's evaluation and control checklist?

Security requirements

Legal requirements

Compliance requirements

Operational requirements

Show Answer Comment (0)

Total 170 questions