ExamGecko
Login
Home / Isaca / CCAK / List of questions
Ask Question

Isaca CCAK Practice Test - Questions Answers, Page 2

Add to Whishlist

List of questions

Question 11

Report Export Collapse

Which of the following is the BEST tool to perform cloud security control audits?

General Data Protection Regulation (GDPR)
General Data Protection Regulation (GDPR)
ISO 27001
ISO 27001
Federal Information Processing Standard (FIPS) 140-2
Federal Information Processing Standard (FIPS) 140-2
CSA Cloud Control Matrix (CCM)
CSA Cloud Control Matrix (CCM)
Suggested answer: D
Explanation:

Reference: https://www.isaca.org/resources/news-and-trends/newsletters/atisaca/2021/volume-22/preventing-the-nextcybersecurity-attack-with-effective-cloud-security-audits

Isaca CCAK image Question 11 explanation 41431 09182024210218000000

asked 18/09/2024
Jonathan Correa
48 questions

Question 12

Report Export Collapse

Which of the following is an example of a corrective control?

A central anti-virus system installing the latest signature files before allowing a connection to the network
A central anti-virus system installing the latest signature files before allowing a connection to the network
Unsuccessful access attempts being automatically logged for investigation
Unsuccessful access attempts being automatically logged for investigation
Privileged access to critical information systems requiring a second factor of authentication using soft token
Privileged access to critical information systems requiring a second factor of authentication using soft token
All new employees having standard access rights until their manager approves privileged rights
All new employees having standard access rights until their manager approves privileged rights
Suggested answer: C
asked 18/09/2024
Solomon Nidish
41 questions

Question 13

Report Export Collapse

When developing a cloud compliance program, what is the PRIMARY reason for a cloud customer to review which cloud services will be deployed?

To determine how those services will fit within its policies and procedures
To determine how those services will fit within its policies and procedures
To determine the total cost of the cloud services to be deployed
To determine the total cost of the cloud services to be deployed
To confirm which vendor will be selected based on the compliance with security requirements
To confirm which vendor will be selected based on the compliance with security requirements
To confirm if the compensating controls implemented are sufficient for the cloud
To confirm if the compensating controls implemented are sufficient for the cloud
Suggested answer: A
Explanation:

Reference: https://www.isaca.org/credentialing/certificate-of-cloud-auditing-knowledge

asked 18/09/2024
Ibrahim mazou Ismael
54 questions

Question 14

Report Export Collapse

The Cloud Computing Compliance Controls Catalogue (C5) framework is maintained by which of the following agencies?

Agence nationale de la sécurité des systèmes d'information (ANSSI)
Agence nationale de la sécurité des systèmes d'information (ANSSI)
National Institute of Standards and Technology (NIST)
National Institute of Standards and Technology (NIST)
National Security Agency (NSA)
National Security Agency (NSA)
Bundesamt für Sicherheit in der Informationstechnik (BSI)
Bundesamt für Sicherheit in der Informationstechnik (BSI)
Suggested answer: D
Explanation:

Reference: https://docs.microsoft.com/en-us/compliance/regulatory/offering-c5-germany

asked 18/09/2024
Rik Ant
51 questions

Question 15

Report Export Collapse

Which of the following is the MOST feasible way to validate the performance of CSPs for the delivery of technology resources?

Cloud compliance program
Cloud compliance program
Legacy IT compliance program
Legacy IT compliance program
Internal audit program
Internal audit program
Service organization controls report
Service organization controls report
Suggested answer: D
asked 18/09/2024
Kaniamuthan K
51 questions

Question 16

Report Export Collapse

Which of the following would be the MOST critical finding of an application security and DevOps audit?

The organization is not using a unified framework to integrate cloud compliance with regulatory requirements.
The organization is not using a unified framework to integrate cloud compliance with regulatory requirements.
Application architecture and configurations did not consider security measures.
Application architecture and configurations did not consider security measures.
Outsourced cloud service interruption, breach or loss of data stored at the cloud service provider.
Outsourced cloud service interruption, breach or loss of data stored at the cloud service provider.
Certifications with global security standards specific to cloud are not reviewed and the impact of noted findings are not assessed.
Certifications with global security standards specific to cloud are not reviewed and the impact of noted findings are not assessed.
Suggested answer: B
asked 18/09/2024
Luis Hernaiz
46 questions

Question 17

Report Export Collapse

During an audit it was identified that a critical application hosted in an off-premises cloud is not part of the organization's DRP (Disaster Recovery Plan).

Management stated that it is responsible for ensuring that the cloud service provider (CSP) has a plan that is tested annually. What should be the auditor's NEXT course of action?

Review the CSP audit reports.
Review the CSP audit reports.
Review the security white paper of the CSP.
Review the security white paper of the CSP.
Review the contract and DR capability.
Review the contract and DR capability.
Plan an audit of the CSP.
Plan an audit of the CSP.
Suggested answer: B
asked 18/09/2024
Mark Baker
45 questions

Question 18

Report Export Collapse

Organizations maintain mappings between the different control frameworks they adopt to:

help identify controls with common assessment status.
help identify controls with common assessment status.
avoid duplication of work when assessing compliance.
avoid duplication of work when assessing compliance.
help identify controls with different assessment status.
help identify controls with different assessment status.
start a compliance assessment using latest assessment.
start a compliance assessment using latest assessment.
Suggested answer: C
Explanation:

Reference: https://www.isaca.org/resources/news-and-trends/industry-news/2019/employing-cobit-2019-for-enterprisegovernance-strategy

Isaca CCAK image Question 18 explanation 41438 09182024210218000000

asked 18/09/2024
Paul Sanchez
42 questions

Question 19

Report Export Collapse

Which of the following defines the criteria designed by the American Institute of Certified Public Accountants (AICPA) to specify trusted services?

Security, confidentiality, availability, privacy and processing integrity
Security, confidentiality, availability, privacy and processing integrity
Security, applicability, availability, privacy and processing integrity
Security, applicability, availability, privacy and processing integrity
Security, confidentiality, availability, privacy and trustworthiness
Security, confidentiality, availability, privacy and trustworthiness
Security, data integrity, availability, privacy and processing integrity
Security, data integrity, availability, privacy and processing integrity
Suggested answer: A
Explanation:

Reference:

https://us.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/trust-servicescriteria.pdf

Isaca CCAK image Question 19 explanation 41439 09182024210218000000

asked 18/09/2024
Jose M Rivera Vega
38 questions

Question 20

Report Export Collapse

While performing the audit, the auditor found that an object storage bucket containing PII could be accessed by anyone on the Internet. Given this discovery, what should be the most appropriate action for the auditor to perform?

Highlighting the gap to the audit sponsor at the sponsor's earliest possible availability
Highlighting the gap to the audit sponsor at the sponsor's earliest possible availability
Asking the organization's cloud administrator to immediately close the gap by updating the configuration settings and making the object storage bucket private and hence inaccessible from the Internet
Asking the organization's cloud administrator to immediately close the gap by updating the configuration settings and making the object storage bucket private and hence inaccessible from the Internet
Documenting the finding in the audit report and sharing the gap with the relevant stakeholders
Documenting the finding in the audit report and sharing the gap with the relevant stakeholders
Informing the organization's internal audit manager immediately about the gap
Informing the organization's internal audit manager immediately about the gap
Suggested answer: C
Explanation:

Reference: https://www.isaca.org/resources/isaca-journal/issues/2020/volume-1/is-audit-basics-the-components-of-the-itaudit-report

Isaca CCAK image Question 20 explanation 41440 09182024210218000000

asked 18/09/2024
mostafa khalaf
53 questions
Total 195 questions
Go to page: of 20
Open VPLUS File
Convert VPLUS to PDF

Related questions

Policies and procedures shall be established, and supporting business processes and technical measures implemented, for maintenance of several items ensuring continuity and availability of operations and support personnel. Which of the following controls BEST matches this control description?
An organization deploying the Cloud Control Matrix (CCM) to perform a compliance assessment will encompass the use of the "Corporate Governance Relevance" feature to filter out those controls:
With regard to the Cloud Control Matrix (CCM), the 'Architectural Relevance' is a feature that enables the filtering of security controls by:
A certification target helps in the formation of a continuous certification framework by incorporating:
What is below the waterline in the context of cloud operationalization?
To ensure that cloud audit resources deliver the best value to the organization, the PRIMARY step would be to:
Which statement about compliance responsibilities and ownership of accountability is correct?
A Dot Release of Cloud Control Matrix (CCM) indicates what?
When establishing cloud governance, an organization should FIRST test by migrating:
Which of the following would be a logical starting point for an auditor who has been engaged to assess the security of an organization's DevOps pipeline?