Home / Isaca / CCAK

Isaca CCAK Practice Test - Questions Answers, Page 2

Question list

List of questions

Question 11

(0)

Which of the following is the BEST tool to perform cloud security control audits?

Question 12

(0)

Which of the following is an example of a corrective control?

Question 13

(0)

When developing a cloud compliance program, what is the PRIMARY reason for a cloud customer to review which cloud services will be deployed?

Question 14

(0)

The Cloud Computing Compliance Controls Catalogue (C5) framework is maintained by which of the following agencies?

Question 15

(0)

Which of the following is the MOST feasible way to validate the performance of CSPs for the delivery of technology resources?

Question 16

(0)

Which of the following would be the MOST critical finding of an application security and DevOps audit?

Question 17

(0)

During an audit it was identified that a critical application hosted in an off-premises cloud is not part of the organization's DRP (Disaster Recovery Plan). Management stated that it is responsibl

Question 18

(0)

Organizations maintain mappings between the different control frameworks they adopt to:

Question 19

(0)

Which of the following defines the criteria designed by the American Institute of Certified Public Accountants (AICPA) to specify trusted services?

Question 20

(0)

While performing the audit, the auditor found that an object storage bucket containing PII could be accessed by anyone on the Internet. Given this discovery, what should be the most appropriate acti

Question 11

Which of the following is the BEST tool to perform cloud security control audits?

General Data Protection Regulation (GDPR)

ISO 27001

Federal Information Processing Standard (FIPS) 140-2

CSA Cloud Control Matrix (CCM)

Show Answer Comment (0)

Question 12

Which of the following is an example of a corrective control?

A central anti-virus system installing the latest signature files before allowing a connection to the network

Unsuccessful access attempts being automatically logged for investigation

Privileged access to critical information systems requiring a second factor of authentication using soft token

All new employees having standard access rights until their manager approves privileged rights

Show Answer Comment (0)

Question 13

When developing a cloud compliance program, what is the PRIMARY reason for a cloud customer to review which cloud services will be deployed?

To determine how those services will fit within its policies and procedures

To determine the total cost of the cloud services to be deployed

To confirm which vendor will be selected based on the compliance with security requirements

To confirm if the compensating controls implemented are sufficient for the cloud

Show Answer Comment (0)

Question 14

The Cloud Computing Compliance Controls Catalogue (C5) framework is maintained by which of the following agencies?

Agence nationale de la sécurité des systèmes d'information (ANSSI)

National Institute of Standards and Technology (NIST)

National Security Agency (NSA)

Bundesamt für Sicherheit in der Informationstechnik (BSI)

Show Answer Comment (0)

Question 15

Which of the following is the MOST feasible way to validate the performance of CSPs for the delivery of technology resources?

Cloud compliance program

Legacy IT compliance program

Internal audit program

Service organization controls report

Show Answer Comment (0)

Question 16

Which of the following would be the MOST critical finding of an application security and DevOps audit?

The organization is not using a unified framework to integrate cloud compliance with regulatory requirements.

Application architecture and configurations did not consider security measures.

Outsourced cloud service interruption, breach or loss of data stored at the cloud service provider.

Certifications with global security standards specific to cloud are not reviewed and the impact of noted findings are not assessed.

Show Answer Comment (0)

Question 17

During an audit it was identified that a critical application hosted in an off-premises cloud is not part of the organization's DRP (Disaster Recovery Plan).

Management stated that it is responsible for ensuring that the cloud service provider (CSP) has a plan that is tested annually. What should be the auditor's NEXT course of action?

Review the CSP audit reports.

Review the security white paper of the CSP.

Review the contract and DR capability.

Plan an audit of the CSP.

Show Answer Comment (0)

Question 18

Organizations maintain mappings between the different control frameworks they adopt to:

help identify controls with common assessment status.

avoid duplication of work when assessing compliance.

help identify controls with different assessment status.

start a compliance assessment using latest assessment.

Show Answer Comment (0)

Question 19

Which of the following defines the criteria designed by the American Institute of Certified Public Accountants (AICPA) to specify trusted services?

Security, confidentiality, availability, privacy and processing integrity

Security, applicability, availability, privacy and processing integrity

Security, confidentiality, availability, privacy and trustworthiness

Security, data integrity, availability, privacy and processing integrity

Show Answer Comment (0)

While performing the audit, the auditor found that an object storage bucket containing PII could be accessed by anyone on the Internet. Given this discovery, what should be the most appropriate action for the auditor to perform?

Highlighting the gap to the audit sponsor at the sponsor's earliest possible availability

Asking the organization's cloud administrator to immediately close the gap by updating the configuration settings and making the object storage bucket private and hence inaccessible from the Internet

Documenting the finding in the audit report and sharing the gap with the relevant stakeholders

Informing the organization's internal audit manager immediately about the gap

Show Answer Comment (0)