Home / Isaca / CCAK

Isaca CCAK Practice Test - Questions Answers, Page 5

Question list

List of questions

Question 41

(0)

What areas should be reviewed when auditing a public cloud?

Question 42

(0)

A Dot Release of Cloud Control Matrix (CCM) indicates what?

Question 43

(0)

What aspect of SaaS functionality and operations would the cloud customer be responsible for and should be audited?

Question 44

(0)

To support customer's verification of the CSP claims regarding their responsibilities according to the shared responsibility model, which of the following tools and techniques is appropriate?

Question 45

(0)

Changes to which of the following will MOST likely influence the expansion or reduction of controls required to remediate the risk arising from changes to an organization's SaaS vendor?

Question 46

(0)

The Cloud Octagon Model was developed to support organizations:

Question 47

(0)

To ensure that integration of security testing is implemented on large code sets in environments where time to completion is critical, what form of validation should an auditor expect?

Question 48

(0)

When performing audits in relation to Business Continuity Management and Operational Resilience strategy, what would be the MOST critical aspect to audit in relation to the strategy of the cloud cus

Question 49

(0)

Which of the following standards is designed to be used by organizations for cloud services that intend to select controls within the process of implementing an Information Security Management Syst

Question 50

(0)

Which of the following aspects of risk management involves identifying the potential reputational harm and/or financial harm when an incident occurs?

Question 41

What areas should be reviewed when auditing a public cloud?

Patching, source code reviews, hypervisor, access controls

Identity and access management, data protection

Patching, configuration, hypervisor, backups

Vulnerability management, cyber security reviews, patching

Show Answer Comment (0)

Question 42

A Dot Release of Cloud Control Matrix (CCM) indicates what?

The introduction of new control frameworks mapped to previously-published CCM controls.

A revision of the CCM domain structure.

A technical change (revision or addition or deletion) of a number of controls is smaller than 10% compared to the previous "Full" release.

A technical change (revision or addition or deletion) of a number of controls is greater than 10% compared to the previous "Full" release.

Show Answer Comment (0)

Question 43

What aspect of SaaS functionality and operations would the cloud customer be responsible for and should be audited?

Access controls

Vulnerability management

Source code reviews

Patching

Show Answer Comment (0)

Question 44

To support customer's verification of the CSP claims regarding their responsibilities according to the shared responsibility model, which of the following tools and techniques is appropriate?

Contractual agreement

Internal audit

External audit

Security assessment

Show Answer Comment (0)

Question 45

Changes to which of the following will MOST likely influence the expansion or reduction of controls required to remediate the risk arising from changes to an organization's SaaS vendor?

Risk exceptions policy

Contractual requirements

Risk appetite

Board oversight

Show Answer Comment (0)

Question 46

The Cloud Octagon Model was developed to support organizations:

risk assessment methodology.

risk treatment methodology.

incident response methodology.

incident detection methodology.

Show Answer Comment (0)

Question 47

To ensure that integration of security testing is implemented on large code sets in environments where time to completion is critical, what form of validation should an auditor expect?

Parallel testing

Full application stack unit testing

Regression testing

Functional verification

Show Answer Comment (0)

When performing audits in relation to Business Continuity Management and Operational Resilience strategy, what would be the MOST critical aspect to audit in relation to the strategy of the cloud customer that should be formulated jointly with the cloud service provider?

Validate if the strategy covers unavailability of all components required to operate the business-as-usual or in disrupted mode, in parts or total- when impacted by a disruption.

Validate if the strategy covers all aspects of Business Continuity and Resilience planning, taking inputs from the assessed impact and risks, to consider activities for before, during, and after a disruption.

Validate if the strategy covers all activities required to continue and recover prioritized activities within identified time frames and agreed capacity, aligned to the risk appetite of the organization including the invocation of continuity plans and crisis management capabilities.

Validate if the strategy is developed by both cloud service providers and cloud service consumers within the acceptable limits of their risk appetite.

Show Answer Comment (0)

Question 49

Which of the following standards is designed to be used by organizations for cloud services that intend to select controls within the process of implementing an

Information Security Management System based on ISO/IEC 27001?

ISO/IEC 27017:2015

CSA Cloud Control Matrix (CCM)

NIST SP 800-146

ISO/IEC 27002

Show Answer Comment (0)