ExamGecko
Home Home / Isaca / CCAK

Isaca CCAK Practice Test - Questions Answers, Page 8

Question list
Search
Search

When migrating to a cloud environment, which of the following should be the PRIMARY driver for the use of encryption?

A.
Cloud Service Provider encryption capabilities
A.
Cloud Service Provider encryption capabilities
Answers
B.
The presence of PII
B.
The presence of PII
Answers
C.
Organizational security policies
C.
Organizational security policies
Answers
D.
Cost-benefit analysis
D.
Cost-benefit analysis
Answers
Suggested answer: A

What type of termination occurs at the initiative of one party, and without the fault of the other party?

A.
Termination for cause
A.
Termination for cause
Answers
B.
Termination for convenience
B.
Termination for convenience
Answers
C.
Termination at the end of the term
C.
Termination at the end of the term
Answers
D.
Termination without the fault
D.
Termination without the fault
Answers
Suggested answer: C

Which of the following is the BEST control framework for a European manufacturing corporation that is migrating to the cloud?

A.
NIST SP 800-53
A.
NIST SP 800-53
Answers
B.
CSA's GDPR CoC
B.
CSA's GDPR CoC
Answers
C.
PCI-DSS
C.
PCI-DSS
Answers
D.
EU GDPR
D.
EU GDPR
Answers
Suggested answer: D

Explanation:

Reference: https://ec.europa.eu/info/sites/default/files/ec_cloud_strategy.pdf

Under GDPR, an organization should report a data breach within what time frame?

A.
72 hours
A.
72 hours
Answers
B.
2 weeks
B.
2 weeks
Answers
C.
1 week
C.
1 week
Answers
D.
48 hours
D.
48 hours
Answers
Suggested answer: A

Explanation:

Reference: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulationgdpr/personal-data-breaches/

Which plan will guide an organization on how to react to a security incident that might occur on the organization's systems, or that might be affecting one of their service providers?

A.
Incident Response Plans
A.
Incident Response Plans
Answers
B.
Security Incident Plans
B.
Security Incident Plans
Answers
C.
Unexpected Event Plans
C.
Unexpected Event Plans
Answers
D.
Emergency Incident Plans
D.
Emergency Incident Plans
Answers
Suggested answer: A

In an organization, how are policy violations MOST likely to occur?

A.
By accident
A.
By accident
Answers
B.
Deliberately by the ISP
B.
Deliberately by the ISP
Answers
C.
Deliberately
C.
Deliberately
Answers
D.
Deliberately by the cloud provider
D.
Deliberately by the cloud provider
Answers
Suggested answer: A

What is a sign of an organization that has adopted a shift-left concept of code release cycles?

A.
A waterfall model to move resources through the development to release phases
A.
A waterfall model to move resources through the development to release phases
Answers
B.
Incorporation of automation to identify and address software code problems early
B.
Incorporation of automation to identify and address software code problems early
Answers
C.
Maturity of start-up entities with high-iteration to low-volume code commits
C.
Maturity of start-up entities with high-iteration to low-volume code commits
Answers
D.
Large entities with slower release cadences and geographical dispersed systems
D.
Large entities with slower release cadences and geographical dispersed systems
Answers
Suggested answer: B

Explanation:

Reference: https://www.ibm.com/cloud/learn/devsecops

An organization that is utilizing a community cloud is contracting an auditor to conduct a review on behalf of the group of organizations within the cloud community. From the following, to whom should the auditor report the findings?

A.
Public
A.
Public
Answers
B.
Management of organization being audited
B.
Management of organization being audited
Answers
C.
Shareholders/interested parties
C.
Shareholders/interested parties
Answers
D.
Cloud service provider
D.
Cloud service provider
Answers
Suggested answer: D

After finding a vulnerability in an internet-facing server of an organization, a cybersecurity criminal is able to access an encrypted file system and successfully manages to overwrite part of some files with random data. In reference to the Top Threats Analysis methodology, how would you categorize the technical impact of this incident?

A.
As an integrity breach
A.
As an integrity breach
Answers
B.
As control breach
B.
As control breach
Answers
C.
As an availability breach
C.
As an availability breach
Answers
D.
As a confidentiality breach
D.
As a confidentiality breach
Answers
Suggested answer: B

Which of the following configuration change controls is acceptable to a cloud auditor?

A.
Development, test and production are hosted in the same network environment.
A.
Development, test and production are hosted in the same network environment.
Answers
B.
Programmers have permanent access to production software.
B.
Programmers have permanent access to production software.
Answers
C.
The Head of Development approves changes requested to production.
C.
The Head of Development approves changes requested to production.
Answers
D.
Programmers cannot make uncontrolled changes to the source code production version.
D.
Programmers cannot make uncontrolled changes to the source code production version.
Answers
Suggested answer: D
Total 170 questions
Go to page: of 17