Certificate of Cloud Auditing Knowledge CCAK Dumps

dumps2021-12-10T03:50:51+08:00

Certification of Cloud Auditing Knowledge CCAK exam is an online, proctored exam. There are 76 multiple choice questions, and you have 2 hours to finish all the questions. The required passing score of CCAK exam is 70%. Our online ISACA certification CCAK exam dumps will be the best guides for you to prepare for the test. Free ISACA CCAK exam dumps questions are available below.

Page 1 of 3

1. Which of the following should be the FIRST step to establish a cloud assurance program during a cloud migration?

Design

Stakeholder identification

Development

Risk assessment

2. Which of the following is MOST important to consider when an organization is building a compliance program for the cloud?

The rapidly changing service portfolio and architecture of the cloud.

Cloud providers should not be part of the compliance program.

The fairly static nature of the service portfolio and architecture of the cloud.

The cloud is similar to the on-premise environment in terms of compliance.

3. An organization has an ISMS implemented, following ISO 27001 and Annex A controls. The CIO would like to migrate some of the infrastructure to the cloud.

Which of the following standards would BEST assist in identifying controls to consider for this migration?

ISO/IEC 27701

ISO/IEC 22301

ISO/IEC 27002

ISO/IEC 27017

4. Cloud Control Matrix (CCM) controls can be used by cloud customers to:

develop new security baselines for the industry.

define different control frameworks for different cloud service providers.

facilitate communication with their legal department.

build an operational cloud risk management program.

5. The MAIN difference between Cloud Control Matrix (CCM) and Consensus Assessment Initiative Questionnaire (CAIQ) is that:

CCM assesses the presence of controls, whereas CAIQ assesses overall security of a service.

CCM has a set of security questions, whereas CAIQ has a set of security controls.

CCM has 14 domains and CAIQ has 16 domains.

CCM provides a controls framework, whereas CAIQ provides industry-accepted ways to document which security controls exist in IaaS, PaaS, and SaaS offerings.

6. A cloud service provider does not allow audits using automated tools as these tools could be considered destructive techniques for the cloud environment.

Which of the following aspects of the audit will be constrained?

Purpose

Objectives

Nature of relationship

Scope

7. An auditor identifies that a CSP received multiple customer inquiries and RFPs during the last month.

Which of the following should be the BEST recommendation to reduce the CSP burden?

CSP can share all security reports with customers to streamline the process.

CSP can schedule a call with each customer.

CSP can answer each customer individually.

CSP can direct all customers’ inquiries to the information in the CSA STAR registry.

8. What should be an organization’s control audit schedule of a cloud service provider’s business continuity plan and operational resilience policy?

Annual

Quarterly

Monthly

Semi-annual

9. When performing audits in relation to Business Continuity Management and Operational Resilience strategy, what would be the MOST critical aspect to audit in relation to the strategy of the cloud customer that should be formulated jointly with the cloud service provider?

Validate if the strategy covers unavailability of all components required to operate the business-as-usual or in disrupted mode, in parts or total- when impacted by a disruption.

Validate if the strategy covers all aspects of Business Continuity and Resilience planning, taking inputs from the assessed impact and risks, to consider activities for before, during, and after a disruption.

Validate if the strategy covers all activities required to continue and recover prioritized activities within identified time frames and agreed capacity, aligned to the risk appetite of the organization including the invocation of continuity plans and crisis management capabilities.

Validate if the strategy is developed by both cloud service providers and cloud service consumers within the acceptable limits of their risk appetite.

10. Policies and procedures shall be established, and supporting business processes and technical measures implemented, for maintenance of several items ensuring continuity and availability of operations and support personnel.

Which of the following controls BEST matches this control description?

Operations Maintenance

System Development Maintenance

Equipment Maintenance

System Maintenance

Page 2 of 3

11. When applying the Top Threats Analysis methodology following an incident, what is the scope of the technical impact identification step?

Determine the impact on the controls that were selected by the organization to respond to identified risks.

Determine the impact on confidentiality, integrity and availability of the information system.

Determine the impact on the financial, operational, compliance and reputation of the organization.

Determine the impact on the physical and environmental security of the organization, excluding informational assets.

12. When using a SaaS solution, who is responsible for application security?

The cloud service provider only

The cloud service consumer only

Both cloud consumer and the enterprise

Both cloud provider and the consumer

13. In an organization, how are policy violations MOST likely to occur?

By accident

Deliberately by the ISP

Deliberately

Deliberately by the cloud provider

14. Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, ports, and by compensating controls.

Which of the following controls BEST matches this control description?

Network Security

Change Detection

Virtual Instance and OS Hardening

Network Vulnerability Management

15. A cloud customer configured and developed a solution on top of the certified cloud services. Building on top of a compliant CSP:

means that the cloud customer is also compliant.

means that the cloud customer and client are both compliant.

means that the cloud customer is compliant but their client is not compliant.

does not necessarily mean that the cloud customer is also compliant.

16. After finding a vulnerability in an internet-facing server of an organization, a cybersecurity criminal is able to access an encrypted file system and successfully manages to overwrite part of some files with random data.

In reference to the Top Threats Analysis methodology, how would you categorize the technical impact of this incident?

As an integrity breach

As control breach

As an availability breach

As a confidentiality breach

17. Organizations maintain mappings between the different control frameworks they adopt to:

help identify controls with common assessment status.

avoid duplication of work when assessing compliance.

help identify controls with different assessment status.

start a compliance assessment using latest assessment.

18. Which of the following metrics are frequently immature?

Metrics around Infrastructure as a Service (IaaS) storage and network environments

Metrics around Platform as a Service (PaaS) development environments

Metrics around Infrastructure as a Service (IaaS) computing environments

Metrics around specific Software as a Service (SaaS) application services

19. Due to cloud audit team resource constraints, an audit plan as initially approved cannot be completed. Assuming that the situation is communicated in the cloud audit report which course of action is MOST relevant?

Focusing on auditing high-risk areas

Testing the adequacy of cloud controls design

Relying on management testing of cloud controls

Testing the operational effectiveness of cloud controls

20. Which of the following is a fundamental concept of FedRAMP that intends to save costs, time, and staff conducting superfluous agency security assessments?

A. Use often, provide many times

B. Be economical, act deliberately

C. Use existing, provide many times

D. Do once, use many times

Page 3 of 3

21. To ensure that cloud audit resources deliver the best value to the organization, the PRIMARY step would be to:

develop a cloud audit plan on the basis of a detailed risk assessment.

schedule the audits and monitor the time spent on each audit.

train the cloud audit staff on current technology used in the organization.

monitor progress of audits and initiate cost control measures.

22. Which of the following quantitative measures is KEY for an auditor to review when assessing the implementation of continuous auditing of performance on a cloud system?

Service Level Objective (SLO)

Recovery Point Objectives (RPO)

Service Level Agreement (SLA)

Recovery Time Objectives (RTO)

23. In all three cloud deployment models, (IaaS, PaaS, and SaaS), who is responsible for the patching of the hypervisor layer?

Cloud service customer

Shared responsibility

Cloud service provider

Patching on hypervisor layer is not required

Certificate of Cloud Auditing Knowledge CCAK Dumps

Certificate of Cloud Auditing Knowledge CCAK Dumps

Share this post

Leave a Reply Cancel reply