Updated Questions for Cloud Security Alliance CCAK Exam

dumps2022-03-28T02:36:00+08:00

Cloud Security Alliance CCAK exam questions have been updated. Many candidates are worried about passing CCAK exam. Learning online ISACA certification CCAK exam updated questions are a neccessary step in your preparation. With them, you can save much time and energy. Free updated Cloud Security Alliance CCAK exam questions are below.

Page 1 of 4

1. Which of the following controls framework should the cloud customer use to assess the overall security risk of a cloud provider?

SOC3 - Type2

Cloud Control Matrix (CCM)

SOC2 - Type1

SOC1 - Type1

2. Which of the following is the risk associated with storing data in a cloud that crosses jurisdictions?

Compliance risk

Provider administration risk

Audit risk

Virtualization risk

3. Which of the following CSP activities requires a client’s approval?

Delete the guest account or test accounts

Delete the master account or subscription owner accounts

Delete the guest account or destroy test data

Delete the test accounts or destroy test data

4. Which of the following is the MOST feasible way to validate the performance of CSPs for the delivery of technology resources?

Cloud compliance program

Legacy IT compliance program

Internal audit program

Service organization controls report

5. Which of the following would be a logical starting point for an auditor who has been engaged to assess the security of an organization’s DevOps pipeline?

Verify the inclusion of security gates in the pipeline.

Conduct an architectural assessment.

Review the CI/CD pipeline audit logs.

Verify separation of development and production pipelines.

6. Which of the following is an example of integrity technical impact?

The cloud provider reports a breach of customer personal data from an unsecured server.

A hacker using a stolen administrator identity alerts the discount percentage in the product database.

A DDoS attack renders the customer’s cloud inaccessible for 24 hours.

An administrator inadvertently click on Phish bait exposing his company to a ransomware attack.

7. Which of the following parties should have accountability for cloud compliance requirements?

Customer

Equally shared between customer and provider

Provider

Either customer or provider, depending on requirements

8. SAST testing is performed by:

scanning the application source code.

scanning the application interface.

scanning all infrastructure components.

performing manual actions to gain control of the application.

9. Under GDPR, an organization should report a data breach within what time frame?

72 hours

2 weeks

1 week

48 hours

10. When migrating to a cloud environment, which of the following should be the PRIMARY driver for the use of encryption?

Cloud Service Provider encryption capabilities

The presence of PII

Organizational security policies

Cost-benefit analysis

Page 2 of 4

11. Which of the following is the BEST recommendation to offer an organization’s HR department planning to adopt a new public SaaS application to ease the recruiting process?

Ensure HIPAA compliance

Implement a cloud access security broker

Consult the legal department

Do not allow data to be in cleratext

12. Which of the following configuration change controls is acceptable to a cloud auditor?

Development, test and production are hosted in the same network environment.

Programmers have permanent access to production software.

The Head of Development approves changes requested to production.

Programmers cannot make uncontrolled changes to the source code production version.

13. What type of termination occurs at the initiative of one party, and without the fault of the other party?

Termination for cause

Termination for convenience

Termination at the end of the term

Termination without the fault

14. Which of the following is MOST important to consider when developing an effective threat model during the introduction of a new SaaS service into a customer organization’s architecture? The threat model:

recognizes the shared responsibility for risk management between the customer and the CS

leverages SaaS threat models developed by peer organizations.

is developed by an independent third-party with expertise in the organization’s industry sector.

considers the loss of visibility and control from transitioning to the cloud.

15. To ensure that integration of security testing is implemented on large code sets in environments where time to completion is critical, what form of validation should an auditor expect?

Parallel testing

Full application stack unit testing

Regression testing

Functional verification

16. Which of the following would be considered as a factor to trust in a cloud service provider?

The level of exposure for public information

The level of proved technical skills

The level of willingness to cooperate

The level of open source evidence available

17. An auditor is performing an audit on behalf of a cloud customer.

For assessing security awareness, the auditor should:

assess the existence and adequacy of a security awareness training program at the cloud service provider’s organization as the cloud customer hired the auditor to review and cloud service.

assess the existence and adequacy of a security awareness training program at both the cloud customer’s organization and the cloud service provider’s organization.

assess the existence and adequacy of a security awareness training program at the cloud customer’s organization as they hired the auditor.

not assess the security awareness training program as it is each organization’s responsibility

18. While performing the audit, the auditor found that an object storage bucket containing PII could be accessed by anyone on the Internet.

Given this discovery, what should be the most appropriate action for the auditor to perform?

Highlighting the gap to the audit sponsor at the sponsor’s earliest possible availability

Asking the organization’s cloud administrator to immediately close the gap by updating the configuration settings and making the object storage bucket private and hence inaccessible from the Internet

Documenting the finding in the audit report and sharing the gap with the relevant stakeholders

Informing the organization’s internal audit manager immediately about the gap

19. An organization that is utilizing a community cloud is contracting an auditor to conduct a review on behalf of the group of organizations within the cloud community.

From the following, to whom should the auditor report the findings?

Public

Management of organization being audited

Shareholders/interested parties

Cloud service provider

20. Which of the following standards is designed to be used by organizations for cloud services that intend to select controls within the process of implementing an Information Security Management System based on ISO/IEC 27001?

ISO/IEC 27017:2015

CSA Cloud Control Matrix (CCM)

NIST SP 800-146

ISO/IEC 27002

Page 3 of 4

21. Which of the following data destruction methods is the MOST effective and efficient?

Crypto-shredding

Degaussing

Multi-pass wipes

Physical destruction

22. An organization is in the initial phases of cloud adoption. It is not very knowledgeable about cloud security and cloud shared responsibility models .

Which of the following approaches is BEST suited for such an organization to evaluate its cloud security?

Use of an established standard/regulation to map controls and use as the audit criteria

For efficiency reasons, use of its on-premises systems’ audit criteria to audit the cloud environment

As this is the initial stage, the ISO/IEC 27001 certificate shared by the cloud service provider is sufficient for audit and compliance purposes.

Development of the cloud security audit criteria based on its own internal audit test plans to ensure appropriate coverage

23. The Cloud Octagon Model was developed to support organizations:

risk assessment methodology.

risk treatment methodology.

incident response methodology.

incident detection methodology.

24. If the degree of verification for information shared with the auditor during an audit is low, the auditor should:

reject the information as audit evidence.

stop evaluating the requirement altogether and review other audit areas.

delve deeper to obtain the required information to decide conclusively.

use professional judgment to determine the degree of reliance that can be placed on the information as evidence.

25. Which of the following is an example of financial business impact?

A hacker using a stolen administrator identity brings down the SaaS sales and marketing systems, resulting in the inability to process customer orders or manage customer relationships.

While the breach was reported in a timely manner to the CEO, the CFO and CISO blamed each other in public, resulting in a loss of public confidence that led the board to replace all three.

A DDoS attack renders the customer's cloud inaccessible for 24 hours resulting in millions in lost sales.

The cloud provider fails to report a breach of customer personal data from an unsecured server, resulting in GDPR fines of 10 million euro.

26. Which of the following defines the criteria designed by the American Institute of Certified Public Accountants (AICPA) to specify trusted services?

Security, confidentiality, availability, privacy and processing integrity

Security, applicability, availability, privacy and processing integrity

Security, confidentiality, availability, privacy and trustworthiness

Security, data integrity, availability, privacy and processing integrity

27. What aspect of SaaS functionality and operations would the cloud customer be responsible for and should be audited?

Access controls

Vulnerability management

Source code reviews

Patching

28. Which of the following are the three MAIN phases of the cloud controls matrix (CCM) mapping methodology?

Plan --> Develop --> Release

Deploy --> Monitor --> Audit

Initiation --> Execution --> Monitoring and Controlling

Preparation --> Execution --> Peer Review and Publication

29. When performing audits in relation to Business Continuity Management and Operational Resilience strategy, what would be the MOST critical aspect to audit in relation to the strategy of the cloud customer that should be formulated jointly with the cloud service provider?

Validate if the strategy covers unavailability of all components required to operate the business-as-usual or in disrupted mode, in parts or total- when impacted by a disruption.

Validate if the strategy covers all aspects of Business Continuity and Resilience planning, taking inputs from the assessed impact and risks, to consider activities for before, during, and after a disruption.

Validate if the strategy covers all activities required to continue and recover prioritized activities within identified time frames and agreed capacity, aligned to the risk appetite of the organization including the invocation of continuity plans and crisis management capabilities.

Validate if the strategy is developed by both cloud service providers and cloud service consumers within the acceptable limits of their risk appetite.

30. With regard to the Cloud Control Matrix (CCM), the ‘Architectural Relevance’ is a feature that enables the filtering of security controls by:

relevant architecture frameworks such as the NIST Enterprise Architecture Model, the Federal Enterprise Architecture Framework (FEAF), The Open Group Architecture Framework (TOGAF), and the Zachman Framework for Enterprise Architecture.

relevant delivery models such as Software as a Service, Platform as a Service, Infrastructure as a Service.

relevant architectural paradigms such as Client-Server, Mainframe, Peer-to-Peer, and SmartClient-Backend.

relevant architectural components such as Physical, Network, Compute, Storage, Application, and Data.

Page 4 of 4

31. Which of the following contract terms is necessary to meet a company’s requirement that needs to move data from one CSP to another?

Drag and Drop

Lift and shift

Flexibility to move

Transition and data portability

32. Which plan will guide an organization on how to react to a security incident that might occur on the organization’s systems, or that might be affecting one of their service providers?

Incident Response Plans

Security Incident Plans

Unexpected Event Plans

Emergency Incident Plans

33. You have been assigned the implementation of an ISMS, whose scope must cover both on premise and cloud infrastructure .

Which of the following is your BEST option?

Implement ISO/IEC 27002 and complement it with additional controls from the CC

Implement ISO/IEC 27001 and complement it with additional controls from ISO/IEC 27017.

Implement ISO/IEC 27001 and complement it with additional controls from ISO/IEC 27002.

Implement ISO/IEC 27001 and complement it with additional controls from the NIST SP 800-145.

34. Which of the following should be the FIRST step to establish a cloud assurance program during a cloud migration?

Design

Stakeholder identification

Development

Risk assessment

35. Which of the following approaches encompasses social engineering of staff, bypassing of physical access controls and penetration testing?

Blue team

White box

Gray box

Red team

36. One of the Cloud Control Matrix’s (CCM’s) control specifications states that “Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations.”

Which of the following controls under the Audit Assurance and Compliance domain does this match to?

Audit planning

Information system and regulatory mapping

GDPR auditing

Independent audits

37. What areas should be reviewed when auditing a public cloud?

Patching, source code reviews, hypervisor, access controls

Identity and access management, data protection

Patching, configuration, hypervisor, backups

Vulnerability management, cyber security reviews, patching

38. In all three cloud deployment models, (IaaS, PaaS, and SaaS), who is responsible for the patching of the hypervisor layer?

Cloud service customer

Shared responsibility

Cloud service provider

Patching on hypervisor layer is not required

Updated Questions for Cloud Security Alliance CCAK Exam

Updated Questions for Cloud Security Alliance CCAK Exam

Share this post

Leave a Reply Cancel reply