Real CCAK Dumps Questions – Pass Certificate of Cloud Auditing Knowledge Exam Smoothly

1. Which of the following is an example of financial business impact?

2. In which control should a cloud service provider, upon request, inform customers of compliance impact and risk, especially if customer data is used as part of the services?

3. Which of the following BEST ensures adequate restriction on the number of people who can access the pipeline production environment?

4. How should controls be designed by an organization?

5. What areas should be reviewed when auditing a public cloud?

6. Policies and procedures shall be established, and supporting business processes and technical measures implemented, for maintenance of several items ensuring continuity and availability of operations and support personnel.

Which of the following controls BEST matches this control description?

7. Which of the following would be the MOST critical finding of an application security and DevOps audit?

8. An organization is in the initial phases of cloud adoption. It is not very knowledgeable about cloud security and cloud shared responsibility models.

Which of the following approaches is BEST suited for such an organization to evaluate its cloud security?

9. Which of the following would be considered as a factor to trust in a cloud service provider?

10. Which of the following quantitative measures is KEY for an auditor to review when assessing the implementation of continuous auditing of performance on a cloud system?

11. Which of the following attestation allows for immediate adoption of the Cloud Control Matrix (CCM) as additional criteria to AICPA Trust Service Criteria and provides the flexibility to update the criteria as technology and market requirements change?

12. Which of the following is an example of integrity technical impact?

13. The Open Certification Framework is structured on three levels of trust. Those three levels of trust are:

14. Cloud Control Matrix (CCM) controls can be used by cloud customers to:

15. A cloud customer configured and developed a solution on top of the certified cloud services. Building on top of a compliant CSP:

16. To ensure that cloud audit resources deliver the best value to the organization, the PRIMARY step would be to:

17. Which of the following is the risk associated with storing data in a cloud that crosses

jurisdictions?

18. Which of the following is a fundamental concept of FedRAMP that intends to save costs, time, and staff conducting superfluous agency security assessments?

A. Use often, provide many times

B. Be economical, act deliberately

C. Use existing, provide many times

D. Do once, use many times

19. The criteria for limiting services allowing non-critical services or services requiring high availability and resilience to be moved to the cloud is an important consideration to be included PRIMARILY in the:

20. When a client’s business process ch be updated.

B. not be reviewed, but the cloud contract should be cancelled immediately.

C. not be reviewed as the SLA cannot be updated.

D. be reviewed and updated if required.

21. From the perspective of a senior cloud security audit practitioner in an organization of a mature security program with cloud adoption, which of the following statements BEST describes the DevSecOps concept?

22. Your company is purchasing an application from a vendor. They do not allow you to perform an on-site audit on their information system. However, they say, they will provide the third-party audit attestation on the adequate control design within their environment.

Which report is the vendor providing you?

23. Supply chain agreements between CSP and cloud customers should, at minimum, include:

24. Changes to which of the following will MOST likely influence the expansion or reduction of controls required to remediate the risk arising from changes to an organization’s SaaS vendor?

25. When performing audits in relation to Business Continuity Management and Operational Resilience strategy, what would be the MOST critical aspect to audit in relation to the strategy of the cloud customer that should be formulated jointly with the cloud service provider?

26. Which of the following CSP activities requires a client’s approval?

27. Which of the following metrics are frequently immature?

28. Customer management interface, if compromised over public internet, can lead to:

29. The Cloud Octagon Model was developed to support organizations:

30. A CSP providing cloud services currently being used by the United States federal government should obtain which of the following to assure compliance to stringent government standards?