Updated CCAK Dumps Questions [2022] Pass ISACA CCAK Exam

1. Which of the following controls framework should the cloud customer use to assess the overall security risk of a cloud provider?

2. Which of the following is the risk associated with storing data in a cloud that crosses jurisdictions?

3. Which of the following CSP activities requires a client’s approval?

4. Which of the following is the MOST feasible way to validate the performance of CSPs for the delivery of technology resources?

5. Which of the following would be a logical starting point for an auditor who has been engaged to assess the security of an organization’s DevOps pipeline?

6. Which of the following is an example of integrity technical impact?

7. Which of the following parties should have accountability for cloud compliance requirements?

8. SAST testing is performed by:

9. Under GDPR, an organization should report a data breach within what time frame?

10. When migrating to a cloud environment, which of the following should be the PRIMARY driver for the use of encryption?

11. Which of the following is the BEST recommendation to offer an organization’s HR department planning to adopt a new public SaaS application to ease the recruiting process?

12. Which of the following configuration change controls is acceptable to a cloud auditor?

13. What type of termination occurs at the initiative of one party, and without the fault of the other party?

14. Which of the following is MOST important to consider when developing an effective threat model during the introduction of a new SaaS service into a customer organization’s architecture? The threat model:

15. To ensure that integration of security testing is implemented on large code sets in environments where time to completion is critical, what form of validation should an auditor expect?

16. Which of the following would be considered as a factor to trust in a cloud service provider?

17. An auditor is performing an audit on behalf of a cloud customer.

For assessing security awareness, the auditor should:

18. While performing the audit, the auditor found that an object storage bucket containing PII could be accessed by anyone on the Internet.

Given this discovery, what should be the most appropriate action for the auditor to perform?

19. An organization that is utilizing a community cloud is contracting an auditor to conduct a review on behalf of the group of organizations within the cloud community.

From the following, to whom should the auditor report the findings?

20. Which of the following standards is designed to be used by organizations for cloud services that intend to select controls within the process of implementing an Information Security Management System based on ISO/IEC 27001?

21. Which of the following data destruction methods is the MOST effective and efficient?

22. An organization is in the initial phases of cloud adoption. It is not very knowledgeable about cloud security and cloud shared responsibility models .

Which of the following approaches is BEST suited for such an organization to evaluate its cloud security?

23. The Cloud Octagon Model was developed to support organizations:

24. If the degree of verification for information shared with the auditor during an audit is low, the auditor should:

25. Which of the following is an example of financial business impact?

26. Which of the following defines the criteria designed by the American Institute of Certified Public Accountants (AICPA) to specify trusted services?

27. What aspect of SaaS functionality and operations would the cloud customer be responsible for and should be audited?

28. Which of the following are the three MAIN phases of the cloud controls matrix (CCM) mapping methodology?

29. When performing audits in relation to Business Continuity Management and Operational Resilience strategy, what would be the MOST critical aspect to audit in relation to the strategy of the cloud customer that should be formulated jointly with the cloud service provider?

30. With regard to the Cloud Control Matrix (CCM), the ‘Architectural Relevance’ is a feature that enables the filtering of security controls by:

31. Which of the following contract terms is necessary to meet a company’s requirement that needs to move data from one CSP to another?

32. Which plan will guide an organization on how to react to a security incident that might occur on the organization’s systems, or that might be affecting one of their service providers?

33. You have been assigned the implementation of an ISMS, whose scope must cover both on premise and cloud infrastructure .

Which of the following is your BEST option?

34. Which of the following should be the FIRST step to establish a cloud assurance program during a cloud migration?

35. Which of the following approaches encompasses social engineering of staff, bypassing of physical access controls and penetration testing?

36. One of the Cloud Control Matrix’s (CCM’s) control specifications states that “Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations.”

Which of the following controls under the Audit Assurance and Compliance domain does this match to?

37. What areas should be reviewed when auditing a public cloud?

38. In all three cloud deployment models, (IaaS, PaaS, and SaaS), who is responsible for the patching of the hypervisor layer?

39. Which of the following is a corrective control that may be identified in a SaaS service provider?

40. A large organization with subsidiaries in multiple locations has a business requirement to organize IT systems to have identified resources reside in particular locations with organizational personnel .

Which access control method will allow IT personnel to be segregated across the various locations?

41. In the context of Infrastructure as a Service (IaaS), a vulnerability assessment will scan virtual machines to identify vulnerabilities in:

42. An independent contractor is assessing security maturity of a SaaS company against industry standards. The SaaS company has developed and hosted all their products using the cloud services provided by a third-party cloud service provider (CSP) .

What is the optimal and most efficient mechanism to assess the controls CSP is responsible for?

43. To ensure that cloud audit resources deliver the best value to the organization, the PRIMARY step would be to:

44. After finding a vulnerability in an internet-facing server of an organization, a cybersecurity criminal is able to access an encrypted file system and successfully manages to overwrite part of some files with random data.

In reference to the Top Threats Analysis methodology, how would you categorize the technical impact of this incident?

45. The MOST critical concept of managing the build and test of code in DevOps is: