CCAK Practice Questions

A.  

regulatory guidelines impacting the cloud customer.

B.  

audits, assessments, and independent verification of compliance certifications with agreement terms.

C.  

policies and procedures of the cloud customer

D.  

the organizational chart of the provider.

A.  

Evaluation summaries

B.  

logs

C.  

SOC reports

D.  

Interviews

A.  

combine point-in-time assurance approaches with continuous monitoring.

B.  

increase the frequency of external audits from annual to quarterly.

C.  

combine point-in-time assurance approaches with continuous auditing.

D.  

decrease the interval between attestations of compliance

A.  

A distributed denial of service (DDoS) attack renders the customer's cloud inaccessible for

24 hours, resulting in millions in lost sales.

B.  

A hacker using a stolen administrator identity brings down the Software of a Service (SaaS)

sales and marketing systems, resulting in the inability to process customer orders or

manage customer relationships.

C.  

While the breach was reported in a timely manner to the CEO, the CFO and CISO blamed

each other in public consulting in a loss of public confidence that led the board to replace all

three.

A.  

To establish an audit mindset within the organization

B.  

To contrast the risk generated by the loss of control

C.  

To reinforce the role of the internal audit function

D.  

To establish an accountability culture within the organization

A.  

Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)

B.  

General Data Protection Regulation (GDPR)

C.  

Federal Information Processing Standard (FIPS) 140-2

D.  

ISO 27001

A.  

Automating risk monitoring and reporting processes

B.  

Reporting emerging threats to senior stakeholders

C.  

Establishing ownership and accountability

D.  

Monitoring key risk indicators (KRIs) for multi-cloud environments

A.  

As an integrity breach

B.  

As an availability breach

C.  

As a confidentiality breach

D.  

As a control breach

A.  

Certifications with global security standards specific to cloud are not reviewed, and the impact of noted findings are not assessed.

B.  

Outsourced cloud service interruption, breach, or loss of stored data occurred at the cloud service provider.

C.  

The organization is not using a unified framework to integrate cloud compliance with regulatory requirements.

D.  

Application architecture and configurations did not consider security measures.

A.  

at the end of the development cycle.

B.  

after go-live.

C.  

in all development steps.

D.  

at the beginning of the development cycle.