CCAK Braindumps PDF, ISACA CCAK Exam Cram [Q36-Q60]

Rate this post

CCAK Braindumps PDF, ISACA CCAK Exam Cram

New 2023 CCAK Sample Questions Reliable CCAK Test Engine

How can you further improve your chances of passing the ISACA CCAK Exam?

The ISACA CCAK Exam is a well-known entry certification exam for cloud security professionals. However, the exam itself can be very challenging for those who are not used to taking formal exams. To guarantee your success in passing the ISACA CCAK Exam, you need an ISACA CCAK Dumps to aid you in your studies.

NO.36 When building a cloud governance model, which of the following requirements will focus more on the cloud service provider’s evaluation and control checklist?

Security requirements

Legal requirements

Compliance requirements

Operational requirements

NO.37 Which layer is the most important for securing because it is considered to be the foundation for secure cloud operations?

Infrastructure

Datastructure

Infostructure

Applistructure

Metastructure

NO.38 A CSP contracts for a penetration test to be conducted on its infrastructures. The auditor engages the target with no prior knowledge of its defenses, assets, or channels. The CSP’s security operation center is not notified in advance of the scope of the audit and the test vectors. Which mode is selected by the CSP?

Double gray box

Tandem

Reversal

Double blind

NO.39 If the degree of verification for information shared with the auditor during an audit is low, the auditor should:

reject the information as audit evidence.

stop evaluating the requirement altogether and review other audit areas.

delve deeper to obtain the required information to decide conclusively.

use professional judgment to determine the degree of reliance that can be placed on the information as evidence.

NO.40 What should be the control audit frequency for Business Continuity Management?

Quarterly

Annually

Monthly

Semi-annually

NO.41 ENISA: A reason for risk concerns of a cloud provider being acquired is:

Arbitrary contract termination by acquiring company

Resource isolation may fail

Provider may change physical location

Mass layoffs may occur

Non-binding agreements put at risk

NO.42 An organization recently implemented a cloud document storage solution and removed the ability for end users to save data to their local workstation hard drives Which of the following findings should be the IS auditor’s GREATEST concern?

Mobile devices are not encrypted.

Users have not been trained on the new system.

Users are not required to sign updated acceptable

The business continuity plan (BCP) was not updated.

NO.43 How does virtualized storage help avoid data loss if a drive fails?

Multiple copies indifferent locations

Drives are backed up, swapped, and archived constantly

Full back ups weekly

Data loss is unavoidable with drive failures

Incremental backups daily

NO.44 Your SLA with your cloudprovider ensures continuity for all services.

False

True

NO.45 What is true of searching data across cloud environments?

You might not have the ability oradministrative rights to search or access all hosted data.

The cloud provider must conduct the search with the full administrative controls.

All cloud-hosted email accounts are easily searchable.

Search and discovery time is alwaysfactored into a contract between the consumer and provider.

You can easily search across your environment using any E-Discovery tool.

NO.46 How is encryption managed on multi-tenant storage?

Single key for all data owners

One key per data owner

Multiple keys per data owner

The answer could be A, B, or C depending on the provider

C for data subject to the EU Data Protection Directive; B for all others

NO.47 Which of the following is the BEST control framework for a European manufacturing corporation that is migrating to the cloud?

NIST SP 800-53

CSA’s GDPR CoC

PCI-DSS

EU GDPR

NO.48 Which of the following is the MOST important audit scope document when conducting a review of a cloud service provider?

Updated audit/work program

Documentation criteria for the audit evidence

Processes and systems to be audited

Testing procedure to be performed

NO.49 Organizations maintain mappings between the different control frameworks they adopt to:

help identify controls with common assessment status.

avoid duplication of work when assessing compliance.

help identify controls with different assessment status.

start a compliance assessment using latest assessment.

NO.50 Which of the following is the BEST tool to perform cloud security control audits?

General Data Protection Regulation (GDPR)

ISO 27001

Federal Information Processing Standard (FIPS) 140-2

CSA Cloud Control Matrix (CCM)

NO.51 Cloud Control Matrix (CCM) controls can be used by cloud customers to:

develop new security baselines for the industry.

define different control frameworks for different cloud service providers.

facilitate communication with their legal department.

build an operational cloud risk management program.

NO.52 Which concept provides the abstraction needed for resource pools?

Virtualization

Applistructure

Hypervisor

Metastructure

Orchestration

NO.53 Which attack surfaces, if any, does virtualization technology introduce?

The hypervisor

Virtualization management components apart from the hypervisor

Configuration and VM sprawl issues

All of the above

NO.54 What is defined as the process by which an opposing party may obtain private documents for use in litigation?

Discovery

Custody

Subpoena

Risk Assessment

Scope

NO.55 What areas should be reviewed when auditing a public cloud?

Patching, source code reviews, hypervisor, access controls

Identity and access management, data protection

Patching, configuration, hypervisor, backups

Vulnerability management, cyber security reviews, patching

NO.56 The MAIN difference between Cloud Control Matrix (CCM) and Consensus Assessment Initiative Questionnaire (CAIQ) is that:

CCM assesses the presence of controls, whereas CAIQ assesses overall security of a service.

CCM has a set of security questions, whereas CAIQ has a set of security controls.

CCM has 14 domains and CAIQ has 16 domains.

CCM provides a controls framework, whereas CAIQ provides industry-accepted ways to document which security controls exist in IaaS, PaaS, and SaaS offerings.

NO.57 When developing a cloud compliance program, what is the PRIMARY reason for a cloud customer to review which cloud services will be deployed?

To determine how those services will fit within its policies and procedures

To determine the total cost of the cloud services to be deployed

To confirm which vendor will be selected based on the compliance with security requirements

To confirm if the compensating controls implemented are sufficient for the cloud

NO.58 A defining set of rules composed of claims and attributes of the entities in a transaction, which is used to determine their level of access to cloud-based resources is called what?

An entitlement matrix

A support table

An entrylog

A validation process

An access log

NO.59 Which of the following contract terms is necessary to meet a company’s requirement that needs to move data from one CSP to another?

Drag and Drop

Lift and shift

Flexibility to move

Transition and data portability

NO.60 What is known as a code execution environment running within an operating system that shares and uses the resources of the operating system?

Platform-basedWorkload

Pod

Abstraction

Container

Virtual machine

Loading …