CCAK practice questions 91–100

1. Question 91 · 271 in bank

   The BEST way to deliver continuous compliance in a cloud environment is to:

   • Adecrease the interval between attestations of compliance.
   • Bcombine point-in-time assurance approaches with continuous monitoring.
   • Cincrease the frequency of external audits from annual to quarterly.
   • Dcombine point-in-time assurance approaches with continuous auditing.

   Show answer

   Answer: D

   Next question

2. Question 92 · 271 in bank

   When reviewing a third-party agreement with a cloud service provider, which of the following should be the GREATEST concern regarding customer data privacy?

   • AData retention, backup, and recovery
   • BPatch management process
   • CReturn or destruction of information
   • DNetwork intrusion detection

   Show answer

   Answer: C

   Next question

3. Question 93 · 271 in bank

   To identify key actors and requirements, which of the following MUST be considered when designing a cloud compliance program?

   • ACloud service provider, internal and external audit perspectives
   • BBusiness/organizational, governance, cloud and risk perspectives
   • CEnterprise risk management, data protection, privacy and legal perspectives
   • DKey stakeholders, enterprise risk management, and Internal audit perspectives

   Show answer

   Answer: B

   Next question

4. Question 94 · 271 in bank

   Which of the following standards is designed to be used by organizations for cloud services that intend to select controls within the process of implementing an Information Security Management System based on ISO/IEC 27001?

   • AISO/IEC 27017:2015
   • BCSA Cloud Control Matrix (CCM)
   • CNIST SP 800-146
   • DISO/IEC 27002

   Show answer

   Answer: A

   Next question

5. Question 95 · 271 in bank

   Which of the following is the common cause of misconfiguration in a cloud environment?

   • AAbsence of effective change control
   • BUsing multiple cloud service providers
   • CNew cloud computing techniques
   • DTraditional change process mechanisms

   Show answer

   Answer: A

   Next question

6. Question 96 · 271 in bank

   To ensure that integration of security testing is implemented on large code sets in environments where time to completion is critical, what form of validation should an auditor expect?

   • AParallel testing
   • BFull application stack unit testing
   • CRegression testing
   • DFunctional verification

   Show answer

   Answer: A

   Next question

7. Question 97 · 271 in bank

   One of the Cloud Control Matrix’s (CCM’s) control specifications states that “Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations.” Which of the following controls under the Audit Assurance and Compliance domain does this match to?

   • AAudit planning
   • BInformation system and regulatory mapping
   • CGDPR auditing
   • DIndependent audits

   Show answer

   Answer: D

   Next question

8. Question 98 · 271 in bank

   In the context of Infrastructure as a Service (IaaS), a vulnerability assessment will scan virtual machines to identify vulnerabilities in:

   • Aboth operating system and application infrastructure contained within the CSP’s instances.
   • Bboth operating system and application infrastructure contained within the customer’s instances
   • Conly application infrastructure contained within the CSP’s instances.
   • Donly application infrastructure contained within the customer’s instances.

   Show answer

   Answer: B

   Next question

9. Question 99 · 271 in bank

   Prioritizing assurance activities for an organization’s cloud services portfolio depends PRIMARILY on an organization’s ability to:

   • Aschedule frequent reviews with high-risk cloud service providers.
   • Bdevelop plans using a standardized risk-based approach.
   • Cmaintain a comprehensive cloud service inventory.
   • Dcollate views from various business functions using cloud services.

   Show answer

   Answer: B

   Next question

10. Question 100 · 271 in bank

    When building a cloud governance model, which of the following requirements will focus more on the cloud service provider’s evaluation and control checklist?

    • ASecurity requirements
    • BLegal requirements
    • CCompliance requirements
    • DOperational requirements

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 91. 271 questions available.