CCAK practice questions 111–120

1. Question 111 · 271 in bank

   An auditor is performing an audit on behalf of a cloud customer. For assessing security awareness, the auditor should:

   • Aassess the existence and adequacy of a security awareness training program at the cloud service provider’s organization as the cloud customer hired the auditor to review and cloud service.
   • Bassess the existence and adequacy of a security awareness training program at both the cloud customer’s organization and the cloud service provider’s organization.
   • Cassess the existence and adequacy of a security awareness training program at the cloud customer’s organization as they hired the auditor.
   • Dnot assess the security awareness training program as it is each organization’s responsibility

   Show answer

   Answer: B

   Next question

2. Question 112 · 271 in bank

   Which of the following would give an auditor the BEST view of design and implementation decisions when an organization uses programmatic automation for Infrastructure as a Service (IaaS) deployments? The visibility of:

   • Aoutput from threat modeling exercises.
   • Bresults from automated testing.
   • Csource code within build scripts.
   • Dservice level agreements.

   Show answer

   Answer: A

   Next question

3. Question 113 · 271 in bank

   The MOST critical concept of managing the build and test of code in DevOps is:

   • Acontinuous build.
   • Bcontinuous delivery.
   • Ccontinuous deployment.
   • Dcontinuous integration.

   Show answer

   Answer: D

   Next question

4. Question 114 · 271 in bank

   The Cloud Computing Compliance Controls Catalogue (C5) framework is maintained by which of the following agencies?

   • AAgence nationale de la sécurité des systèmes d’information (ANSSI)
   • BNational Institute of Standards and Technology (NIST)
   • CNational Security Agency (NSA)
   • DBundesamt für Sicherheit in der Informationstechnik (BSI)

   Show answer

   Answer: D

   Next question

5. Question 115 · 271 in bank

   Which statement about compliance responsibilities and ownership of accountability is correct?

   • AOrganizations may be able to transfer their accountability for compliance with various regulatory requirements to their CSPs, but they retain the ownership of responsibility.
   • BOrganizations may be able to transfer their responsibility for compliance with various regulatory requirements to their CSPs, but they retain the ownership of accountability.
   • COrganizations may transfer their responsibility and accountability for compliance with various regulatory requirements to their CSPs.
   • DOrganizations are not able to transfer their responsibility nor accountability for compliance with various regulatory requirements to their CSPs.

   Show answer

   Answer: B

   Next question

6. Question 116 · 271 in bank

   Which objective is MOST appropriate to measure the effectiveness of password policy?

   • AThe number of related incidents increases.
   • BAttempts to log with weak credentials increases.
   • CNewly created account credentials satisfy requirements.
   • DThe number of related incidents decreases.

   Show answer

   Answer: D

   Next question

7. Question 117 · 271 in bank

   A Dot Release of Cloud Control Matrix (CCM) indicates what?

   • AThe introduction of new control frameworks mapped to previously-published CCM controls.
   • BA revision of the CCM domain structure.
   • CA technical change (revision or addition or deletion) of a number of controls is smaller than 10% compared to the previous “Full” release.
   • DA technical change (revision or addition or deletion) of a number of controls is greater than 10% compared to the previous “Full” release.

   Show answer

   Answer: C

   Next question

8. Question 118 · 271 in bank

   What should be the auditor’s PRIMARY objective while examining a cloud service provider’s (CSP’s) SLA?

   • AVerifying whether commensurate compensation in the form of service credits is factored in if the CSC is unable to match its SLA obligations
   • BVerifying whether the SLA includes all the operational matters which are material to the operation of the service
   • CVerifying whether the SLA caters to the availability requirements of the cloud service customer (CSC)
   • DVerifying whether the SLAs are well-defined and measurable

   Show answer

   Answer: B

   Next question

9. Question 119 · 271 in bank

   Which of the following is a cloud-specific security standard?

   • AISO27017
   • BISO27701
   • CISO22301
   • DISO14001

   Show answer

   Answer: A

   Next question

10. Question 120 · 271 in bank

    Which of the following is an example of a corrective control?

    • AA central anti-virus system installing the latest signature files before allowing a connection to the network
    • BUnsuccessful access attempts being automatically logged for investigation
    • CPrivileged access to critical information systems requiring a second factor of authentication using soft token
    • DAll new employees having standard access rights until their manager approves privileged rights

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 111. 271 questions available.