CCAK practice questions 141–150

1. Question 141 · 271 in bank

   Which of the following BEST describes the Center for Internet Security (CIS) benchmarks applied to a cloud service provider?

   • ABest practices for the tuning of performance in cloud service providers’ services
   • BBest practices for the secure configuration of the cloud service provider services
   • CComparisons of the performance obtained from the cloud service providers
   • DComparisons of the security capabilities provided by the cloud service providers

   Show answer

   Answer: B

   Next question

2. Question 142 · 271 in bank

   A large organization recently migrated to the cloud and identified Function as a Service (FaaS) as a new service category that enhances the concept of:

   • Abeta testing.
   • Bfuzzing.
   • Calpha testing.
   • Dscripting.

   Show answer

   Answer: D

   Next question

3. Question 143 · 271 in bank

   Which of the following is a KEY benefit of using the Cloud Controls Matrix (CCM)?

   • ACCM maps to existing security standards, best practices, and regulations.
   • BCCM utilizes an ITIL framework to define the capabilities needed to manage the IT services and security services.
   • CCCM V4 is an improved version from CCM V3.0.1.
   • DCCM uses a specific control for Infrastructure as a Service (IaaS).

   Show answer

   Answer: A

   Next question

4. Question 144 · 271 in bank

   Which of the following has been provided by the Federal Office for Information Security in Germany to support customers in selecting, controlling, and monitoring their cloud service providers?

   • AGerman IDW PS 951
   • BMulti-Tier Cloud Security (MTCS)
   • CBSI Criteria Catalogue C5
   • DBSI IT-basic protection catalogue

   Show answer

   Answer: C

   Next question

5. Question 145 · 271 in bank

   Organizations, including cloud service providers or cloud customers, must have methods for determining the disruption to processes, people, and technology. Which of the following processes can BEST help identify the issues?

   • AImpact analysis
   • BResearch analysis
   • CPredictive analysis
   • DDisruption analysis

   Show answer

   Answer: A

   Next question

6. Question 146 · 271 in bank

   It is MOST important for an auditor to be aware that an inventory of assets within a cloud environment:

   • Ais fundamental for the security management program.
   • Bis not fundamental for the security management program, as this is a cloud service.
   • Cshould be mapped only if discovered during the audit.
   • Dcan be a misleading source of data.

   Show answer

   Answer: A

   Next question

7. Question 147 · 271 in bank

   Which of the following cloud environments should be a concern to an organization’s cloud auditor?

   • AThe cloud service provider’s data center is more than 100 miles away.
   • BThe organization entirely depends on several proprietary Software as a Service (SaaS) applications.
   • CThe failover region of the cloud service provider is on another continent.
   • DThe technical team is trained on only one vendor Infrastructure as a Service (Iaas) platform, but the organization has subscribed to another vendor’s IaaS platform as an alternative.

   Show answer

   Answer: D

   Next question

8. Question 148 · 271 in bank

   An external auditor is auditing a global organization located in Portugal that does business with a US-based organization in California. The auditor should verify that the global organization complies with which of the following regulations?

   • ASOC 2
   • BGDPR
   • CHIPAA
   • DCCPA

   Show answer

   Answer: B

   Next question

9. Question 149 · 271 in bank

   What should an auditor do when assessing the business continuity plan (BCP) and disaster recovery (DR) of a cloud customer?

   • AEvaluate the service level agreement (SLA) through a BCP/DR lens.
   • BGet assurances from the cloud service provider that the service level agreement (SLA) can be met in a BCP/DR scenario.
   • CRecommend auditing the BCP/DR planning under a separate engagement.
   • DLimit the scope of the evaluation to security measures that are under the direct responsibility of the auditee.

   Show answer

   Answer: A

   Next question

10. Question 150 · 271 in bank

    When capturing compliance objectives within an organization’s cloud policy, it is MOST important for stakeholders to:

    • Atake into consideration the organization’s risk appetite.
    • Bmeasure the operating effectiveness of existing controls.
    • Cseek input from external subject matter experts.
    • Dfollow a structured decision-making process.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 141. 271 questions available.