CCAK practice questions 151–160

1. Question 151 · 271 in bank

   To minimize the risk of noncompliance with regulatory equipment when switching to a new cloud service, it is MOST important to:

   • Aadopt a hard-cutover approach to minimize the risk of data loss.
   • Btest and validate that the new service meets predefined security targets.
   • Cseek assurances from peer organizations already using the proposed cloud service.
   • Densure the new service provider includes a pilot option of the cloud solution.

   Show answer

   Answer: B

   Next question

2. Question 152 · 271 in bank

   From a systems development life cycle perspective, where a Software as a Service (SaaS) provider follows a DevOps approach, it is MOST beneficial for continuous auditing controls to be:

   • Adesigned natively into the software.
   • Bsubjected to independent review.
   • Cintegrated with external tools.
   • Devaluated with high frequency.

   Show answer

   Answer: A

   Next question

3. Question 153 · 271 in bank

   A cloud service provider utilizes services of other service providers for its cloud service. Which of the following is the BEST approach for the auditor while performing the audit for the cloud service?

   • AThe auditor should review the service providers’ security controls even more strictly, as they are further separated from the cloud customer.
   • BThe auditor should review the relationship between the cloud service provider and its service provider to help direct and estimate the level of effort and analysis the auditor should apply.
   • CAs the contract for the cloud service is between the cloud customer and the cloud service provider, there is no need for the auditor to review the services provided by the service providers.
   • DAs the relationship between the cloud service provider and its service providers is governed by separate contracts between them, there is no need for the auditor to review the services provided by the service providers.

   Show answer

   Answer: B

   Next question

4. Question 154 · 271 in bank

   As Infrastructure as a Service (IaaS) cloud service providers often do not allow the cloud service customers to perform on-premise audits, the BEST approach for the auditor should be to:

   • Ause other sources of available data for evaluating the customer’s controls.
   • Brefrain from auditing the provider’s security controls due to lack of cooperation.
   • Cescalate the lack of support from the provider to the regulatory authority.
   • Drecommend that the customer not use the services provided by the provider.

   Show answer

   Answer: A

   Next question

5. Question 155 · 271 in bank

   Why are the fieldwork audit papers reviewed by an audit manager, even when the cloud auditor has many years of experience?

   • AInternal quality requirements
   • BProfessional standards
   • CAudit guidelines
   • DAudit methodology

   Show answer

   Answer: B

   Next question

6. Question 156 · 271 in bank

   During the course of a web application review, a cloud auditor identified minor weakness in a relevant database that is out of scope for the audit. Which of the following is the BEST course of action?

   • AInclude review of database controls in the scope.
   • BReport the weakness as observed.
   • CDocument for future review.
   • DWork with database administrators to rectify the issue.

   Show answer

   Answer: B

   Next question

7. Question 157 · 271 in bank

   What documents should be provided by the infrastructure and platform operations team to the auditors in relation to auditing cloud data protection and life cycle management?

   • ABackup and recovery policy, including evidence of the last review and update timeline and latest best results
   • BPolicies and procedures established around third-party risk assessments
   • CInventory of third-party attestation reports
   • DEnterprise-cloud strategy and policy

   Show answer

   Answer: A

   Next question

8. Question 158 · 271 in bank

   DevSecOps aims to integrate security tools and processes directly into the software development life cycle and should be done:

   • Ain all development steps.
   • Bat the beginning of the development cycle.
   • Cat the end of the development cycle.
   • Dafter go-live.

   Show answer

   Answer: A

   Next question

9. Question 159 · 271 in bank

   An auditor identifies that a cloud service provider received multiple customer inquiries and requests for proposal (RFPs) during the last month. Which of the following should be the BEST recommendation to reduce the provider’s burden?

   • AThe provider can answer each customer individually.
   • BThe provider can schedule a call with each customer.
   • CThe provider can share all security reports with customers to streamline the process.
   • DThe provider can direct all customer inquiries to the information in the CSA STAR registry.

   Show answer

   Answer: D

   Next question

10. Question 160 · 271 in bank

    Which of the following is a CRITICAL element that facilitates a blue-green deployment test?

    • ATesting of code in development before migration to production environment
    • BRunning of compliance and unit tests in parallel
    • CChange in network traffic routing rules
    • DMaintenance of one production region to serve clients

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 151. 271 questions available.