CCAK practice questions 171–180

1. Question 171 · 271 in bank

   An audit that evaluates the organization’s framework for defining requirements, performing risk assessments, monitoring controls, reporting adherence, and developing a strategic plan for the cloud is:

   • Aa compliance and controls audit.
   • Bconfiguration and activity monitoring.
   • Ca governance and strategy audit.
   • Daccess review

   Show answer

   Answer: C

   Next question

2. Question 172 · 271 in bank

   Which of the following should be performed FIRST when an organization is considering a migration to the cloud?

   • ASelect the cloud deployment model.
   • BIdentify applicable laws and regulations to the organization.
   • CSelect a suitable control framework for the implementation.
   • DIdentify different suitable cloud service providers.

   Show answer

   Answer: B

   Next question

3. Question 173 · 271 in bank

   Which of the following enables auditors to conduct gap analyses of what a cloud service provider offers versus what the customer requires?

   • AThe as-is and to-be enterprise architecture (EA)
   • BUsing a standardized control framework
   • CThe experience gained over the years
   • DUnderstanding the customer risk profile

   Show answer

   Answer: B

   Next question

4. Question 174 · 271 in bank

   Which industry organization provides benchmarking for cloud providers, virtualization, and other categories?

   • AThe SANS Institute
   • BThe OWASP Foundation
   • CVendors of cloud technologies
   • DCenter for Internet Security (CIS)

   Show answer

   Answer: D

   Next question

5. Question 175 · 271 in bank

   Who would be BEST suited to mitigate on a daily basis the risk related to development and operations practices in a public cloud?

   • ARisk management team
   • BDevOps team
   • CInternal audit team
   • DCloud infrastructure team

   Show answer

   Answer: B

   Next question

6. Question 176 · 271 in bank

   What is below the waterline in the context of cloud operationalization?

   • AThe controls operated by the cloud access security broker (CASB)
   • BThe controls operated by both
   • CThe controls operated by the customer
   • DThe controls operated by the cloud service provider

   Show answer

   Answer: D

   Next question

7. Question 177 · 271 in bank

   An auditor wants to get information about the operating effectiveness of controls addressing privacy, availability, and confidentiality of a service organization. Which of the following can BEST help to gain the required information?

   • ASOC2 Type 2 report
   • BISAE 3402 report
   • CSOC1 Type 1 report
   • DISO/IEC 27001 certification

   Show answer

   Answer: A

   Next question

8. Question 178 · 271 in bank

   A cloud auditor observed that just before a new software went live, the librarian transferred production data to the test environment to confirm the new software can work in the production environment. What additional control should the cloud auditor check?

   • AApproval of the change by the change advisory board
   • BExplicit documented approval from all customers whose data is affected
   • CTraining for the librarian
   • DVerification that the hardware of the test and production environments are compatible

   Show answer

   Answer: A

   Next question

9. Question 179 · 271 in bank

   Which of the following should a cloud auditor recommend regarding controls for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse?

   • AEstablishment of policies and procedures across multiple system interfaces, jurisdictions, and business functions to prevent improper disclosure, alteration, or destruction
   • BData input and output integrity routines
   • CAssessment of contractual and regulatory requirements for customer access
   • DTesting in accordance with leading industry standards such as OWASP

   Show answer

   Answer: B

   Next question

10. Question 180 · 271 in bank

    An organization deploying the Cloud Controls Matrix (CCM) to perform a compliance assessment will encompass the use of the Corporate Governance Relevance feature to filter out those controls:

    • Athat are related to policies, processes, laws, regulations, and institutions conditioning the way an organization is managed, directed, or controlled.
    • Bthat can be of either an administrative or a technical nature, therefore requiring an approval from the Change Advisory Board.
    • Cthat can be of either a management or a legal nature, therefore requiring an approval from the Change Advisory Board.
    • Dthat require prior approval from the Board of Directors to be funded (for either make or buy), implemented, and reported on.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 171. 271 questions available.