CCAK practice questions 11–20

1. Question 11 · 271 in bank

   When a client’s business process changes, the CSP SLA should:

   • Abe reviewed, but the SLA cannot be updated.
   • Bnot be reviewed, but the cloud contract should be cancelled immediately.
   • Cnot be reviewed as the SLA cannot be updated.
   • Dbe reviewed and updated if required.

   Show answer

   Answer: D

   Next question

2. Question 12 · 271 in bank

   Policies and procedures shall be established, and supporting business processes and technical measures implemented, for maintenance of several items ensuring continuity and availability of operations and support personnel. Which of the following controls BEST matches this control description?

   • AOperations Maintenance
   • BSystem Development Maintenance
   • CEquipment Maintenance
   • DSystem Maintenance

   Show answer

   Answer: A

   Next question

3. Question 13 · 271 in bank

   An auditor identifies that a CSP received multiple customer inquiries and RFPs during the last month. Which of the following should be the BEST recommendation to reduce the CSP burden?

   • ACSP can share all security reports with customers to streamline the process.
   • BCSP can schedule a call with each customer.
   • CCSP can answer each customer individually.
   • DCSP can direct all customers’ inquiries to the information in the CSA STAR registry.

   Show answer

   Answer: D

   Next question

4. Question 14 · 271 in bank

   Which of the following approaches encompasses social engineering of staff, bypassing of physical access controls and penetration testing?

   • ABlue team
   • BWhite box
   • CGray box
   • DRed team

   Show answer

   Answer: D

   Next question

5. Question 15 · 271 in bank

   When applying the Top Threats Analysis methodology following an incident, what is the scope of the technical impact identification step?

   • ADetermine the impact on the controls that were selected by the organization to respond to identified risks.
   • BDetermine the impact on confidentiality, integrity and availability of the information system.
   • CDetermine the impact on the financial, operational, compliance and reputation of the organization.
   • DDetermine the impact on the physical and environmental security of the organization, excluding informational assets.

   Show answer

   Answer: B

   Next question

6. Question 16 · 271 in bank

   When performing audits in relation to Business Continuity Management and Operational Resilience strategy, what would be the MOST critical aspect to audit in relation to the strategy of the cloud customer that should be formulated jointly with the cloud service provider?

   • AValidate if the strategy covers unavailability of all components required to operate the business-as-usual or in disrupted mode, in parts or total- when impacted by a disruption.
   • BValidate if the strategy covers all aspects of Business Continuity and Resilience planning, taking inputs from the assessed impact and risks, to consider activities for before, during, and after a disruption.
   • CValidate if the strategy covers all activities required to continue and recover prioritized activities within identified time frames and agreed capacity, aligned to the risk appetite of the organization including the invocation of continuity plans and crisis management capabilities.
   • DValidate if the strategy is developed by both cloud service providers and cloud service consumers within the acceptable limits of their risk appetite.

   Show answer

   Answer: C

   Next question

7. Question 17 · 271 in bank

   Which of the following metrics are frequently immature?

   • AMetrics around Infrastructure as a Service (IaaS) storage and network environments
   • BMetrics around Platform as a Service (PaaS) development environments
   • CMetrics around Infrastructure as a Service (IaaS) computing environments
   • DMetrics around specific Software as a Service (SaaS) application services

   Show answer

   Answer: D

   Next question

8. Question 18 · 271 in bank

   The MAIN difference between Cloud Control Matrix (CCM) and Consensus Assessment Initiative Questionnaire (CAIQ) is that:

   • ACCM assesses the presence of controls, whereas CAIQ assesses overall security of a service.
   • BCCM has a set of security questions, whereas CAIQ has a set of security controls.
   • CCCM has 14 domains and CAIQ has 16 domains.
   • DCCM provides a controls framework, whereas CAIQ provides industry-accepted ways to document which security controls exist in IaaS, PaaS, and SaaS offerings.

   Show answer

   Answer: D

   Next question

9. Question 19 · 271 in bank

   Which of the following is an example of financial business impact?

   • AA hacker using a stolen administrator identity brings down the SaaS sales and marketing systems, resulting in the inability to process customer orders or manage customer relationships.
   • BWhile the breach was reported in a timely manner to the CEO, the CFO and CISO blamed each other in public, resulting in a loss of public confidence that led the board to replace all three.
   • CA DDoS attack renders the customer's cloud inaccessible for 24 hours resulting in millions in lost sales.
   • DThe cloud provider fails to report a breach of customer personal data from an unsecured server, resulting in GDPR fines of 10 million euro.

   Show answer

   Answer: C

   Next question

10. Question 20 · 271 in bank

    From the perspective of a senior cloud security audit practitioner in an organization of a mature security program with cloud adoption, which of the following statements BEST describes the DevSecOps concept?

    • AProcess of security integration using automation in software development
    • BDevelopment standards for addressing integration, testing, and deployment issues
    • COperational framework that promotes software consistency through automation
    • DMaking software development simpler, faster, and easier using automation

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 11. 271 questions available.