CCAK practice questions 201–210

1. Question 201 · 271 in bank

   Controls implemented as part of a cloud compliance plan need to be adapted depending on changes in the:

   • Akey control indicators (KCIs).
   • Bthreat landscape.
   • Crisk scoring criteria.
   • Drisk owner expertise.

   Show answer

   Answer: B

   Next question

2. Question 202 · 271 in bank

   An example of a preventive control that may be identified in an Infrastructure as a Service (IaaS) service provider is:

   • Aprivileged access monitoring.
   • Bthreat hunting.
   • Cencryption for data at rest.
   • Dincident response.

   Show answer

   Answer: C

   Next question

3. Question 203 · 271 in bank

   An organization should document the compliance responsibilities and ownership of accountability in a RACI chart or its informational equivalents in order to:

   • Aconform to the organization's governance model.
   • Bdefine the cloud compliance requirements and how they interplay with the organization's business strategy, goals, and other compliance requirements.
   • Cprovide a holistic and seamless view of the enterprise's responsibility for compliance with prevailing laws and regulations.
   • Dprovide a holistic and seamless view of the cloud service provider's responsibility for compliance with prevailing laws and regulations.

   Show answer

   Answer: B

   Next question

4. Question 204 · 271 in bank

   Which of the following enterprise architecture (EA) frameworks is MOST likely to define the EA technology services domain?

   • AThe Open Group Application Framework (TOGAF)
   • BInformation Technology Infrastructure Library (ITIL)
   • CSherwood Applied Business Security Architecture (SABSA)
   • DControl Objectives for Information Technologies (COBIT)

   Show answer

   Answer: A

   Next question

5. Question 205 · 271 in bank

   Which of the following helps an organization to identify control gaps and shortcomings in the context of cloud computing?

   • APeriodic documentation review
   • BUser security awareness training
   • CWalk-through peer review
   • DMonitoring effectiveness

   Show answer

   Answer: D

   Next question

6. Question 206 · 271 in bank

   An organization plans to migrate to an Infrastructure as a Service (IaaS) cloud service provider and performs an evaluation of the provider's security. What would be the BEST course of action for the cloud auditor to understand the provider's network security controls?

   • APerform an independent audit of the cloud service provider’s premises.
   • BAsk the cloud service provider for a detailed network diagram.
   • CCheck the information provided by the cloud service provider.
   • DPerform pen testing against the cloud service provider's infrastructure.

   Show answer

   Answer: C

   Next question

7. Question 207 · 271 in bank

   When using transparent database encryption, where does the encryption engine reside?

   • AIn a key management system
   • BOn the instances attached to the volume
   • CAt the application using the database
   • DWithin the database

   Show answer

   Answer: D

   Next question

8. Question 208 · 271 in bank

   Which of the following activities is performed outside information security monitoring?

   • AManagement review of the information security framework
   • BCollection and review of security events before escalation
   • CPeriodic review of risks, vulnerabilities, likelihoods, and threats
   • DMonitoring the effectiveness of implemented controls

   Show answer

   Answer: A

   Next question

9. Question 209 · 271 in bank

   What is the PRIMARY mission of the FedRAMP Program Management Office (PMO)?

   • ATo provide agencies of the federal government a dedicated tool to certify Authority to Operate (ATO)
   • BTo promote the adoption of secure cloud services across the federal government by providing a standardized approach to security and risk assessment
   • CTo publish a comprehensive and official framework for the secure implementation of controls for cloud security
   • DTo enable 3PAOs to perform independent security assessments of cloud service providers

   Show answer

   Answer: B

   Next question

10. Question 210 · 271 in bank

    A dot release of the Cloud Controls Matrix (CCM) indicates:

    • Aa technical change (revision, addition, or deletion) of a number of controls that is smaller than 10% compared to the previous full release.
    • Ba revision of the CCM domain structure.
    • Cthe introduction of new control frameworks mapped to previously published CCM controls.
    • Da technical change (revision, addition, or deletion) of a number of controls that is greater than 10% compared to the previous full release.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 201. 271 questions available.