CCAK practice questions 211–220

1. Question 211 · 271 in bank

   What business continuity considerations does a cloud customer need when implementing a cloud-based infrastructure?

   • AFrequent review of cloud backups to ensure business continuity when needed
   • BReview of cloud service provider contractual commitments to the main continuity of the provisioned service
   • CConducting of business continuity plan (BCP) and disaster recovery (DR) tests on the cloud service provider
   • DRequirement for 100% uptime commitment from the cloud service provider at all times

   Show answer

   Answer: B

   Next question

2. Question 212 · 271 in bank

   The control domain feature within a Cloud Controls Matrix (CCM) represents:

   • ACCM's ability to scan and check Active Directory, LDAP, and x.500 directories for suspicious and/or privileged user accounts.
   • BCCM's ability to scan for anomalies in DNS zones in order to detect DNS spoofing, DNS hijacking, DNS cache poisoning, and similar threats.
   • Ca logical grouping of security controls addressing the same category of IT risks or information security concerns.
   • Da set of application programming interfaces (APIs) that allows a cloud consumer to restrict the replication area within a well-defined jurisdictional perimeter.

   Show answer

   Answer: C

   Next question

3. Question 213 · 271 in bank

   Regarding suppliers of a cloud service provider, it is MOST important for the auditor to be aware that the:

   • Aclient organization has a clear understanding of the provider's suppliers.
   • Bclient organization does not need to worry about the provider's suppliers, as this is the provider's responsibility.
   • Csuppliers are accountable for the provider's service that they are providing.
   • Dclient organization and provider are both responsible for the provider's suppliers.

   Show answer

   Answer: A

   Next question

4. Question 214 · 271 in bank

   Which of the following is the BEST indicator of the use of agile techniques to deploy an enterprise resource planning (ERP) Software as a Service (SaaS) solution for an organization?

   • AA working version of the solution is used to capture and refine user requirements.
   • BTesting of the various SaaS solution modules is completed prior to the main release.
   • CRequirements are signed off by the product owner prior to solution design.
   • DDevelopers are drawn from both the customer and SaaS vendor organizations.

   Show answer

   Answer: A

   Next question

5. Question 215 · 271 in bank

   Which of the following factors would PRIMARILY drive the decision to increase the frequency of the audit process to validate the security posture of a cloud service provider on an ongoing basis?

   • AExposure from the cloud supply chain
   • BDecreasing risk appetite
   • CIncreasing customer demand
   • DReliance on the shared responsibility model

   Show answer

   Answer: B

   Next question

6. Question 216 · 271 in bank

   Which audit report provides an attestation of audit results that cloud service providers will make available for public consumption?

   • ASOC 3
   • BSOC 1 Type 1
   • CSOC 2 Type 2
   • DSOC 1

   Show answer

   Answer: A

   Next question

7. Question 217 · 271 in bank

   Which of the following is the MOST significant difference between a cloud risk management program and a traditional risk management program?

   • ARisk management practices adopted by the cloud service provider
   • BHosting sensitive information in the cloud environment
   • CVirtualization of the IT landscape
   • DShared responsibility model

   Show answer

   Answer: D

   Next question

8. Question 218 · 271 in bank

   The effect of which of the following should have priority in planning the scope and objectives of a cloud audit?

   • AApplicable corporate standards
   • BApplicable statutory requirements
   • CApplicable industry good practices
   • DOrganizational policies and procedures

   Show answer

   Answer: B

   Next question

9. Question 219 · 271 in bank

   Which of the following report types includes prescriptive remediation recommendations along with details and action steps?

   • AInternal
   • BAudit
   • CLimited
   • DPublic

   Show answer

   Answer: A

   Next question

10. Question 220 · 271 in bank

    When auditing a Software as a Service (SaaS) cloud service provider, which of the following observations would be of GREATEST concern to the auditor?

    • AThe provider was in breach of a couple of service level agreements (SLAs) in the past year.
    • BThe audit trails are available for 3-4 days and are typically overwritten as soon as the disk reaches its capacity.
    • COnly an executive summary of the annual penetration testing report was made available by the provider for the review. It had details about the criticality of the vulnerabilities and the plan and timeline to mitigate them, but the detailed penetration testing report was not made available.
    • DIn case of a breach in the provider’s environment involving the organization's data, the provider sends the breach notification to the organization's breach notification shared mailbox that is documented in the service agreement.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 211. 271 questions available.