CCAK practice questions 231–240

1. Question 231 · 271 in bank

   Which of the following is MOST important to ensure effective operationalization of cloud security controls?

   • AIdentifying business requirements
   • BComparing different control frameworks
   • CAssessing existing risks
   • DTraining and awareness

   Show answer

   Answer: D

   Next question

2. Question 232 · 271 in bank

   Which of the following is an example of reputational business impact?

   • AWhile the breach was reported in a timely manner to the CEO, the CFO and CISO blamed each other in public, resulting in a loss of public confidence that led the board to replace all three.
   • BThe cloud provider fails to report a breach of customer personal data from an unsecured server, resulting in GDPR fines of 10 million euros.
   • CA distributed denial of service (DDoS) attack renders the customer's cloud inaccessible for 24 hours, resulting in millions in lost sales.
   • DA hacker using a stolen administrator identity brings down the Software as a Service (SaaS) sales and marketing systems, resulting in the inability to process customer orders or manage customer relationships.

   Show answer

   Answer: A

   Next question

3. Question 233 · 271 in bank

   From an auditor perspective, which of the following BEST describes shadow IT?

   • AAn opportunity to diversify the cloud control approach
   • BA weakness in the cloud compliance posture
   • CA strength of disaster recovery (DR) planning
   • DA risk that jeopardizes business continuity planning

   Show answer

   Answer: B

   Next question

4. Question 234 · 271 in bank

   In a situation where duties related to cloud risk management and control are split between an organization and its cloud service providers, which of the following would BEST help to ensure a coordinated approach to risk and control processes?

   • AEstablishing a joint security operations center
   • BAutomating reporting of risk and control compliance
   • CCo-locating compliance management specialists
   • DMaintaining a centralized risk and controls dashboard

   Show answer

   Answer: A

   Next question

5. Question 235 · 271 in bank

   Which of the following provides the BEST evidence that a cloud service provider's continuous integration and continuous delivery (CI/CD) development pipeline includes checks for compliance as new features are added to its Software as a Service (SaaS) applications?

   • ACompliance tests are automated and integrated within the CI tool.
   • BDevelopers keep credentials outside the code base and in a secure repository.
   • CFrequent compliance checks are performed for development environments.
   • DThird-party security libraries are continuously kept up to date.

   Show answer

   Answer: A

   Next question

6. Question 236 · 271 in bank

   Which of the following is the PRIMARY area for an auditor to examine in order to understand the criticality of the cloud services in an organization, along with their dependencies and risks?

   • ATurtle diagram
   • BData security process flow
   • CContractual documents of the cloud service provider
   • DHeat maps

   Show answer

   Answer: C

   Next question

7. Question 237 · 271 in bank

   During the planning phase of a cloud audit, the PRIMARY goal of a cloud auditor is to:

   • Aaddress audit objectives.
   • Bcollect sufficient evidence.
   • Cminimize audit resources.
   • Dspecify appropriate tests.

   Show answer

   Answer: A

   Next question

8. Question 238 · 271 in bank

   An auditor is reviewing an organization's virtual machines (VMs) hosted in the cloud. The organization utilizes a configuration management (CM) tool to enforce password policies on its VMs. Which of the following is the BEST approach for the auditor to use to review the operating effectiveness of the password requirement?

   • AThe auditor should not rely on the CM tool and its settings, and for thoroughness should review the password configuration on the set of sample VMs.
   • BReview the relevant configuration settings on the CM tool and check whether the CM tool agents are operating effectively on the sample VMs.
   • CAs it is an automated environment, reviewing the relevant configuration settings on the CM tool would be sufficient.
   • DReview the incident records for any incidents relating to brute force attacks or password compromise in the last 12 months and investigate whether the root cause of the incidents was due to inappropriate password policy configured on the VMs.

   Show answer

   Answer: B

   Next question

9. Question 239 · 271 in bank

   Why should the results of third-party audits and certification be relied on when analyzing and assessing the cybersecurity risks in the cloud?

   • ATo reinforce the role of the internal audit function
   • BTo establish an audit mindset within the organization
   • CTo contrast the risk generated by the loss of control
   • DTo establish an accountability culture within the organization

   Show answer

   Answer: C

   Next question

10. Question 240 · 271 in bank

    While using Software as a Service (SaaS) to store secret customer information, an organization identifies a risk of disclosure to unauthorized parties. Although the SaaS service continues to be used, secret customer data is not processed. Which of the following risk treatment methods is being practiced?

    • ARisk acceptance
    • BRisk transfer
    • CRisk mitigation
    • DRisk reduction

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 231. 271 questions available.