CCAK practice questions 21–30

1. Question 21 · 271 in bank

   Which of the following is MOST important to consider when developing an effective threat model during the introduction of a new SaaS service into a customer organization’s architecture? The threat model:

   • Arecognizes the shared responsibility for risk management between the customer and the CSP.
   • Bleverages SaaS threat models developed by peer organizations.
   • Cis developed by an independent third-party with expertise in the organization’s industry sector.
   • Dconsiders the loss of visibility and control from transitioning to the cloud.

   Show answer

   Answer: A

   Next question

2. Question 22 · 271 in bank

   While performing the audit, the auditor found that an object storage bucket containing PII could be accessed by anyone on the Internet. Given this discovery, what should be the most appropriate action for the auditor to perform?

   • AHighlighting the gap to the audit sponsor at the sponsor’s earliest possible availability
   • BAsking the organization’s cloud administrator to immediately close the gap by updating the configuration settings and making the object storage bucket private and hence inaccessible from the Internet
   • CDocumenting the finding in the audit report and sharing the gap with the relevant stakeholders
   • DInforming the organization’s internal audit manager immediately about the gap

   Show answer

   Answer: B

   Next question

3. Question 23 · 271 in bank

   To qualify for CSA STAR attestation for a particular cloud system, the SOC 2 report must cover:

   • AISO/IЕС 27001: 2013 controls.
   • Bmaturity model criteria.
   • Call Cloud Control Matrix (CCM) controls and TSPC security principles.
   • DCloud Control Matrix (CCM) and ISO/IEC 27001:2013 controls.

   Show answer

   Answer: C

   Next question

4. Question 24 · 271 in bank

   Which of the following is MOST important to consider when an organization is building a compliance program for the cloud?

   • AThe rapidly changing service portfolio and architecture of the cloud.
   • BCloud providers should not be part of the compliance program.
   • CThe fairly static nature of the service portfolio and architecture of the cloud.
   • DThe cloud is similar to the on-premise environment in terms of compliance.

   Show answer

   Answer: A

   Next question

5. Question 25 · 271 in bank

   When developing a cloud compliance program, what is the PRIMARY reason for a cloud customer to review which cloud services will be deployed?

   • ATo determine how those services will fit within its policies and procedures
   • BTo determine the total cost of the cloud services to be deployed
   • CTo confirm which vendor will be selected based on the compliance with security requirements
   • DTo confirm if the compensating controls implemented are sufficient for the cloud

   Show answer

   Answer: A

   Next question

6. Question 26 · 271 in bank

   Which of the following attestation allows for immediate adoption of the Cloud Control Matrix (CCM) as additional criteria to AICPA Trust Service Criteria and provides the flexibility to update the criteria as technology and market requirements change?

   • APC-IDSS
   • BCSA STAR Attestation
   • CMTCS
   • DBSI Criteria Catalogue C5

   Show answer

   Answer: B

   Next question

7. Question 27 · 271 in bank

   To ensure that cloud audit resources deliver the best value to the organization, the PRIMARY step would be to:

   • Adevelop a cloud audit plan on the basis of a detailed risk assessment.
   • Bschedule the audits and monitor the time spent on each audit.
   • Ctrain the cloud audit staff on current technology used in the organization.
   • Dmonitor progress of audits and initiate cost control measures.

   Show answer

   Answer: A

   Next question

8. Question 28 · 271 in bank

   Which of the following is an example of integrity technical impact?

   • AThe cloud provider reports a breach of customer personal data from an unsecured server.
   • BA hacker using a stolen administrator identity alerts the discount percentage in the product database.
   • CA DDoS attack renders the customer’s cloud inaccessible for 24 hours.
   • DAn administrator inadvertently clicked on Phish bait exposing his company to a ransomware attack.

   Show answer

   Answer: B

   Next question

9. Question 29 · 271 in bank

   What is a sign of an organization that has adopted a shift-left concept of code release cycles?

   • AA waterfall model to move resources through the development to release phases
   • BIncorporation of automation to identify and address software code problems early
   • CMaturity of start-up entities with high-iteration to low-volume code commits
   • DLarge entities with slower release cadences and geographical dispersed systems

   Show answer

   Answer: B

   Next question

10. Question 30 · 271 in bank

    Cloud Control Matrix (CCM) controls can be used by cloud customers to:

    • Adevelop new security baselines for the industry.
    • Bdefine different control frameworks for different cloud service providers.
    • Cfacilitate communication with their legal department.
    • Dbuild an operational cloud risk management program.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 21. 271 questions available.