CCAK practice questions 31–40

1. Question 31 · 271 in bank

   Within an organization, which of the following functions should be responsible for defining the cloud adoption approach?

   • AAudit committee
   • BCompliance manager
   • CIT manager
   • DSenior management

   Show answer

   Answer: D

   Next question

2. Question 32 · 271 in bank

   An independent contractor is assessing security maturity of a SaaS company against industry standards. The SaaS company has developed and hosted all their products using the cloud services provided by a third-party cloud service provider (CSP). What is the optimal and most efficient mechanism to assess the controls CSP is responsible for?

   • AReview third-party audit reports.
   • BReview CSP’s published questionnaires.
   • CDirectly audit the CSP.
   • DSend supplier questionnaire to the CSP.

   Show answer

   Answer: A

   Next question

3. Question 33 · 271 in bank

   Which of the following key stakeholders should be identified the earliest when an organization is designing a cloud compliance program?

   • ACloud process owners
   • BInternal control function
   • CLegal functions
   • DCloud strategy owners

   Show answer

   Answer: D

   Next question

4. Question 34 · 271 in bank

   Which of the following CSP activities requires a client’s approval?

   • ADelete the guest account or test accounts
   • BDelete the master account or subscription owner accounts
   • CDelete the guest account or destroy test data
   • DDelete the test accounts or destroy test data

   Show answer

   Answer: B

   Next question

5. Question 35 · 271 in bank

   A cloud service provider does not allow audits using automated tools as these tools could be considered destructive techniques for the cloud environment. Which of the following aspects of the audit will be constrained?

   • APurpose
   • BObjectives
   • CNature of relationship
   • DScope

   Show answer

   Answer: D

   Next question

6. Question 36 · 271 in bank

   An organization has an ISMS implemented, following ISO 27001 and Annex A controls. The CIO would like to migrate some of the infrastructure to the cloud. Which of the following standards would BEST assist in identifying controls to consider for this migration?

   • AISO/IEC 27701
   • BISO/IEC 22301
   • CISO/IEC 27002
   • DISO/IEC 27017

   Show answer

   Answer: D

   Next question

7. Question 37 · 271 in bank

   An organization is in the initial phases of cloud adoption. It is not very knowledgeable about cloud security and cloud shared responsibility models. Which of the following approaches is BEST suited for such an organization to evaluate its cloud security?

   • AUse of an established standard/regulation to map controls and use as the audit criteria
   • BFor efficiency reasons, use of its on-premises systems’ audit criteria to audit the cloud environment
   • CAs this is the initial stage, the ISO/IEC 27001 certificate shared by the cloud service provider is sufficient for audit and compliance purposes.
   • DDevelopment of the cloud security audit criteria based on its own internal audit test plans to ensure appropriate coverage

   Show answer

   Answer: A

   Next question

8. Question 38 · 271 in bank

   Which of the following controls framework should the cloud customer use to assess the overall security risk of a cloud provider?

   • ASOC3 - Type2
   • BCloud Control Matrix (CCM)
   • CSOC2 - Type1
   • DSOC1 - Type1

   Show answer

   Answer: B

   Next question

9. Question 39 · 271 in bank

   Which of the following aspects of risk management involves identifying the potential reputational harm and/or financial harm when an incident occurs?

   • AMitigations
   • BResidual risk
   • CLikelihood
   • DImpact Analysis

   Show answer

   Answer: D

   Next question

10. Question 40 · 271 in bank

    When using a SaaS solution, who is responsible for application security?

    • AThe cloud service provider only
    • BThe cloud service consumer only
    • CBoth cloud consumer and the enterprise
    • DBoth cloud provider and the consumer

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 31. 271 questions available.