CCAK practice questions 41–50

1. Question 41 · 271 in bank

   Which of the following would be the GREATEST governance challenge to an organization where production is hosted in a public cloud and backups are held on the premises?

   • AAligning the cloud service delivery with the organization’s objective
   • BAligning the cloud provider’s SLA with the organization’s policy
   • CAligning shared responsibilities between provider and customer
   • DAligning the organization’s activity with the cloud provider’s policy

   Show answer

   Answer: C

   Next question

2. Question 42 · 271 in bank

   What aspect of SaaS functionality and operations would the cloud customer be responsible for and should be audited?

   • AAccess controls
   • BVulnerability management
   • CSource code reviews
   • DPatching

   Show answer

   Answer: A

   Next question

3. Question 43 · 271 in bank

   The Open Certification Framework is structured on three levels of trust. Those three levels of trust are:

   • ACSA STAR Self-Assessment, STAR Certification & Attestation (Third-party Assessment), STAR Compliance
   • BCSA STAR Audit, STAR Certification & Attestation (Third-party Assessment), STAR Continuous
   • CCSA STAR Self-Assessment, STAR Certification & Attestation (Third-party Assessment), STAR Monitoring and Control
   • DCSA STAR Self-Assessment, STAR Certification & Attestation (Third-party Assessment), STAR Continuous

   Show answer

   Answer: D

   Next question

4. Question 44 · 271 in bank

   Which of the following is a fundamental concept of FedRAMP that intends to save costs, time, and staff conducting superfluous agency security assessments?

   • AUse often, provide many times
   • BBe economical, act deliberately
   • CUse existing, provide many times
   • DDo once, use many times

   Show answer

   Answer: D

   Next question

5. Question 45 · 271 in bank

   Which of the following is the risk associated with storing data in a cloud that crosses jurisdictions?

   • ACompliance risk
   • BProvider administration risk
   • CAudit risk
   • DVirtualization risk

   Show answer

   Answer: A

   Next question

6. Question 46 · 271 in bank

   Since CCM allows cloud customers to build a detailed list of requirements and controls to be implemented by the CSP as part of their overall third-party risk management and procurement program, will CCM alone be enough to define all the items to be considered when operating/using cloud services?

   • ANo. CCM must be completed with definitions established by the CSP because of its relevance to service continuity.
   • BYes. CCM suffices since it maps a huge library of widely accepted frameworks.
   • CYes. When implemented in the right manner, CCM alone can help to measure, assess and monitor the risk associated with a CSP or a particular service.
   • DNo. CCM can serve as a foundation for a cloud assessment program, but it needs to be completed with requirements applicable to each company.

   Show answer

   Answer: D

   Next question

7. Question 47 · 271 in bank

   Which of the following is the BEST recommendation to offer an organization’s HR department planning to adopt a new public SaaS application to ease the recruiting process?

   • AEnsure HIPAA compliance
   • BImplement a cloud access security broker
   • CConsult the legal department
   • DDo not allow data to be in cleratext

   Show answer

   Answer: C

   Next question

8. Question 48 · 271 in bank

   During an audit it was identified that a critical application hosted in an off-premises cloud is not part of the organization’s DRP (Disaster Recovery Plan). Management stated that it is responsible for ensuring that the cloud service provider (CSP) has a plan that is tested annually. What should be the auditor’s NEXT course of action?

   • AReview the CSP audit reports.
   • BReview the security white paper of the CSP.
   • CReview the contract and DR capability.
   • DPlan an audit of the CSP.

   Show answer

   Answer: C

   Next question

9. Question 49 · 271 in bank

   In which control should a cloud service provider, upon request, inform customers of compliance impact and risk, especially if customer data is used as part of the services?

   • AService Provider control
   • BImpact and Risk control
   • CData Inventory control
   • DCompliance control

   Show answer

   Answer: D

   Next question

10. Question 50 · 271 in bank

    Which of the following is a direct benefit of mapping the Cloud Control Matrix (CCM) to other international standards and regulations?

    • ACCM mapping entitles cloud service providers to be listed as an approved supplier for tenders and government contracts.
    • BCCM mapping enables cloud service providers and customers alike to streamline their own compliance and security efforts.
    • CCCM mapping enables an uninterrupted data flow and, in particular, the export of personal data across different jurisdictions.
    • DCCM mapping entitles cloud service providers to be certified under the CSA STAR program.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 41. 271 questions available.