CCAK practice questions 51–60

1. Question 51 · 271 in bank

   What is the advantage of using dynamic application security testing (DAST) over static application security testing (SAST) methodology?

   • AUnlike SAST, DAST is a blackbox and programming language agnostic.
   • BDAST can dynamically integrate with most CI/CD tools.
   • CDAST delivers more false positives than SAST.
   • DDAST is slower but thorough.

   Show answer

   Answer: D

   Next question

2. Question 52 · 271 in bank

   The criteria for limiting services allowing non-critical services or services requiring high availability and resilience to be moved to the cloud is an important consideration to be included PRIMARILY in the:

   • Arisk management policy.
   • Bcloud policy.
   • Cbusiness continuity plan.
   • Dinformation security standard for cloud technologies.

   Show answer

   Answer: C

   Next question

3. Question 53 · 271 in bank

   Which of the following should be the FIRST step to establish a cloud assurance program during a cloud migration?

   • ADesign
   • BStakeholder identification
   • CDevelopment
   • DRisk assessment

   Show answer

   Answer: A

   Next question

4. Question 54 · 271 in bank

   Customer management interface, if compromised over public internet, can lead to:

   • Acustomer’s computing and data compromise.
   • Baccess to the RAM of neighboring cloud computer.
   • Cease of acquisition of cloud services.
   • Dincomplete wiping of the data.

   Show answer

   Answer: A

   Next question

5. Question 55 · 271 in bank

   How should controls be designed by an organization?

   • ABy the internal audit team
   • BUsing the ISO27001 framework
   • CBy the cloud provider
   • DUsing the organization’s risk management framework

   Show answer

   Answer: D

   Next question

6. Question 56 · 271 in bank

   To assist an organization with planning a cloud migration strategy to execution, an auditor should recommend the use of:

   • Aobject-oriented architecture.
   • Bsoftware architecture.
   • Cservice-oriented architecture.
   • Denterprise architecture.

   Show answer

   Answer: D

   Next question

7. Question 57 · 271 in bank

   Which of the following quantitative measures is KEY for an auditor to review when assessing the implementation of continuous auditing of performance on a cloud system?

   • AService Level Objective (SLO)
   • BRecovery Point Objectives (RPO)
   • CService Level Agreement (SLA)
   • DRecovery Time Objectives (RTO)

   Show answer

   Answer: A

   Next question

8. Question 58 · 271 in bank

   Your company is purchasing an application from a vendor. They do not allow you to perform an on-site audit on their information system. However, they say, they will provide the third-party audit attestation on the adequate control design within their environment. Which report is the vendor providing you?

   • ASOC 3
   • BSOC 2, TYPE 2
   • CSOC 1
   • DSOC 2, TYPE 1

   Show answer

   Answer: D

   Next question

9. Question 59 · 271 in bank

   Which of the following activities are part of the implementation phase of a cloud assurance program during a cloud migration?

   • ADevelopment of the monitoring goals and requirements
   • BIdentification of processes, functions, and systems
   • CIdentification of the relevant laws, regulations, and standards
   • DIdentification of roles and responsibilities

   Show answer

   Answer: B

   Next question

10. Question 60 · 271 in bank

    Which of the following would be considered as a factor to trust in a cloud service provider?

    • AThe level of exposure for public information
    • BThe level of proved technical skills
    • CThe level of willingness to cooperate
    • DThe level of open source evidence available

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 51. 271 questions available.