CCAK practice questions 71–80

1. Question 71 · 271 in bank

   Which plan will guide an organization on how to react to a security incident that might occur on the organization’s systems, or that might be affecting one of their service providers?

   • AIncident Response Plans
   • BSecurity Incident Plans
   • CUnexpected Event Plans
   • DEmergency Incident Plans

   Show answer

   Answer: A

   Next question

2. Question 72 · 271 in bank

   The rapid and dynamic rate of changes found in a cloud environment affects the organization’s:

   • Arisk profile.
   • Brisk appetite.
   • Crisk scoring.
   • Drisk communication.

   Show answer

   Answer: A

   Next question

3. Question 73 · 271 in bank

   Which of the following would be the MOST critical finding of an application security and DevOps audit?

   • AThe organization is not using a unified framework to integrate cloud compliance with regulatory requirements.
   • BApplication architecture and configurations did not consider security measures.
   • COutsourced cloud service interruption, breach or loss of data stored at the cloud service provider.
   • DCertifications with global security standards specific to cloud are not reviewed and the impact of noted findings are not assessed.

   Show answer

   Answer: B

   Next question

4. Question 74 · 271 in bank

   What should be an organization’s control audit schedule of a cloud service provider’s business continuity plan and operational resilience policy?

   • AAnnual
   • BQuarterly
   • CMonthly
   • DSemi-annual

   Show answer

   Answer: A

   Next question

5. Question 75 · 271 in bank

   An organization deploying the Cloud Control Matrix (CCM) to perform a compliance assessment will encompass the use of the “Corporate Governance Relevance” feature to filter out those controls:

   • Arelating to policies, processes, laws, regulations, and institutions conditioning the way an organization is managed, directed, or controlled.
   • Bthat can be either of a management or of a legal nature, therefore requiring an approval from the Change Advisory Board.
   • Cthat require the prior approval from the Board of Directors to be funded (for either make or buy), implemented, and reported on.
   • Dthat can be either of an administrative or of a technical nature, therefore requiring an approval from the Change Advisory Board.

   Show answer

   Answer: A

   Next question

6. Question 76 · 271 in bank

   Which of the following is the BEST way for a client to enforce a policy violation committed by a cloud service provider (CSP)?

   • AThe violation is agreed upon and documented.
   • BNothing can be done to enforce violations as this is a cloud service.
   • CThe violation is agreed to verbally by the CSP.
   • DViolations will be automatically enforced so no action is needed.

   Show answer

   Answer: A

   Next question

7. Question 77 · 271 in bank

   Which of the following is a corrective control that may be identified in a SaaS service provider?

   • ALog monitoring
   • BPenetration testing
   • CIncident response plans
   • DVulnerability scan

   Show answer

   Answer: C

   Next question

8. Question 78 · 271 in bank

   Which of the following configuration change controls is acceptable to a cloud auditor?

   • ADevelopment, test and production are hosted in the same network environment.
   • BProgrammers have permanent access to production software.
   • CThe Head of Development approves changes requested to production.
   • DProgrammers cannot make uncontrolled changes to the source code production version.

   Show answer

   Answer: D

   Next question

9. Question 79 · 271 in bank

   The BEST method to report continuous assessment of a cloud provider’s services to the CSA is through:

   • Aa set of dedicated application programming interfaces (APIs).
   • BSOC 2 Type 2 attestation.
   • CCCM assessment by a third-party auditor on a periodic basis.
   • Dtools selected by the third-party auditor.

   Show answer

   Answer: A

   Next question

10. Question 80 · 271 in bank

    In cloud computing, with whom does the responsibility and accountability for compliance lie?

    • AThe cloud service provider is responsible and accountable for compliance.
    • BThe cloud service provider is responsible for compliance, and the cloud service customer is accountable.
    • CThe cloud service customer is responsible and accountable for compliance.
    • DThe cloud service customer is responsible for compliance, and the cloud service provider is accountable.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 71. 271 questions available.