CCAK practice questions 81–90

1. Question 81 · 271 in bank

   With regard to the Cloud Control Matrix (CCM), the ‘Architectural Relevance’ is a feature that enables the filtering of security controls by:

   • Arelevant architecture frameworks such as the NIST Enterprise Architecture Model, the Federal Enterprise Architecture Framework (FEAF), The Open Group Architecture Framework (TOGAF), and the Zachman Framework for Enterprise Architecture.
   • Brelevant delivery models such as Software as a Service, Platform as a Service, Infrastructure as a Service.
   • Crelevant architectural paradigms such as Client-Server, Mainframe, Peer-to-Peer, and SmartClient-Backend.
   • Drelevant architectural components such as Physical, Network, Compute, Storage, Application, and Data.

   Show answer

   Answer: D

   Next question

2. Question 82 · 271 in bank

   To support customer’s verification of the CSP claims regarding their responsibilities according to the shared responsibility model, which of the following tools and techniques is appropriate?

   • AContractual agreement
   • BInternal audit
   • CExternal audit
   • DSecurity assessment

   Show answer

   Answer: D

   Next question

3. Question 83 · 271 in bank

   Which of the following has the MOST substantial impact on how aggressive or conservative the cloud approach of an organization will be?

   • AInternal policies and technical standards
   • BRisk scoring criteria
   • CApplicable laws and regulations
   • DRisk appetite and budget constraints

   Show answer

   Answer: D

   Next question

4. Question 84 · 271 in bank

   Which of the following would be a logical starting point for an auditor who has been engaged to assess the security of an organization’s DevOps pipeline?

   • AVerify the inclusion of security gates in the pipeline.
   • BConduct an architectural assessment.
   • CReview the CI/CD pipeline audit logs.
   • DVerify separation of development and production pipelines.

   Show answer

   Answer: B

   Next question

5. Question 85 · 271 in bank

   Which of the following are the three MAIN phases of the cloud controls matrix (CCM) mapping methodology?

   • APlan --> Develop --> Release
   • BDeploy --> Monitor --> Audit
   • CInitiation --> Execution --> Monitoring and Controlling
   • DPreparation --> Execution --> Peer Review and Publication

   Show answer

   Answer: D

   Next question

6. Question 86 · 271 in bank

   A large organization with subsidiaries in multiple locations has a business requirement to organize IT systems to have identified resources reside in particular locations with organizational personnel. Which access control method will allow IT personnel to be segregated across the various locations?

   • ARole Based Access Control
   • BAttribute Based Access Control
   • CPolicy Based Access Control
   • DRule Based Access Control

   Show answer

   Answer: B

   Next question

7. Question 87 · 271 in bank

   What data center and physical security measures should a cloud customer consider when assessing a cloud service provider?

   • AAssess use of monitoring systems to control ingress and egress points of entry to the data center.
   • BImplement physical security perimeters to safeguard personnel, data and information systems.
   • CConduct a due diligence to verify the cloud provider applies adequate physical security measures.
   • DReview internal policies and procedures for relocation of hardware and software to an offsite location.

   Show answer

   Answer: C

   Next question

8. Question 88 · 271 in bank

   Which of the following is the MOST feasible way to validate the performance of CSPs for the delivery of technology resources?

   • ACloud compliance program
   • BLegacy IT compliance program
   • CInternal audit program
   • DService organization controls report

   Show answer

   Answer: A

   Next question

9. Question 89 · 271 in bank

   Which of the following is the MOST important audit scope document when conducting a review of a cloud service provider?

   • AUpdated audit/work program
   • BDocumentation criteria for the audit evidence
   • CProcesses and systems to be audited
   • DTesting procedure to be performed

   Show answer

   Answer: C

   Next question

10. Question 90 · 271 in bank

    When establishing cloud governance, an organization should FIRST test by migrating:

    • Aall applications at once to the cloud.
    • Bcomplex applications to the cloud.
    • Clegacy applications to the cloud.
    • Da few applications to the cloud.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCAK practice, question 81. 271 questions available.