[Jun-2022] CCAK Dumps With 100% Verified Q&As – Pass Guarantee or Full Refund [Q34-Q57]

4/5 - (1 vote)

[Jun-2022] CCAK Dumps With 100% Verified Q&As – Pass Guarantee or Full Refund

Pass ISACA CCAK Exam With Practice Test Questions Dumps Bundle

NEW QUESTION 34
An organization is in the initial phases of cloud adoption. It is not very knowledgeable about cloud security and cloud shared responsibility models. Which of the following approaches is BEST suited for such an organization to evaluate its cloud security?

Use of an established standard/regulation to map controls and use as the audit criteria

For efficiency reasons, use of its on-premises systems’ audit criteria to audit the cloud environment

As this is the initial stage, the ISO/IEC 27001 certificate shared by the cloud service provider is sufficient for audit and compliance purposes.

Development of the cloud security audit criteria based on its own internal audit test plans to ensure appropriate coverage

NEW QUESTION 35
When performing audits in relation to Business Continuity Management and Operational Resilience strategy, what would be the MOST critical aspect to audit in relation to the strategy of the cloud customer that should be formulated jointly with the cloud service provider?

Validate if the strategy covers unavailability of all components required to operate the business-as-usual or in disrupted mode, in parts or total- when impacted by a disruption.

Validate if the strategy covers all aspects of Business Continuity and Resilience planning, taking inputs from the assessed impact and risks, to consider activities for before, during, and after a disruption.

Validate if the strategy covers all activities required to continue and recover prioritized activities within identified time frames and agreed capacity, aligned to the risk appetite of the organization including the invocation of continuity plans and crisis management capabilities.

Validate if the strategy is developed by both cloud service providers and cloud service consumers within the acceptable limits of their risk appetite.

NEW QUESTION 36
When establishing cloud governance, an organization should FIRST test by migrating:

all applications at once to the cloud.

complex applications to the cloud.

legacy applications to the cloud.

a few applications to the cloud.

NEW QUESTION 37
What factors should you understand about the data specifically due to legal, regulatory, and jurisdictional factors?

Thephysical location of the data and how it is accessed

The fragmentation and encryption algorithms employed

The language of the data and how it affects the user

The implications of storing complex information on simple storage systems

The actualsize of the data and the storage format

NEW QUESTION 38
Which of the following is MOST important to consider when an organization is building a compliance program for the cloud?

The rapidly changing service portfolio and architecture of the cloud.

Cloud providers should not be part of the compliance program.

The fairly static nature of the service portfolio and architecture of the cloud.

The cloud is similar to the on-premise environment in terms of compliance.

NEW QUESTION 39
How is encryption managed on multi-tenant storage?

Single key for all data owners

One key per data owner

Multiple keys per data owner

The answer could be A, B, or C depending on the provider

C for data subject to the EU Data Protection Directive; B for all others

NEW QUESTION 40
To identify key actors and requirements, which of the following MUST be considered when designing a cloud compliance program?

Cloud service provider, internal and external audit perspectives

Business/organizational, governance, cloud and risk perspectives

Enterprise risk management, data protection, privacy and legal perspectives

Key stakeholders, enterprise risk management, and Internal audit perspectives

NEW QUESTION 41
Policies and procedures shall be established, and supporting business processes and technical measures implemented, for maintenance of several items ensuring continuity and availability of operations and support personnel. Which of the following controls BEST matches this control description?

Operations Maintenance

System Development Maintenance

Equipment Maintenance

System Maintenance

NEW QUESTION 42
How does running applications on distinct virtual networks and only connecting networksas needed help?

It reduces hardware costs

It provides dynamic and granular policies with less management overhead

It locks down access and provides stronger data security

It reduces the blast radius of a compromised system

It enables you to configure applications around business groups

NEW QUESTION 43
Which of the following contract terms is necessary to meet a company’s requirement that needs to move data from one CSP to another?

Drag and Drop

Lift and shift

Flexibility to move

Transition and data portability

NEW QUESTION 44
An audit has identified that business units have purchased cloud-based applications without ITs support. What is the GREATEST risk associated with this situation?

The applications could be modified without advanced notice.

The application purchases did not follow procurement policy.

The applications are not included in business continuity plans (BCPs).

The applications may not reasonably protect data.

NEW QUESTION 45
When deploying an application that was created using the programming language and tools supported by the cloud provider, the MOST appropriate cloud computing model for an organization to adopt is:

Platform as a Service (PaaS).

Software as a Service (SaaS).

Infrastructure as a Service (laaS).

Identity as a Service (IDaaS).

NEW QUESTION 46
The BEST method to report continuous assessment of a cloud provider’s services to the CSA is through:

a set of dedicated application programming interfaces (APIs).

SOC 2 Type 2 attestation.

CCM assessment by a third-party auditor on a periodic basis.

tools selected by the third-party auditor.

NEW QUESTION 47
Which statement about compliance responsibilities and ownership of accountability is correct?

Organizations may be able to transfer their accountability for compliance with various regulatory requirements to their CSPs, but they retain the ownership of responsibility.

Organizations may be able to transfer their responsibility for compliance with various regulatory requirements to their CSPs, but they retain the ownership of accountability.

Organizations may transfer their responsibility and accountability for compliance with various regulatory requirements to their CSPs.

Organizations are not able to transfer their responsibility nor accountability for compliance with various regulatory requirements to their CSPs.

NEW QUESTION 48
SAST testing is performed by:

scanning the application source code.

scanning the application interface.

scanning all infrastructure components.

performing manual actions to gain control of the application.

NEW QUESTION 49
Which governance domain deals with evaluating how cloudcomputing affects compliance with internal security policies and various legal requirements, such as regulatory and legislative?

Legal Issues: Contracts and Electronic Discovery

Infrastructure Security

Compliance and Audit Management

Information Governance

Governance and Enterprise Risk Management

NEW QUESTION 50
To ensure that integration of security testing is implemented on large code sets in environments where time to completion is critical, what form of validation should an auditor expect?

Parallel testing

Full application stack unit testing

Regression testing

Functional verification

NEW QUESTION 51
Big data includes high volume, high variety, and high velocity.

False

True

NEW QUESTION 52
Which of thefollowing items is NOT an example of Security as a Service (SecaaS)?

Spam filtering

Authentication

Provisioning

Web filtering

Intrusion detection

NEW QUESTION 53
A CSP contracts for a penetration test to be conducted on its infrastructures. The auditor engages the target with no prior knowledge of its defenses, assets, or channels. The CSP’s security operation center is not notified in advance of the scope of the audit and the test vectors. Which mode is selected by the CSP?

Double gray box

Tandem

Reversal

Double blind

NEW QUESTION 54
Which of the following is the BEST control framework for a European manufacturing corporation that is migrating to the cloud?

NIST SP 800-53

CSA’s GDPR CoC

PCI-DSS

EU GDPR

NEW QUESTION 55
Which of the following key stakeholders should be identified the earliest when an organization is designing a cloud compliance program?

Cloud process owners

Internal control function

Legal functions

Cloud strategy owners

NEW QUESTION 56
After finding a vulnerability in an internet-facing server of an organization, a cybersecurity criminal is able to access an encrypted file system and successfully manages to overwrite part of some files with random data. In reference to the Top Threats Analysis methodology, how would you categorize the technical impact of this incident?

As an integrity breach

As control breach

As an availability breach

As a confidentiality breach

NEW QUESTION 57
Cloud Control Matrix (CCM) controls can be used by cloud customers to:

develop new security baselines for the industry.

define different control frameworks for different cloud service providers.

facilitate communication with their legal department.

build an operational cloud risk management program.

ISACA CCAK Exam Syllabus Topics:

Topic	Details
Topic 1	Continuous Assurance and Compliance Cloud Compliance Program
Topic 2	Evaluating a Cloud Compliance Program Cloud Auditing
Topic 3	A Threat Analysis Methodology for Cloud Using CCM Cloud Governance
Topic 4	CCM and CAIQ: Goals, Objectives, and Structure CCM: Auditing Controls