New 2022 Realistic CCAK Dumps Test Engine Exam Questions in here [Q53-Q73] – IT Certification Exam Questions & Answers

Rate this post

New 2022 Realistic CCAK Dumps Test Engine Exam Questions in here

Updated Official licence for CCAK Certified by CCAK Dumps PDF

Topics covered by Isaca CCAK Exam

Addresses unique challenges such as technology stacks, deployment frameworks, DevOps, CI/CD, etc.
Leverages ISACA’s traditional audit expertise and CSA’s cloud expertise.
Complements ISACA’s ANSI accredited certifications such as CISA, CISM, CRISC and CGEIT.
Builds off of and complements the material covered in the CSA Certificate of Cloud Security Knowledge (CCSK).
Complements FedRAMP 3PAO Assessor, PCI-DSS Qualified Security Assessor, ISO 27001 Leader Auditor credentials.

QUESTION 53
Prioritizing assurance activities for an organization’s cloud services portfolio depends PRIMARILY on an organization’s ability to:

schedule frequent reviews with high-risk cloud service providers.

develop plans using a standardized risk-based approach.

maintain a comprehensive cloud service inventory.

collate views from various business functions using cloud services.

QUESTION 54
Which of the following is the GREATEST security risk associated with data migration from a legacy human resources (HR) system to a cloud-based system”

Data from the source and target system may be intercepted

Records past their retention period may not be migrated to the new system

System performance may be impacted by the migration

Data from the source and target system may have different data formats

QUESTION 55
Which of the following is a corrective control that may be identified in a SaaS service provider?

Log monitoring

Penetration testing

Incident response plans

Vulnerability scan

QUESTION 56
What data center and physical security measures should a cloud customer consider when assessing a cloud service provider?

Assess use of monitoring systems to control ingress and egress points of entry to the data center.

Implement physical security perimeters to safeguard personnel, data and information systems.

Conduct a due diligence to verify the cloud provider applies adequate physical security measures.

Review internal policies and procedures for relocation of hardware and software to an offsite location.

QUESTION 57
Which of the following is the BEST control framework for a European manufacturing corporation that is migrating to the cloud?

NIST SP 800-53

CSA’s GDPR CoC

PCI-DSS

EU GDPR

QUESTION 58
Which best describes the difference between a type 1 and a type 2 SOC report?

A type 2 SOC report validates the operating effectiveness of controls whereas a type 1 SOC report validates the suitability of the design of the controls.

A type 2 SOC report validates the suitability of the design of the controls whereas a type 1 SOC report validates the operating effectiveness of controls.

A type 1 SOC report provides an attestation whereas a type 2 SOC report offers a certification.

There is no difference between a type 2 and type 1 SOC report.

QUESTION 59
Network logs from cloud providers are typically flow records, not full packet captures.

False

True

QUESTION 60
What should be the auditor’s PRIMARY objective while examining a cloud service provider’s (CSP’s) SLA?

Verifying whether commensurate compensation in the form of service credits is factored in if the CSC is unable to match its SLA obligations

Verifying whether the SLA includes all the operational matters which are material to the operation of the service

Verifying whether the SLA caters to the availability requirements of the cloud service customer (CSC)

Verifying whether the SLAs are well-defined and measurable

QUESTION 61
Big data includes high volume, high variety, and high velocity.

False

True

QUESTION 62
Which of the following data destruction methods is the MOST effective and efficient?

Crypto-shredding

Degaussing

Multi-pass wipes

Physical destruction

QUESTION 63
What is true of searching data across cloud environments?

You might not have the ability oradministrative rights to search or access all hosted data.

The cloud provider must conduct the search with the full administrative controls.

All cloud-hosted email accounts are easily searchable.

Search and discovery time is alwaysfactored into a contract between the consumer and provider.

You can easily search across your environment using any E-Discovery tool.

QUESTION 64
What is the newer application development methodology and philosophy focused on automation of application development and deployment?

Agile

BusOps

DevOps

SecDevOps

Scrum

QUESTION 65
The MAIN difference between Cloud Control Matrix (CCM) and Consensus Assessment Initiative Questionnaire (CAIQ) is that:

CCM assesses the presence of controls, whereas CAIQ assesses overall security of a service.

CCM has a set of security questions, whereas CAIQ has a set of security controls.

CCM has 14 domains and CAIQ has 16 domains.

CCM provides a controls framework, whereas CAIQ provides industry-accepted ways to document which security controls exist in IaaS, PaaS, and SaaS offerings.

QUESTION 66
Which of the following should be of GREATEST concern to an IS auditor reviewing actions taken during a forensic investigation?

The investigation report does not indicate a conclusion.

An image copy of the attacked system was not taken.

The proper authorities were not notified.

The handling procedures of the attacked system are not documented.

QUESTION 67
A CSP providing cloud services currently being used by the United States federal government should obtain which of the following to assure compliance to stringent government standards?

Multi-Tier Cloud Security (MTCS) Attestation

FedRAMP Authorization

ISO/IEC 27001:2013 Certification

CSA STAR Level Certificate

QUESTION 68
In an organization, how are policy violations MOST likely to occur?

By accident

Deliberately by the ISP

Deliberately

Deliberately by the cloud provider

QUESTION 69
When applying the Top Threats Analysis methodology following an incident, what is the scope of the technical impact identification step?

Determine the impact on the controls that were selected by the organization to respond to identified risks.

Determine the impact on confidentiality, integrity and availability of the information system.

Determine the impact on the financial, operational, compliance and reputation of the organization.

Determine the impact on the physical and environmental security of the organization, excluding informational assets.

QUESTION 70
An IS auditor is a member of an application development team that is selecting software. Which of the following would impair the auditor’s independence?

Approving the vendor selection methodology

verifying the weighting of each selection criteria

Reviewing the request for proposal (RFP)

Witnessing the vendor selection process

QUESTION 71
When using a SaaS solution, who is responsible for application security?

The cloud service provider only

The cloud service consumer only

Both cloud consumer and the enterprise

Both cloud provider and the consumer

Reference:
%20applications

QUESTION 72
An IS department is evaluated monthly on its cost-revenue ratio user satisfaction rate, and computer downtime This is BEST zed as an application of.

control self-assessment (CSA)

balanced scorecard

value chain analysis

risk framework

QUESTION 73
Due to cloud audit team resource constraints, an audit plan as initially approved cannot be completed.
Assuming that the situation is communicated in the cloud audit report which course of action is MOST relevant?

Focusing on auditing high-risk areas

Testing the adequacy of cloud controls design

Relying on management testing of cloud controls

Testing the operational effectiveness of cloud controls

Loading …