CCAK by ISACA Actual Free Exam Questions And Answers

Question 1

Which of the following cloud service provider activities MUST obtain a client's approval?

A. Deleting guest accounts

B. Deleting test accounts

C. Deleting subscription owner accounts

D. Destroying test data

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 2

A large healthcare provider within the United States is seeking a cloud service provider offering Software as a Service (SaaS) for core business systems. The selected provider MUST comply with which of the following regulations?

A. FISMA

B. HIPAA

C. GLBA

D. GDPR

Discussion 0

Correct Answer: B Vote an answer

Question 3

A cloud service customer is looking to subscribe to a finance solution provided by a cloud service provider. The provider has clarified that the audit logs cannot be taken out of the cloud environment by the customer to its security information and event management (SIEM) solution for monitoring purposes. Which of the following should be the GREATEST concern to the auditor?

A. The audit trails are backed up regularly, but the backup is not encrypted.

B. The provider does not maintain audit logs in their environment.

C. The customer cannot monitor its cloud subscription on its own and must rely on the provider for monitoring purposes.

D. The audit logs are overwritten every 30 days, and all past audit trail is lost.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 4

Which of the following standards is designed to be used by organizations for cloud services that intend to select controls within the process of implementing an information security management system based on ISO/IEC 27001?

A. Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)

B. NIST SP 800-146

C. ISO/IEC 27017:2015

D. ISO/IEC 27002

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 5

The MAIN limitation of relying on traditional cloud compliance assurance approaches such as SOC2 attestations is that:

A. they place responsibility for demonstrating compliance on the vendor organization.

B. they can only be performed by skilled cloud audit service providers.

C. they are subject to change when the regulatory climate changes.

D. they provide a point-in-time snapshot of an organization's compliance posture.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 6

In a multi-level supply chain structure where cloud service provider A relies on other sub cloud services, the provider should ensure that any compliance requirements relevant to the provider are:

A. treated as sensitive information and withheld from certain sub cloud service providers.

B. treated as confidential information and withheld from all sub cloud service providers.

C. passed to the sub cloud service providers based on the sub cloud service providers' geographic location.

D. passed to the sub cloud service providers.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 7

Which of the following methods can be used by a cloud service provider with a cloud customer that does not want to share security and control information?

A. Nondisclosure agreements (NDAs)

B. Independent auditor report

C. Industry certifications

D. First-party audit

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 8

Which of the following is the MOST important audit scope document when conducting a review of a cloud service provider?

A. Documentation criteria for the audit evidence

B. Updated audit work program

C. Testing procedure to be performed

D. Processes and systems to be audited

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 9

To ensure that compliance obligations for data residency in the cloud are aligned with an organization's risk appetite, which of the following activities is MOST important to perform?

A. Manage compliance obligations through a structured risk management process.

B. Perform a cloud vendor assessment every time there is a change to data flows.

C. Communicate the organization's risk appetite across cloud service providers.

D. Develop risk metrics to show how the organization is meeting the obligations.

Discussion 0

Correct Answer: A Vote an answer

Question 10

What do cloud service providers offer to encourage clients to extend the cloud platform?

A. Cloud console

B. Reward programs

C. Access to the cloud infrastructure

D. Application programming interfaces (APIs)

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 11

Which of the following is an example of a corrective control?

A. Privileged access to critical information systems requiring a second factor of authentication using a soft token

B. A central antivirus system installing the latest signature files before allowing a connection to the network

C. All new employees having standard access rights until their manager approves privileged rights

D. Unsuccessful access attempts being automatically logged for investigation

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

ISACA Certificate of Cloud Auditing Knowledge - CCAK Exam Practice Test

Contact Us

Useful Links

Latest Updated