File Info
| Exam | Certificate of Cloud Auditing Knowledge |
| Number | CCAK |
| File Name | ISACA.CCAK.VCEplus.2024-08-31.82q.tqb |
| Size | 6 MB |
| Posted | Aug 31, 2024 |
| Download | ISACA.CCAK.VCEplus.2024-08-31.82q.tqb |
How to open VCEX & EXAM Files?
Files with VCEX & EXAM extensions can be opened by ProfExam Simulator.
Coupon: MASTEREXAM
With discount: 20%
Demo Questions
Question 1
Which of the following is a fundamental concept of FedRAMP that intends to save costs, time, and staff conducting superfluous agency security assessments?
- Use often, provide many times
- Be economical, act deliberately
- Use existing, provide many times
- Do once, use many times
Correct answer: D
Explanation:
Reference: https://www.fedramp.gov/assets/resources/documents/FedRAMP_Security_Assessment_Framework.pdf (2) Reference: https://www.fedramp.gov/assets/resources/documents/FedRAMP_Security_Assessment_Framework.pdf (2)
Question 2
In all three cloud deployment models, (IaaS, PaaS, and SaaS), who is responsible for the patching of the hypervisor layer?
- Cloud service customer
- Shared responsibility
- Cloud service provider
- Patching on hypervisor layer is not required
Correct answer: A
Question 3
In an organization, how are policy violations MOST likely to occur?
- By accident
- Deliberately by the ISP
- Deliberately
- Deliberately by the cloud provider
Correct answer: A
Question 4
What is a sign of an organization that has adopted a shift-left concept of code release cycles?
- A waterfall model to move resources through the development to release phases
- Incorporation of automation to identify and address software code problems early
- Maturity of start-up entities with high-iteration to low-volume code commits
- Large entities with slower release cadences and geographical dispersed systems
Correct answer: B
Explanation:
Reference: https://www.ibm.com/cloud/learn/devsecops Reference: https://www.ibm.com/cloud/learn/devsecops
Question 5
An organization that is utilizing a community cloud is contracting an auditor to conduct a review on behalf of the group of organizations within the cloud community. From the following, to whom should the auditor report the findings?
- Public
- Management of organization being audited
- Shareholders/interested parties
- Cloud service provider
Correct answer: D
Question 6
After finding a vulnerability in an internet-facing server of an organization, a cybersecurity criminal is able to access an encrypted file system and successfully manages to overwrite part of some files with random data. In reference to the Top Threats Analysis methodology, how would you categorize the technical impact of this incident?
- As an integrity breach
- As control breach
- As an availability breach
- As a confidentiality breach
Correct answer: B
Question 7
Which of the following configuration change controls is acceptable to a cloud auditor?
- Development, test and production are hosted in the same network environment.
- Programmers have permanent access to production software.
- The Head of Development approves changes requested to production.
- Programmers cannot make uncontrolled changes to the source code production version.
Correct answer: D
Question 8
Which best describes the difference between a type 1 and a type 2 SOC report?
- A type 2 SOC report validates the operating effectiveness of controls whereas a type 1 SOC report validates the suitability of the design of the controls.
- A type 2 SOC report validates the suitability of the design of the controls whereas a type 1 SOC report validates the operating effectiveness of controls.
- A type 1 SOC report provides an attestation whereas a type 2 SOC report offers a certification.
- There is no difference between a type 2 and type 1 SOC report.
Correct answer: C
Explanation:
Reference: https://www.accountingtools.com/articles/2019/8/30/the-difference-between-soc-type-1-and-type-2-reports Reference: https://www.accountingtools.com/articles/2019/8/30/the-difference-between-soc-type-1-and-type-2-reports
Question 9
To ensure that cloud audit resources deliver the best value to the organization, the PRIMARY step would be to:
- develop a cloud audit plan on the basis of a detailed risk assessment.
- schedule the audits and monitor the time spent on each audit.
- train the cloud audit staff on current technology used in the organization.
- monitor progress of audits and initiate cost control measures.
Correct answer: A
Explanation:
It delivers value to the organization are the resources and efforts being dedicated to, and focused on, the higher-risk areas. It delivers value to the organization are the resources and efforts being dedicated to, and focused on, the higher-risk areas.
Question 10
The BEST way to deliver continuous compliance in a cloud environment is to:
- decrease the interval between attestations of compliance.
- combine point-in-time assurance approaches with continuous monitoring.
- increase the frequency of external audits from annual to quarterly.
- combine point-in-time assurance approaches with continuous auditing.
Correct answer: B
