CCAK Practice Questions

Which of the following is an example of integrity technical impact?

What is a sign of an organization that has adopted a shift-left concept of code release cycles?

Cloud Control Matrix (CCM) controls can be used by cloud customers to:

Within an organization, which of the following functions should be responsible for defining the cloud adoption approach?

An independent contractor is assessing security maturity of a SaaS company against industry standards. The SaaS company has developed and hosted all their products using the cloud...

What areas should be reviewed when auditing a public cloud?

Which of the following key stakeholders should be identified the earliest when an organization is designing a cloud compliance program?

Which of the following CSP activities requires a client's approval?

A cloud service provider does not allow audits using automated tools as these tools could be considered destructive techniques for the cloud environment. Which of the following asp...

An organization has an ISMS implemented, following ISO 27001 and Annex A controls. The CIO would like to migrate some of the infrastructure to the cloud. Which of the following sta...

An organization is in the initial phases of cloud adoption. It is not very knowledgeable about cloud security and cloud shared responsibility models. Which of the following approac...

Which of the following controls framework should the cloud customer use to assess the overall security risk of a cloud provider?

Which of the following aspects of risk management involves identifying the potential reputational harm and/or financial harm when an incident occurs?

When using a SaaS solution, who is responsible for application security?

Which of the following would be the GREATEST governance challenge to an organization where production is hosted in a public cloud and backups are held on the premises?

What aspect of SaaS functionality and operations would the cloud customer be responsible for and should be audited?

The Open Certification Framework is structured on three levels of trust. Those three levels of trust are:

Which of the following is a fundamental concept of FedRAMP that intends to save costs, time, and staff conducting superfluous agency security assessments?

Which of the following is the risk associated with storing data in a cloud that crosses jurisdictions?

Since CCM allows cloud customers to build a detailed list of requirements and controls to be implemented by the CSP as part of their overall third-party risk management and procure...

During an audit it was identified that a critical application hosted in an off-premises cloud is not part of the organization's DRP (Disaster Recovery Plan). Management stated that...

Which of the following is the BEST recommendation to offer an organization's HR department planning to adopt a new public SaaS application to ease the recruiting process?

In which control should a cloud service provider, upon request, inform customers of compliance impact and risk, especially if customer data is used as part of the services?

What is the advantage of using dynamic application security testing (DAST) over static application security testing (SAST) methodology?

Which of the following contract terms is necessary to meet a company's requirement that needs to move data from one CSP to another?

Which of the following is a cloud-native solution designed to counter threats that do not exist within the enterprise?

The Cloud Octagon Model was developed to support organizations:

Which of the following BEST ensures adequate restriction on the number of people who can access the pipeline production environment?

A cloud customer configured and developed a solution on top of the certified cloud services. Building on top of a compliant CSP:

The rapid and dynamic rate of changes found in a cloud environment affects the organization's:

With regard to the Cloud Control Matrix (CCM), the `Architectural Relevance' is a feature that enables the filtering of security controls by:

To support customer's verification of the CSP claims regarding their responsibilities according to the shared responsibility model, which of the following tools and techniques is a...

Which of the following has the MOST substantial impact on how aggressive or conservative the cloud approach of an organization will be?

Which of the following would be a logical starting point for an auditor who has been engaged to assess the security of an organization's DevOps pipeline?

Which of the following are the three MAIN phases of the cloud controls matrix (CCM) mapping methodology?

A large organization with subsidiaries in multiple locations has a business requirement to organize IT systems to have identified resources reside in particular locations with orga...

Which of the following is the MOST feasible way to validate the performance of CSPs for the delivery of technology resources?

What data center and physical security measures should a cloud customer consider when assessing a cloud service provider?

Which of the following is the MOST important audit scope document when conducting a review of a cloud service provider?

When establishing cloud governance, an organization should FIRST test by migrating:

When reviewing a third-party agreement with a cloud service provider, which of the following should be the GREATEST concern regarding customer data privacy?

The BEST way to deliver continuous compliance in a cloud environment is to:

To identify key actors and requirements, which of the following MUST be considered when designing a cloud compliance program?

Which of the following standards is designed to be used by organizations for cloud services that intend to select controls within the process of implementing an Information Securit...

Which of the following is the common cause of misconfiguration in a cloud environment?

To ensure that integration of security testing is implemented on large code sets in environments where time to completion is critical, what form of validation should an auditor exp...

One of the Cloud Control Matrix's (CCM's) control specifications states that "Independent reviews and assessments shall be performed at least annually to ensure that the organizati...

In the context of Infrastructure as a Service (IaaS), a vulnerability assessment will scan virtual machines to identify vulnerabilities in:

When building a cloud governance model, which of the following requirements will focus more on the cloud service provider's evaluation and control checklist?

Prioritizing assurance activities for an organization's cloud services portfolio depends PRIMARILY on an organization's ability to: