CCAK Practice Questions

If the degree of verification for information shared with the auditor during an audit is low, the auditor should:

Which best describes the difference between a type 1 and a type 2 SOC report?

You have been assigned the implementation of an ISMS, whose scope must cover both on premise and cloud infrastructure. Which of the following is your BEST option?

As a developer building codes into a container in a DevSecOps environment, which of the following is the appropriate place(s) to perform security tests?

An organization that is utilizing a community cloud is contracting an auditor to conduct a review on behalf of the group of organizations within the cloud community. From the follo...

Which of the following parties should have accountability for cloud compliance requirements?

Which of the following data destruction methods is the MOST effective and efficient?

Under GDPR, an organization should report a data breach within what time frame?

Which of the following cloud models prohibits penetration testing?

What type of termination occurs at the initiative of one party, and without the fault of the other party?

Which of the following would give an auditor the BEST view of design and implementation decisions when an organization uses programmatic automation for Infrastructure as a Service...

An auditor is performing an audit on behalf of a cloud customer. For assessing security awareness, the auditor should:

The Cloud Computing Compliance Controls Catalogue (C5) framework is maintained by which of the following agencies?

Which statement about compliance responsibilities and ownership of accountability is correct?

Which objective is MOST appropriate to measure the effectiveness of password policy?

A Dot Release of Cloud Control Matrix (CCM) indicates what?

What should be the auditor's PRIMARY objective while examining a cloud service provider's (CSP's) SLA?

Which of the following is an example of a corrective control?

Which of the following is a cloud-specific security standard?

The PRIMARY objective for an auditor to understand the organization's context for a cloud audit is to:

Which of the following defines the criteria designed by the American Institute of Certified Public Accountants (AICPA) to specify trusted services?

Which of the following is the BEST control framework for a European manufacturing corporation that is migrating to the cloud?

Account design in the cloud should be driven by:

Organizations maintain mappings between the different control frameworks they adopt to:

A CSP providing cloud services currently being used by the United States federal government should obtain which of the following to assure compliance to stringent government standa...

Which plan will guide an organization on how to react to a security incident that might occur on the organization's systems, or that might be affecting one of their service provide...

Which of the following would be the MOST critical finding of an application security and DevOps audit?

What should be an organization's control audit schedule of a cloud service provider's business continuity plan and operational resilience policy?

An organization deploying the Cloud Control Matrix (CCM) to perform a compliance assessment will encompass the use of the "Corporate Governance Relevance" feature to filter out tho...

Which of the following is the BEST way for a client to enforce a policy violation committed by a cloud service provider (CSP)?

Which of the following is a corrective control that may be identified in a SaaS service provider?

Which of the following configuration change controls is acceptable to a cloud auditor?

In cloud computing, with whom does the responsibility and accountability for compliance lie?

The BEST method to report continuous assessment of a cloud provider's services to the CSA is through:

SAST testing is performed by:

When a client's business process changes, the CSP SLA should:

The PRIMARY objective of an audit initiation meeting with a cloud audit client is to:

Policies and procedures shall be established, and supporting business processes and technical measures implemented, for maintenance of several items ensuring continuity and availab...

An auditor identifies that a CSP received multiple customer inquiries and RFPs during the last month. Which of the following should be the BEST recommendation to reduce the CSP bur...

Which of the following approaches encompasses social engineering of staff, bypassing of physical access controls and penetration testing?

When applying the Top Threats Analysis methodology following an incident, what is the scope of the technical impact identification step?

When performing audits in relation to Business Continuity Management and Operational Resilience strategy, what would be the MOST critical aspect to audit in relation to the strateg...

Which of the following metrics are frequently immature?

The MAIN difference between Cloud Control Matrix (CCM) and Consensus Assessment Initiative Questionnaire (CAIQ) is that:

The MOST critical concept of managing the build and test of code in DevOps is:

Which of the following is a direct benefit of mapping the Cloud Control Matrix (CCM) to other international standards and regulations?

The criteria for limiting services allowing non-critical services or services requiring high availability and resilience to be moved to the cloud is an important consideration to b...

Which of the following should be the FIRST step to establish a cloud assurance program during a cloud migration?

Customer management interface, if compromised over public internet, can lead to:

To assist an organization with planning a cloud migration strategy to execution, an auditor should recommend the use of: