Certificate of Cloud Auditing Knowledge (CCAK) Free Practice Test

Question 1

Which objective is MOST appropriate to measure the effectiveness of password policy?

A. Attempts to log with weak credentials increases.

B. The number of related incidents decreases.

C. Newly created account credentials satisfy requirements.

D. The number of related incidents increases.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

Which of the following aspects of risk management involves identifying the potential reputational and financial harm when an incident occurs?

A. Mitigation

B. Impact analysis

C. Residual risk

D. Likelihood

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

Which of the following would be considered as a factor to trust in a cloud service provider?

A. The level of willingness to cooperate

B. The level of open source evidence available

C. The level of proven technical skills

D. The level of exposure for public information

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

Which of the following is the BEST control framework for a European manufacturing corporation that is migrating to the cloud?

A. NIST SP 800-53

B. CSA'sGDPRCoC

C. EUGDPR

D. PCI-DSS

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

To ensure integration of security testing is implemented on large code sets in environments where time to completion is critical, what form of validation should an auditor expect?

A. Parallel testing

B. Full application stack unit testing

C. Functional verification

D. Regression testing

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

The MOST important goal of regression testing is to ensure:

A. new releases do not impact previous stable features.

B. the system can be restored after a technical issue.

C. the expected outputs are provided by the new features.

D. the system can handle a high number of users.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

In cloud computing, which KEY subject area relies on measurement results and metrics?

A. Software as a Service (SaaS) application services

B. Platform as a Service (PaaS) development environment

C. Service level agreements (SLAs)

D. Infrastructure as a Service (IaaS) storage and network

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

Which of the following is the MOST relevant question in the cloud compliance program design phase?

A. Who owns the cloud strategy?

B. Who owns the cloud governance strategy?

C. Who owns the cloud services strategy?

D. Who owns the cloud portfolio strategy?

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 9

Which of the following is a direct benefit of mapping the Cloud Controls Matrix (CCM) to other international standards and regulations?

A. CCM mapping enables cloud service providers and customers alike to streamline their own compliance and security efforts.

B. CCM mapping entitles cloud service providers to be listed as an approved supplier for tenders and government contracts.

C. CCM mapping enables an uninterrupted data flow and in particular the export of personal data across different jurisdictions.

D. CCM mapping entitles cloud service providers to be certified under the CSA STAR program.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 10

What do cloud service providers offer to encourage clients to extend the cloud platform?

A. Reward programs

B. Application programming interfaces (APIs)

C. Cloud console

D. Access to the cloud infrastructure

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 11

Which of the following metrics are frequently immature?

A. Metrics around specific Software as a Service (SaaS) application services

B. Metrics around Platform as a Service (PaaS) development environments

C. Metrics around Infrastructure as a Service (laaS) computing environments

D. Metrics around Infrastructure as a Service (laaS) storage and network environments

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 12

To qualify for CSA STAR attestation for a particular cloud system, the SOC 2 report must cover:

A. all Cloud Controls Matrix (CCM) controls and TSPC security principles.

B. Cloud Controls Matrix (CCM) and ISO/IEC 27001:2013 controls.

C. maturity model criteria.

D. ISO/IEC 27001:2013 controls.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 13

A certification target helps in the formation of a continuous certification framework by incorporating:

A. CSA STAR level 2 attestation.

B. the scope description and security attributes to be tested.

C. the frequency of evaluating security attributes.

D. the service level objective (SLO) and service qualitative objective (SQO).

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 14

Controls mapping found in the Scope Applicability column of the Cloud Controls Matrix (CCM) may help organizations to realize cost savings:

A. by avoiding fines for breaching those regulations that impose a controls mapping in order to prove compliance

B. by implementing layered security, thus reducing the likelihood of data breaches and the associated costs.

C. by avoiding duplication of efforts in the compliance evaluation and for the eventual control design and implementation.

D. by avoiding the need to hire a cloud security specialist to perform the periodic risk assessment exercise.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

ISACA Certificate of Cloud Auditing Knowledge (CCAK) Free Practice Test