Free ISACA CCAK Practice Exams - Page 8 of 10

Question #71

Which of the following is a cloud-specific security standard?

A . 15027017
B . 15014001
C . 15022301
D . 15027701

Question #72

An independent contractor is assessing the security maturity of a Software as a Service (SaaS) company against industry standards. The SaaS company has developed and hosted all its products using the cloud services provided by a third-party cloud service provider.

What is the optimal and most efficient mechanism to assess the controls provider is responsible for?

A . Review the provider’s published questionnaires.
B . Review third-party audit reports.
C . Directly audit the provider.
D . Send a supplier questionnaire to the provider.

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

The optimal and most efficient mechanism to assess the controls that the provider is responsible for is to review third-party audit reports. Third-party audit reports are independent and objective assessments of the provider’s security, compliance, and performance, conducted by qualified and reputable auditors. Third-party audit reports can provide assurance and evidence that the provider meets the industry standards and best practices, as well as the contractual and legal obligations with the SaaS company. Third-party audit reports can also cover a wide range of controls, such as data security, encryption, identity and access management, incident response, disaster recovery, and service level agreements. Some examples of third-party audit reports are ISO 27001 certification, SOC 1/2/3 reports, CSA STAR certification, and FedRAMP authorization123.

Reviewing the provider’s published questionnaires (A) may not be optimal or efficient, as the published questionnaires may not be comprehensive or up-to-date, and may not reflect the actual state of the provider’s controls. The published questionnaires may also be biased or inaccurate, as they are produced by the provider themselves.

Directly auditing the provider © may not be feasible or necessary, as the independent contractor may not have access to the provider’s environment or data, and may not have the authority or expertise to conduct such an audit. The independent contractor should rely on the third-party audit reports and certifications to assess the provider’s compliance with relevant standards and

regulations.

Sending a supplier questionnaire to the provider (D) may not be optimal or efficient, as the supplier questionnaire may not cover all the aspects of the provider’s controls, and may not provide sufficient evidence or assurance of the provider’s security maturity. The supplier questionnaire may also take a long time to complete and verify, and may not be consistent with the industry standards and best practices.

Reference: =

How to Evaluate Cloud Service Provider Security (Checklist) Cloud service review process – Cloud Adoption Framework How to choose a cloud service provider | Microsoft Azure

Question #73

An auditor is reviewing an organization’s virtual machines (VMs) hosted in the cloud. The organization utilizes a configuration management (CM) tool to enforce password policies on its VMs.

Which of the following is the BEST approach for the auditor to use to review the operating effectiveness of the password requirement?

A . The auditor should not rely on the CM tool and its settings, and for thoroughness should review the password configuration on the set of sample VMs.
B . Review the relevant configuration settings on the CM tool and check whether the CM tool agents are operating effectively on the sample VMs.
C . As it is an automated environment, reviewing the relevant configuration settings on the CM tool would be sufficient.
D . Review the incident records for any incidents relating to brute force attacks or password compromise in the last 12 months and investigate whether the root cause of the incidents was due to in appropriate password policy configured on the VMs.

Reveal Solution Hide Solution

Question #74

An auditor is auditing the services provided by a cloud service provider.

When evaluating the security of the cloud customer’s data in the cloud, which of the following should be of GREATEST concern to the auditor?

A . Personally identifiable information (Pll) is pseudonymized but not fully encrypted.
B . The cloud customer has encrypted the confidential data in the cloud using its own encryption keys.
C . The confidential data stored in the cloud is encrypted using encryption keys that are managed by the provider.
D . According to the cloud customer’s data handling policy, all confidential data should be encrypted, but the confidential data stored in the cloud is well segmented but not encrypted.

Reveal Solution Hide Solution

Question #75

For an auditor auditing an organization’s cloud resources, which of the following should be of GREATEST concern?

A . The organization does not have separate policies for governing its cloud environment.
B . The organization’s IT team does not include resources with cloud certifications.
C . The organization does not perform periodic reviews or control monitoring for its cloud environment, but it has a documented audit plan and performs an audit for its cloud environment every alternate year.
D . The risk management team reports to the head of audit.

Reveal Solution Hide Solution

Question #76

What areas should be reviewed when auditing a public cloud?

A . Patching and configuration
B . Vulnerability management and cyber security reviews
C . Identity and access management (IAM) and data protection
D . Source code reviews and hypervisor

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

Identity and access management (IAM) and data protection are the areas that should be reviewed when auditing a public cloud, as they are the key aspects of cloud security and compliance that affect both the cloud service provider and the cloud service customer. IAM and data protection refer to the methods and techniques that ensure the confidentiality, integrity, and availability of data and resources in the cloud environment. IAM involves the use of credentials, policies, roles, permissions, and tokens to verify the identity and access rights of users or devices. Data protection involves the use of encryption, backup, recovery, deletion, and retention to protect data from unauthorized access, modification, loss, or disclosure123.

Patching and configuration (A) are not the areas that should be reviewed when auditing a public cloud, as they are not the key aspects of cloud security and compliance that affect both the cloud service provider and the cloud service customer. Patching and configuration refer to the processes and practices that ensure the security, reliability, and performance of the cloud infrastructure, platform, or software. Patching involves the use of updates or fixes to address vulnerabilities, bugs, errors, or exploits that may compromise or affect the functionality of the cloud components. Configuration involves the use of settings or parameters to customize or optimize the functionality of the cloud components. Patching and configuration are mainly under the responsibility of the cloud service provider, as they own and operate the cloud infrastructure, platform, or software. The cloud service customer has limited or no access or control over these aspects123.

Vulnerability management and cyber security reviews (B) are not the areas that should be reviewed

when auditing a public cloud, as they are not specific or measurable aspects of cloud security and compliance that can be easily audited or tested. Vulnerability management and cyber security reviews refer to the processes and practices that identify, assess, treat, monitor, and report on the risks that affect the security posture of an organization or a domain. Vulnerability management involves the use of tools or techniques to scan, analyze, prioritize, remediate, or mitigate vulnerabilities that may expose an organization or a domain to threats or attacks. Cyber security reviews involve the use of tools or techniques to evaluate, measure, benchmark, or improve the security capabilities or maturity of an organization or a domain. Vulnerability management and cyber security reviews are general or broad terms that encompass various aspects of cloud security and compliance, such as IAM, data protection, patching, configuration, etc. Therefore, they are not specific or measurable areas that can be audited or tested individually123.

Source code reviews and hypervisor (D) are not the areas that should be reviewed when auditing a public cloud, as they are not relevant or accessible aspects of cloud security and compliance for most cloud service customers. Source code reviews refer to the processes and practices that examine the source code of software applications or systems to identify errors, bugs, vulnerabilities, or inefficiencies that may affect their quality, functionality, or security. Hypervisor refers to the software that allows the creation and management of virtual machines on a physical server. Source code reviews and hypervisor are mainly under the responsibility of the cloud service provider, as they own and operate the software applications or systems that deliver cloud services. The cloud service customer has no access or control over these aspects123.

Reference: = Cloud Audits: A Guide for Cloud Service Providers – Cloud Standards …

Cloud Audits: A Guide for Cloud Service Customers – Cloud Standards …

Cloud Auditing Knowledge: Preparing for the CCAK Certificate Exam

Question #77

Which of the following is a tool that visually depicts the gaps in an organization’s security capabilities?

A . Cloud security alliance (CSA) cloud control matrix
B . Requirements traceability matrix
C . Cloud security alliance (CSA) enterprise architecture (EA)
D . Colored impact and likelihood risk matrix

Reveal Solution Hide Solution

Question #78

"Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, ports, and by compensating controls."

Which of the following types of controls BEST matches this control description?

A . Virtual instance and OS hardening
B . Network security
C . Network vulnerability management
D . Change detection

Reveal Solution Hide Solution

Question #79

Application programming interfaces (APIs) are likely to be attacked continuously by bad actors because they:

A . are the asset with private IP addresses.
B . are generally the most exposed part.
C . could be poorly designed.
D . act as a very effective backdoor.

Reveal Solution Hide Solution

Question #80

The PRIMARY objective for an auditor to understand the organization’s context for a cloud audit is to:

A . determine whether the organization has carried out control self-assessment (CSA) and validated audit reports of the cloud service providers.
B . validate an understanding of the organization’s current state and how the cloud audit plan fits into the existing audit approach.
C . validate the organization’s performance effectiveness utilizing cloud service provider solutions.
D . validate whether an organization has a cloud audit plan in place.

Reveal Solution Hide Solution