[Jan-2023 Newly Released] CCAK Dumps for Cloud Security Alliance Certified [Q37-Q51]

4/5 - (2 votes)

[Jan-2023 Newly Released] CCAK Dumps for Cloud Security Alliance Certified

Updated Verified CCAK dumps Q&As – 100% Pass

ISACA CCAK Exam Syllabus Topics:

Topic	Details
Topic 1	Continuous Assurance and Compliance Cloud Compliance Program
Topic 2	CCM and CAIQ: Goals, Objectives, and Structure CCM: Auditing Controls
Topic 3	Evaluating a Cloud Compliance Program Cloud Auditing
Topic 4	A Threat Analysis Methodology for Cloud Using CCM Cloud Governance

NEW QUESTION 37
While performing the audit, the auditor found that an object storage bucket containing PII could be accessed by anyone on the Internet. Given this discovery, what should be the most appropriate action for the auditor to perform?

Highlighting the gap to the audit sponsor at the sponsor’s earliest possible availability

Asking the organization’s cloud administrator to immediately close the gap by updating the configuration settings and making the object storage bucket private and hence inaccessible from the Internet

Documenting the finding in the audit report and sharing the gap with the relevant stakeholders

Informing the organization’s internal audit manager immediately about the gap

NEW QUESTION 38
Which of the following is NOT normally a method for detecting and preventing data migration into the cloud?

Intrusion Prevention System

URL filters

Data Loss Prevention

Cloud Access and Security Brokers (CASB)

Database Activity Monitoring

NEW QUESTION 39
The PRIMARY objective for an auditor to understand the organization’s context for a cloud audit is to:

determine whether the organization has carried out control self-assessment and validated audit reports of the cloud service providers (CSP).

validate an understanding of the organization’s current state and how the cloud audit plan fits into the existing audit approach.

validate whether an organization has a cloud audit plan in place.

validate the organization’s performance effectiveness utilizing cloud service providers (CSP) solutions.

NEW QUESTION 40
How is encryption managed on multi-tenant storage?

Single key for all data owners

One key per data owner

Multiple keys per data owner

The answer could be A, B, or C depending on the provider

C for data subject to the EU Data Protection Directive; B for all others

NEW QUESTION 41
ENISA: A reason for risk concerns of a cloud provider being acquired is:

Arbitrary contract termination by acquiring company

Resource isolation may fail

Provider may change physical location

Mass layoffs may occur

Non-binding agreements put at risk

NEW QUESTION 42
When deploying an application that was created using the programming language and tools supported by the cloud provider, the MOST appropriate cloud computing model for an organization to adopt is:

Platform as a Service (PaaS).

Software as a Service (SaaS).

Infrastructure as a Service (laaS).

Identity as a Service (IDaaS).

NEW QUESTION 43
CCM: In the CCM tool, “Encryption and Key Management” is an example of which of the following?

Risk Impact

Domain

Control Specification

NEW QUESTION 44
Changes to which of the following will MOST likely influence the expansion or reduction of controls required to remediate the risk arising from changes to an organization’s SaaS vendor?

Risk exceptions policy

Contractual requirements

Risk appetite

Board oversight

NEW QUESTION 45
What should be the auditor’s PRIMARY objective while examining a cloud service provider’s (CSP’s) SLA?

Verifying whether commensurate compensation in the form of service credits is factored in if the CSC is unable to match its SLA obligations

Verifying whether the SLA includes all the operational matters which are material to the operation of the service

Verifying whether the SLA caters to the availability requirements of the cloud service customer (CSC)

Verifying whether the SLAs are well-defined and measurable

NEW QUESTION 46
Segregation of duties would be compromised if:

application programmers moved programs into production.

application programmers accessed test data.

database administrators (DBAs) modified the structure of user tables.

operations staff modified batch schedules.

NEW QUESTION 47
Which of the following cloud deployment models would BEST meet the needs of a startup software development organization with limited initial capital?

Community

Public

Hybrid

Private

NEW QUESTION 48
Which of the following is MOST important to consider when developing an effective threat model during the introduction of a new SaaS service into a customer organization’s architecture? The threat model:

recognizes the shared responsibility for risk management between the customer and the CSP.

leverages SaaS threat models developed by peer organizations.

is developed by an independent third-party with expertise in the organization’s industry sector.

considers the loss of visibility and control from transitioning to the cloud.

NEW QUESTION 49
When performing audits in relation to Business Continuity Management and Operational Resilience strategy, what would be the MOST critical aspect to audit in relation to the strategy of the cloud customer that should be formulated jointly with the cloud service provider?

Validate if the strategy covers unavailability of all components required to operate the business-as-usual or in disrupted mode, in parts or total- when impacted by a disruption.

Validate if the strategy covers all aspects of Business Continuity and Resilience planning, taking inputs from the assessed impact and risks, to consider activities for before, during, and after a disruption.

Validate if the strategy covers all activities required to continue and recover prioritized activities within identified time frames and agreed capacity, aligned to the risk appetite of the organization including the invocation of continuity plans and crisis management capabilities.

Validate if the strategy is developed by both cloud service providers and cloud service consumers within the acceptable limits of their risk appetite.

NEW QUESTION 50
Which of the following is the common cause of misconfiguration in a cloud environment?

Absence of effective change control

Using multiple cloud service providers

New cloud computing techniques

Traditional change process mechanisms

NEW QUESTION 51
Which concept provides the abstraction needed for resource pools?

Virtualization

Applistructure

Hypervisor

Metastructure

Orchestration

Loading …

Latest CCAK Exam Dumps ISACA Exam from Training: https://www.dumpstorrent.com/CCAK-exam-dumps-torrent.html

[Jan-2023 Newly Released] CCAK Dumps for Cloud Security Alliance Certified [Q37-Q51]

ISACA CCAK Exam Syllabus Topics:

admin

Leave a Reply Cancel reply