CCAK Practice Test Questions Updated 78 Questions
ISACA CCAK Dumps - Secret To Pass in First Attempt
NEW QUESTION 45
Which concept is a mapping of an identity, including roles, personas, and attributes, to an authorization?
- A. Federated Identity Management
- B. Authoritative source
- C. Authentication
- D. Access control
- E. Entitlement
Answer: E
NEW QUESTION 46
Which governance domain deals with evaluating how cloudcomputing affects compliance with internal security policies and various legal requirements, such as regulatory and legislative?
- A. Governance and Enterprise Risk Management
- B. Information Governance
- C. Legal Issues: Contracts and Electronic Discovery
- D. Compliance and Audit Management
- E. Infrastructure Security
Answer: D
NEW QUESTION 47
Which of the following is a perceived advantage or disadvantage of managing enterprise risk for cloud deployments?
- A. Increased need, but reduction in costs, for managing risks accepted by the cloud provider.
- B. Greater reliance on contracts, audits, and assessments due to lack of visibility or management.
- C. None of the above.
- D. Decreased requirement for proactive management of relationship and adherence to contracts.
- E. More physical control over assets and processes.
Answer: B
NEW QUESTION 48
Which of the following is the GREATEST security risk associated with data migration from a legacy human resources (HR) system to a cloud-based system''
- A. Data from the source and target system may be intercepted
- B. Data from the source and target system may have different data formats
- C. Records past their retention period may not be migrated to the new system
- D. System performance may be impacted by the migration
Answer: A
NEW QUESTION 49
An important consideration when performing a remote vulnerability test of a cloud-based application is to
- A. Obtain provider permission for test
- B. Use techniques to evade cloud provider's detection systems
- C. Use network layer testing tools exclusively
- D. Use application layer testing tools exclusively
- E. Schedule vulnerability test at night
Answer: A
NEW QUESTION 50
CCM: In the CCM tool, "Encryption and Key Management" is an example of which of the following?
- A. Domain
- B. Risk Impact
- C. Control Specification
Answer: A
NEW QUESTION 51
To understand their compliance alignments and gaps with a cloud provider, what must cloud customers rely on?
- A. Provider documentation
- B. Provider run audits and reports
- C. Third-party attestations
- D. EDiscovery tools
- E. Provider and consumer contracts
Answer: C
NEW QUESTION 52
Which attack surfaces, if any, does virtualization technology introduce?
- A. The hypervisor
- B. All of the above
- C. Configuration and VM sprawl issues
- D. Virtualization management components apart from the hypervisor
Answer: B
NEW QUESTION 53
CCM: A hypothetical company called: "Health4Sure" is located in the United States and provides cloud based services fortracking patient health. The company is compliant with HIPAA/HITECH Act among other industry standards. Health4Sure decides to assess the overall security of their cloud service against the CCM toolkit so that they will be able to present this document topotential clients.
Which of the following approach would be most suitable to assess the overall security posture of Health4Sure's cloud service?
- A. The CCM domain controls are mapped to HIPAA/HITECH Act and therefore Health4Sure could verify the CCM controls already covered as a result of their compliance with HIPPA/HITECH Act. They could then assess the remaining controls thoroughly. This approach saves time while being able to assess the company's overall security posture in an efficient manner.
- B. The CCM columns are mapped to HIPAA/HITECH Act and therefore Health4Sure could verify the CCM controls already covered ad a result of their compliance with HIPPA/HITECH Act. They could then assess the remaining controls. This approach will save time.
- C. The CCM domains are not mapped to HIPAA/HITECH Act. Therefore Health4Sure should assess the security posture of their cloud service against each and every control in the CCM. This approach will allow a thorough assessment of the security posture.
Answer: C
NEW QUESTION 54
CCM: The following list of controls belong to which domain of the CCM?
GRM 06 - Policy GRM 07- Policy Enforcement GRM 08 - Policy Impact on Risk Assessments GRM 09 - Policy Reviews GRM 10 - Risk Assessments GRM 11 - Risk Management Framework
- A. Governance and Risk Management
- B. Governance and Retention Management
- C. Governing and Risk Metrics
Answer: A
NEW QUESTION 55
ENISA: Lock-in is ranked as a high risk in ENISA research, a key underlying vulnerability causing lock in is:
- A. Lack of information onjurisdictions
- B. No source escrow agreement
- C. Unclear asset ownership
- D. Lack of completeness and transparency in terms of use
- E. Audit or certification not available to customers
Answer: D
NEW QUESTION 56
Which of thefollowing items is NOT an example of Security as a Service (SecaaS)?
- A. Intrusion detection
- B. Provisioning
- C. Authentication
- D. Spam filtering
- E. Web filtering
Answer: B
NEW QUESTION 57
Who is responsible for the security of the physical infrastructure and virtualization platform?
- A. The cloud consumer
- B. The responsibility is split equally
- C. The majority is covered by the consumer
- D. Itdepends on the agreement
- E. The cloud provider
Answer: E
NEW QUESTION 58
Which of the following cloud deployment models would BEST meet the needs of a startup software development organization with limited initial capital?
- A. Public
- B. Community
- C. Hybrid
- D. Private
Answer: A
NEW QUESTION 59
If there are gaps in network logging data,what can you do?
- A. Nothing. The cloud provider must make the information available.
- B. Ask the cloud provider to open more ports.
- C. Ask the cloud provider to close more ports.
- D. You can instrument the technology stack with your own logging.
- E. Nothing. There are simply limitations around the data that can be logged in the cloud.
Answer: D
NEW QUESTION 60
Your SLA with your cloudprovider ensures continuity for all services.
- A. False
- B. True
Answer: A
NEW QUESTION 61
When deploying an application that was created using the programming language and tools supported by the cloud provider, the MOST appropriate cloud computing model for an organization to adopt is:
- A. Identity as a Service (IDaaS).
- B. Infrastructure as a Service (laaS).
- C. Platform as a Service (PaaS).
- D. Software as a Service (SaaS).
Answer: C
NEW QUESTION 62
An organization recently implemented a cloud document storage solution and removed the ability for end users to save data to their local workstation hard drives Which of the following findings should be the IS auditor's GREATEST concern?
- A. The business continuity plan (BCP) was not updated.
- B. Mobile devices are not encrypted.
- C. Users are not required to sign updated acceptable
- D. Users have not been trained on the new system.
Answer: A
NEW QUESTION 63
An IS auditor is a member of an application development team that is selecting software. Which of the following would impair the auditor's independence?
- A. verifying the weighting of each selection criteria
- B. Approving the vendor selection methodology
- C. Witnessing the vendor selection process
- D. Reviewing the request for proposal (RFP)
Answer: B
NEW QUESTION 64
......
ISACA CCAK Exam Dumps [2021] Practice Valid Exam Dumps Question: https://www.validbraindumps.com/CCAK-exam-prep.html
CCAK Dumps - Grab Out For [NEW-2021] ISACA Exam: https://drive.google.com/open?id=1kMOoIKbg-ckaJjG4nz4zseE5vSOPq2lt