Isaca CCAK Practice Exam Questions

Isaca CCAK Sample Question Answers

Question # 1

Which of the following is a KEY benefit of using the Cloud Controls Matrix (CCM)? 

A. CCM uses a specific control for Infrastructure as a Service (IaaS). 
B. CCM maps to existing security standards, best practices, and regulations. 
C. CCM V4 is an improved version from CCM V3.0.1. 
D. CCM utilizes an ITIL framework to define the capabilities needed to manage the IT services and security services

Show Answer

Question # 2

What is below the waterline in the context of cloud operationalization?

A. The controls operated by the customer 
B. The controls operated by both 
C. The controls operated by the cloud access security broker (CASB) 
D. The controls operated by the cloud service provider 

Show Answer

Question # 3

Which of the following helps an organization to identify control gaps and shortcomings in the context of cloud computing? 

A. Walk-through peer review 
B. Periodic documentation review 
C. User security awareness training 
D. Monitoring effectiveness 

Show Answer

Question # 4

Which of the following BEST describes the difference between a Type 1 and a Type 2 SOC report? 

A. A Type 2 SOC report validates the operating effectiveness of controls, whereas a Type 1 SOC report validates the suitability of the design of the controls
B. A Type 1 SOC report provides an attestation, whereas a Type 2 SOC report offers a certification. 
C. A Type 2 SOC report validates the suitability of the control design, whereas a Type 1 SOC report validates the operating effectiveness of controls
D. There is no difference between a Type 2 and a Type 1 SOC report. 

Show Answer

Question # 5

Which of the following is the BEST control framework for a European manufacturing corporation that is migrating to the cloud? 

A. CSA'sGDPRCoC 
B. EUGDPR 
C. NIST SP 800-53 
D. PCI-DSS 

Show Answer

Question # 6

organization should document the compliance responsibilities and ownership of accountability in a RACI chart or its informational equivalents in order to: 

A. provide a holistic and seamless view of the cloud service provider's responsibility for compliance with prevailing laws and regulations. 
B. provide a holistic and seamless view of the enterprise's responsibility for compliance with prevailing laws and regulations. 
C. conform to the organization's governance model.
 D. define the cloud compliance requirements and how they interplay with the organization’s business strategy, goals, and other compliance requirements. 

Show Answer

Question # 7

In cloud computing, which KEY subject area relies on measurement results and metrics? 

A. Software as a Service (SaaS) application services 
B. Infrastructure as a Service (IaaS) storage and network 
C. Platform as a Service (PaaS) development environment 
D. Service level agreements (SLAs) 

Show Answer

Question # 8

Market share and geolocation are aspects PRIMARILY related to: 

A. business perspective. 
B. cloud perspective. 
C. risk perspective. 
D. governance perspective. 

Show Answer

Question # 9

Which of the following is a cloud-native solution designed to counter threats that do not exist within the enterprise?

A. Rule-based access control 
B. Attribute-based access control 
C. Policy-based access control 
D. Role-based access control 

Show Answer

Question # 10

Which industry organization offers both security controls and cloud-relevant benchmarking? 

A. Cloud Security Alliance (CSA) 
B. SANS Institute 
C. International Organization for Standardization (ISO) 
D. Center for Internet Security (CIS) 

Show Answer