السؤال #1

What aspect of SaaS functionality and operations would the cloud customer be responsible for and should be audited?

A. Access controls

B. Vulnerability management

C. Source code reviews

D. Patching

عرض الإجابة

اجابة صحيحة: A

السؤال #2

What is an essential factor to consider when evaluating the effectiveness of a Cloud Compliance Program?

A. The attractiveness of the cloud provider's websitE

B. The number of data centers the cloud provider possesses

C. The alignment of the program with organizational compliance requirements

D. The variety of colors used in the cloud provider's dashboarD

عرض الإجابة

اجابة صحيحة: c

السؤال #3

An organization deploying the Cloud Control Matrix (CCM) to perform a compliance assessment will encompass the use ofthe Corporate Governance Relevance feature to filter out those controls:

A. relating to policies, processes, laws, regulations, and institutions conditioning the way an organization is managed, directed, or controlled

B. that can be either of a management or of a legal nature, therefore requiring an approval from the Change Advisory Board

C. that require the prior approval from the Board of Directors to be funded (for either make or buy), implemented, and reported on

D. that can be either of an administrative or of a technical nature, therefore requiring an approval from the Change Advisory Board

عرض الإجابة

اجابة صحيحة: A

السؤال #4

As a developer building codes into a container in a DevSecOps environment, which of the following is the appropriateplace(s) to perform security tests?

A. Within developer’s laptop

B. Within the CI/CD server

C. Within version repositories

D. Within the CI/CD pipeline

عرض الإجابة

اجابة صحيحة: D

السؤال #5

When a client’s business process changes, the CSP SLA should:

A. be reviewed, but the SLA cannot be updated

B. not be reviewed, but the cloud contract should be cancelled immediately

C. not be reviewed as the SLA cannot be updated

D. be reviewed and updated if required

عرض الإجابة

اجابة صحيحة: D

السؤال #6

Which of the following quantitative measures is KEY for an auditor to review when assessing the implementation ofcontinuous auditing of performance on a cloud system?

A. Service Level Objective (SLO)

B. Recovery Point Objectives (RPO)

C. Service Level Agreement (SLA)

D. Recovery Time Objectives (RTO)

عرض الإجابة

اجابة صحيحة: C

السؤال #7

What data center and physical security measures should a cloud customer consider when assessing a cloud serviceprovider?

A. Assess use of monitoring systems to control ingress and egress points of entry to the data center

B. Implement physical security perimeters to safeguard personnel, data and information systems

C. Conduct a due diligence to verify the cloud provider applies adequate physical security measures

D. Review internal policies and procedures for relocation of hardware and software to an offsite location

عرض الإجابة

اجابة صحيحة: C

السؤال #8

Prioritizing assurance activities for an organizations cloud services portfolio depends PRIMARILY on an organizationsability to:

A. schedule frequent reviews with high-risk cloud service providers

B. develop plans using a standardized risk-based approach

C. maintain a comprehensive cloud service inventory

D. collate views from various business functions using cloud services

عرض الإجابة

اجابة صحيحة: A

السؤال #9

What is the advantage of using dynamic application security testing (DAST) over static application security testing (SAST)methodology?

A. Unlike SAST, DAST is a blackbox and programming language agnostic

B. DAST can dynamically integrate with most CI/CD tools

C. DAST delivers more false positives than SAST

D. DAST is slower but thorough

عرض الإجابة

اجابة صحيحة: A

السؤال #10

When evaluating a cloud compliance program, it is crucial to assess the program's effectiveness in enforcing and maintaining compliance standards. What factors should be considered in such an evaluation?Select all that apply.

A. The frequency and thoroughness of compliance audits and assessments

B. The involvement of senior management and stakeholders in supporting and understanding the compliance program

C. The presence of an attractive and user-friendly compliance training program, regardless of its content or relevance to cloud compliancE

D. The procedures in place for identifying, reporting, and addressing compliance violations or gaps

عرض الإجابة

اجابة صحيحة: abd

السؤال #11

Which of the following is a key benefit of using a continuous monitoring approach in cloud auditing?

A. It allows for real-time detection of security incidents and breaches

B. It eliminates the need for manual audit reviews and assessments

C. It provides assurance that all cloud controls and configurations are up-to-datE

D. It enables auditors to conduct thorough penetration tests on cloud systems

عرض الإجابة

اجابة صحيحة: a

السؤال #12

A cloud auditor is evaluating a cloud service provider's adherence to the Cloud Control Matrix (CCM). The auditor needs to assess various aspects of the provider's operations. What areas should the auditor examine to provide a comprehensive evaluation?Select all that apply.

A. The CSP's policies and procedures for access control, data encryption, and incident responsE

B. The aesthetic appeal of the CSP's user interface to ensure it meets industry design standards

C. The effectiveness of the CSP's change management process and how well it is integrated with incident and problem management

D. The transparency of the CSP's data processing locations and data transfer mechanisms to assess compliance with data sovereignty laws

عرض الإجابة

اجابة صحيحة: acd

السؤال #13

Changes to which of the following will MOST likely influence the expansion or reduction of controls required to remediate therisk arising from changes to an organizations SaaS vendor?

A. Risk exceptions policy

B. Contractual requirements

C. Risk appetite

D. Board oversight

عرض الإجابة

اجابة صحيحة: C

السؤال #14

Why is it important to understand the shared responsibility model in cloud computing?

A. To evaluate the parties based on their contribution to cloud service entertainment

B. To assess which party has the best cloud-related social media presencE

C. To determine which party enjoys the most benefits from cloud services

D. To clarify the security responsibilities of the cloud provider and the customer

عرض الإجابة

اجابة صحيحة: d

السؤال #15

Which of the following metrics are frequently immature?

A. Metrics around Infrastructure as a Service (IaaS) storage and network environments

B. Metrics around Platform as a Service (PaaS) development environments

C. Metrics around Infrastructure as a Service (IaaS) computing environments

D. Metrics around specific Software as a Service (SaaS) application services

عرض الإجابة

اجابة صحيحة: A

السؤال #16

In Cloud Governance, which component is crucial for aligning IT resources with business objectives?

A. Developing a robust marketing strategy

B. Implementing effective cost management

C. Creating graphical content

D. Ensuring entertainment of stakeholders

عرض الإجابة

اجابة صحيحة: b

السؤال #17

Which of the following is the common cause of misconfiguration in a cloud environment?

A. Absence of effective change control

B. Using multiple cloud service providers

C. New cloud computing techniques

D. Traditional change process mechanisms

عرض الإجابة

اجابة صحيحة: A

السؤال #18

Which of the following is MOST important to consider when developing an effective threat model during the introduction of anew SaaS service into a customer organizations architecture? The threat model:

A. recognizes the shared responsibility for risk management between the customer and the CSP

B. leverages SaaS threat models developed by peer organizations

C. is developed by an independent third-party with expertise in the organization’s industry sector

D. considers the loss of visibility and control from transitioning to the cloud

عرض الإجابة

اجابة صحيحة: A

السؤال #19

Effective cloud governance frameworks often include what elements?(Choose two)

A. Social media integration strategies

B. Mechanisms for policy enforcement

C. Strategies for engaging with influencers

D. Performance and compliance monitoring

عرض الإجابة

اجابة صحيحة: bd

السؤال #20

How should controls be designed by an organization?

A. By the internal audit team

B. Using the ISO27001 framework

C. By the cloud provider

D. Using the organization’s risk management framework

عرض الإجابة

اجابة صحيحة: A

السؤال #21

An organization has an ISMS implemented, following ISO 27001 and Annex A controls. The CIO would like to migrate someof the infrastructure to the cloud. Which of the following standards would BEST assist in identifying controls to consider forthis migration?

A. ISO/IEC 27701

B. ISO/IEC 22301

C. ISO/IEC 27002

D. ISO/IEC 27017

عرض الإجابة

اجابة صحيحة: D

السؤال #22

What are key considerations when establishing a Cloud Governance framework?(Choose two)

A. Selecting colors for the user interface

B. Defining clear roles and responsibilities

C. Establishing performance and reliability metrics

D. Ensuring the framework is visually appealing

عرض الإجابة

اجابة صحيحة: bc

السؤال #23

When migrating to a cloud environment, which of the following should be the PRIMARY driver for the use of encryption?

A. Cloud Service Provider encryption capabilities

B. The presence of PII

C. Organizational security policies

D. Cost-benefit analysis

عرض الإجابة

اجابة صحيحة: A

السؤال #24

How does a Threat Analysis Methodology utilizing CCM aid in cloud security?

A. It provides a systematic approach to identify and mitigate potential cloud security threats

B. It evaluates the creativity of cloud threat warnings

C. It assesses the impact of cloud threats on social media trends

C. It measures the cloud provider's ability to create engaging threat reports

عرض الإجابة

اجابة صحيحة: a

لا تريد أن تفوت شيئا؟

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع!
احصل الان

عرض الإجابات بعد التقديم

لا تريد أن تفوت شيئا؟

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع! احصل الان

عرض الإجابات بعد التقديم

اجتياز اختبار الممارسة Cisco وPMP وCISA وCISM وAWS بنسبة 100% للبيع!
احصل الان