Latest CSA CCAK Exam Questions for Comprehensive Preparation

Question #1

Changes to which of the following will MOST likely influence the expansion or reduction of controls required to remediate the risk arising from changes to an organization’s SaaS vendor?

A. isk exceptions policy

B. ontractual requirements

C. isk appetite

D. oard oversight

View answer

Correct Answer: C

Question #2

A CSP contracts for a penetration test to be conducted on its infrastructures. The auditor engages the target with no prior knowledge of its defenses, assets, or channels. The CSP’s security operation center is not notified in advance of the scope of the audit and the test vectors. Which mode is selected by the CSP?

A. ouble gray box

B. andem

C. eversal

D. ouble blind

View answer

Correct Answer: D

Question #3

Due to cloud audit team resource constraints, an audit plan as initially approved cannot be completed. Assuming that the situation is communicated in the cloud audit report, which course of action is MOST relevant?

A. ocusing on auditing high-risk areas

B. esting the adequacy of cloud controls design

C. elying on management testing of cloud controls

D. esting the operational effectiveness of cloud controls

View answer

Correct Answer: A

Question #4

In an organization, how are policy violations MOST likely to occur?

A. y accident

B. eliberately by the ISP

C. eliberately

D. eliberately by the cloud provider

View answer

Correct Answer: A

Question #5

Which of the following is the BEST tool to perform cloud security control audits?

A. eneral Data Protection Regulation (GDPR)

B. SO 27001

C. ederal Information Processing Standard (FIPS) 140-2

D. SA Cloud Control Matrix (CCM)

View answer

Correct Answer: D

Question #6

Changes to which of the following will MOST likely influence the expansion or reduction of controls required to remediate the risk arising from changes to an organization’s SaaS vendor?

A. isk exceptions policy

B. ontractual requirements

C. isk appetite

D. oard oversight

View answer

Correct Answer: C

Question #7

A CSP contracts for a penetration test to be conducted on its infrastructures. The auditor engages the target with no prior knowledge of its defenses, assets, or channels. The CSP?s security operation center is not notified in advance of the scope of the audit and the test vectors. Which mode is selected by the CSP?

A. ouble gray box

B. andem

C. eversal

D. ouble blind

View answer

Correct Answer: D

Question #8

Due to cloud audit team resource constraints, an audit plan as initially approved cannot be completed. Assuming that the situation is communicated in the cloud audit report, which course of action is MOST relevant?

A. ocusing on auditing high-risk areas

B. esting the adequacy of cloud controls design

C. elying on management testing of cloud controls

D. esting the operational effectiveness of cloud controls

View answer

Correct Answer: A

Question #9

In an organization, how are policy violations MOST likely to occur?

A. y accident

B. eliberately by the ISP

C. eliberately

D. eliberately by the cloud provider

View answer

Correct Answer: A

Question #10

Which of the following is the BEST tool to perform cloud security control audits?

A. eneral Data Protection Regulation (GDPR)

B. SO 27001

C. ederal Information Processing Standard (FIPS) 140-2

D. SA Cloud Control Matrix (CCM)

View answer

Correct Answer: D

Question #11

Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, ports, and by compensating controls. Which of the following controls BEST matches this control description?

A. etwork Security

B. hange Detection

C. irtual Instance and OS Hardening

D. etwork Vulnerability Management

View answer

Correct Answer: A

Question #12

After finding a vulnerability in an internet-facing server of an organization, a cybersecurity criminal is able to access an encrypted file system and successfully manages to overwrite part of some files with random data. In reference to the Top Threats Analysis methodology, how would you categorize the technical impact of this incident?

A. s an integrity breach

B. s control breach

C. s an availability breach

D. s a confidentiality breach

View answer

Correct Answer: B

Question #13

Organizations maintain mappings between the different control frameworks they adopt to:

A. elp identify controls with common assessment status

B. void duplication of work when assessing compliance

C. elp identify controls with different assessment status

D. tart a compliance assessment using latest assessment

View answer

Correct Answer: C

Question #14

SAST testing is performed by:

A. canning the application source code

B. canning the application interface

C. canning all infrastructure components

D. erforming manual actions to gain control of the application

View answer

Correct Answer: A

Question #15

When a client’s business process changes, the CSP SLA should:

A. e reviewed, but the SLA cannot be updated

B. ot be reviewed, but the cloud contract should be cancelled immediately

C. ot be reviewed as the SLA cannot be updated

D. e reviewed and updated if required

View answer

Correct Answer: D

Question #16

The PRIMARY objective of an audit initiation meeting with a cloud audit client is to:

A. elect the methodology of the audit

B. eview requested evidence provided by the audit client

C. iscuss the scope of the cloud audit

D. dentify resource requirements of the cloud audit

View answer

Correct Answer: C

Question #17

Policies and procedures shall be established, and supporting business processes and technical measures implemented, for maintenance of several items ensuring continuity and availability of operations and support personnel. Which of the following controls BEST matches this control description?

A. perations Maintenance

B. ystem Development Maintenance

C. quipment Maintenance

D. ystem Maintenance

View answer

Correct Answer: A

Question #18

An auditor identifies that a CSP received multiple customer inquiries and RFPs during the last month. Which of the following should be the BEST recommendation to reduce the CSP burden?

A. SP can share all security reports with customers to streamline the process

B. SP can schedule a call with each customer

C. SP can answer each customer individually

D. SP can direct all customers’ inquiries to the information in the CSA STAR registry

View answer

Correct Answer: D

Question #19

Which of the following approaches encompasses social engineering of staff, bypassing of physical access controls and penetration testing?

A. lue team

B. hite box

C. ray box

D. ed team

View answer

Correct Answer: B

Question #20

When applying the Top Threats Analysis methodology following an incident, what is the scope of the technical impact identification step?

A. etermine the impact on the controls that were selected by the organization to respond to identified risks

B. etermine the impact on confidentiality, integrity and availability of the information system

C. etermine the impact on the financial, operational, compliance and reputation of the organization

D. etermine the impact on the physical and environmental security of the organization, excluding informational assets

View answer

Correct Answer: D

Question #21

When performing audits in relation to Business Continuity Management and Operational Resilience strategy, what would be the MOST critical aspect to audit in relation to the strategy of the cloud customer that should be formulated jointly with the cloud service provider?

A. alidate if the strategy covers unavailability of all components required to operate the business-as-usual or in disrupted mode, in parts or total- when impacted by a disruption

B. alidate if the strategy covers all aspects of Business Continuity and Resilience planning, taking inputs from the assessed impact and risks, to consider activities for before, during, and after a disruption

C. alidate if the strategy covers all activities required to continue and recover prioritized activities within identified time frames and agreed capacity, aligned to the risk appetite of the organization including the invocation of continuity plans and crisis management capabilities

D. alidate if the strategy is developed by both cloud service providers and cloud service consumers within the acceptable limits of their risk appetite

View answer

Correct Answer: B

Question #22

Which of the following metrics are frequently immature?

A. etrics around Infrastructure as a Service (IaaS) storage and network environments

B. etrics around Platform as a Service (PaaS) development environments

C. etrics around Infrastructure as a Service (IaaS) computing environments

D. etrics around specific Software as a Service (SaaS) application services

View answer

Correct Answer: A

Question #23

The MAIN difference between Cloud Control Matrix (CCM) and Consensus Assessment Initiative Questionnaire (CAIQ) is that:

A. CM assesses the presence of controls, whereas CAIQ assesses overall security of a service

B. CM has a set of security questions, whereas CAIQ has a set of security controls

C. CM has 14 domains and CAIQ has 16 domains

D. CM provides a controls framework, whereas CAIQ provides industry-accepted ways to document which security controls exist in IaaS, PaaS, and SaaS offerings

View answer

Correct Answer: D

Question #24

Which of the following is an example of financial business impact?

A. hacker using a stolen administrator identity brings down the SaaS sales and marketing systems, resulting in the inability to process customer orders or manage customer relationships

B. hile the breach was reported in a timely manner to the CEO, the CFO and CISO blamed each other in public, resulting in a loss of public confidence that led the board to replace all three

C. DDoS attack renders the customer's cloud inaccessible for 24 hours resulting in millions in lost sales

D. he cloud provider fails to report a breach of customer personal data from an unsecured server, resulting in GDPR fines of 10 million euro

View answer

Correct Answer: C

Question #25

From the perspective of a senior cloud security audit practitioner in an organization of a mature security program with cloud adoption, which of the following statements BEST describes the DevSecOps concept?

A. rocess of security integration using automation in software development

B. evelopment standards for addressing integration, testing, and deployment issues

C. perational framework that promotes software consistency through automation

D. aking software development simpler, faster, and easier using automation

View answer

Correct Answer: B

Question #26

Which of the following is MOST important to consider when developing an effective threat model during the introduction of a new SaaS service into a customer organization’s architecture? The threat model:

A. ecognizes the shared responsibility for risk management between the customer and the CSP

B. everages SaaS threat models developed by peer organizations

C. s developed by an independent third-party with expertise in the organization’s industry sector

D. onsiders the loss of visibility and control from transitioning to the cloud

View answer

Correct Answer: A

Question #27

While performing the audit, the auditor found that an object storage bucket containing PII could be accessed by anyone on the Internet. Given this discovery, what should be the most appropriate action for the auditor to perform?

A. ighlighting the gap to the audit sponsor at the sponsor’s earliest possible availability

B. sking the organization’s cloud administrator to immediately close the gap by updating the configuration settings and making the object storage bucket private and hence inaccessible from the Internet

C. ocumenting the finding in the audit report and sharing the gap with the relevant stakeholders

D. nforming the organization’s internal audit manager immediately about the gap

View answer

Correct Answer: C

Question #28

To qualify for CSA STAR attestation for a particular cloud system, the SOC 2 report must cover:

A. SO/I?? 27001: 2013 controls

B. aturity model criteria

C. ll Cloud Control Matrix (CCM) controls and TSPC security principles

D. loud Control Matrix (CCM) and ISO/IEC 27001:2013 controls

View answer

Correct Answer: C

Question #29

Which of the following is MOST important to consider when an organization is building a compliance program for the cloud?

A. he rapidly changing service portfolio and architecture of the cloud

B. loud providers should not be part of the compliance program

C. he fairly static nature of the service portfolio and architecture of the cloud

D. he cloud is similar to the on-premise environment in terms of compliance

View answer

Correct Answer: A

Question #30

When developing a cloud compliance program, what is the PRIMARY reason for a cloud customer to review which cloud services will be deployed?

A. o determine how those services will fit within its policies and procedures

B. o determine the total cost of the cloud services to be deployed

C. o confirm which vendor will be selected based on the compliance with security requirements

D. o confirm if the compensating controls implemented are sufficient for the cloud

View answer

Correct Answer: A

Question #31

Which of the following attestation allows for immediate adoption of the Cloud Control Matrix (CCM) as additional criteria to AICPA Trust Service Criteria and provides the flexibility to update the criteria as technology and market requirements change?

A. C-IDSS

B. SA STAR Attestation

C. TCS

D. SI Criteria Catalogue C5

View answer

Correct Answer: B

Question #32

To ensure that cloud audit resources deliver the best value to the organization, the PRIMARY step would be to:

A. evelop a cloud audit plan on the basis of a detailed risk assessment

B. chedule the audits and monitor the time spent on each audit

C. rain the cloud audit staff on current technology used in the organization

D. onitor progress of audits and initiate cost control measures

View answer

Correct Answer: A

Question #33

Which of the following is an example of integrity technical impact?

A. he cloud provider reports a breach of customer personal data from an unsecured server

B. hacker using a stolen administrator identity alerts the discount percentage in the product database

C. DDoS attack renders the customer’s cloud inaccessible for 24 hours

D. n administrator inadvertently clicked on Phish bait exposing his company to a ransomware attack

View answer

Correct Answer: D

Question #34

What is a sign of an organization that has adopted a shift-left concept of code release cycles?

A. waterfall model to move resources through the development to release phases

B. ncorporation of automation to identify and address software code problems early

C. aturity of start-up entities with high-iteration to low-volume code commits

D. arge entities with slower release cadences and geographical dispersed systems

View answer

Correct Answer: B

Question #35

Cloud Control Matrix (CCM) controls can be used by cloud customers to:

A. evelop new security baselines for the industry

B. efine different control frameworks for different cloud service providers

C. acilitate communication with their legal department

D. uild an operational cloud risk management program

View answer

Correct Answer: B

Question #36

Within an organization, which of the following functions should be responsible for defining the cloud adoption approach?

A. udit committee

B. ompliance manager

C. T manager

D. enior management

View answer

Correct Answer: D

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now

Latest CSA CCAK Exam Questions for Comprehensive Preparation

View Answers after Submission

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE! Get Now

Latest CSA CCAK Exam Questions for Comprehensive Preparation

View Answers after Submission

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now