ISACA Certificate of Cloud Auditing Knowledge - CCAK FREE EXAM DUMPS QUESTIONS & ANSWERS

A. Updated audit work program B. Documentation criteria for the audit evidence C. Processes and systems to be audited D. Testing procedure to be performed

A. CCM has 14 domains, whereas CAIQ has 16 domains. B. CCM has a set of security questions, whereas CAIQ has a set of security controls. C. CCM provides a controls framework, whereas CAIQ provides industry-accepted ways to document which security controls exist in Infrastructure as a Service (laaS), Platform as a Service (PaaS), and Software as a Service (SaaS) offerings. D. CCM assesses the presence of controls, whereas CAIQ assesses the overall security of a service.

A. organization's chief information security officer (CISO) B. auditee's senior management. C. cloud auditor. D. organization's chief executive officer (CEO).

A. Access to the cloud infrastructure B. Cloud console C. Reward programs D. Application programming interfaces (APIs)

A. distributed denial of service (DDoS) attack renders the customer's cloud inaccessible for 24 hours. B. The cloud provider reports a breach of customer personal data from an unsecured server. C. A hacker using a stolen administrator identity alters the discount percentage in the product database. D. An administrator inadvertently clicked on phish bait, exposing the company to a ransomware attack.

A. The experience gained over the years B. The as-is and to-be enterprise architecture (EA C. Using a standardized control framework D. Understanding the customer risk profile

A. transferred. B. avoided. C. shared. D. maintained.

A. There is no difference between a Type 2 and a Type 1 SOC report. B. A Type 1 SOC report provides an attestation, whereas a Type 2 SOC report offers a certification. C. A Type 2 SOC report validates the suitability of the control design, whereas a Type 1 SOC report validates the operating effectiveness of controls. D. A Type 2 SOC report validates the operating effectiveness of controls, whereas a Type 1 SOC report validates the suitability of the design of the controls.

A. Large entities with slower release cadences and geographically dispersed systems B. Maturity of start-up entities with high-iteration to low-volume code commits C. Incorporation of automation to identify and address software code problems early D. A waterfall model remove resources through the development to release phases

A. CCM maps to existing security standards, best practices, and regulations. B. CCM V4 is an improved version from CCM V3.0.1. C. CCM utilizes an ITIL framework to define the capabilities needed to manage the IT services and security services. D. CCM uses a specific control for Infrastructure as a Service (laaS).

A. Review the contract and DR capability. B. Plan an audit of the provider C. Review the provider's audit reports. D. Review the security white paper of the provider.

A. Patching B. Source code reviews C. Access controls D. Vulnerability management

A. Controls are the responsibility of the cloud service provider. B. Controls adapt to changes in the threat landscape. C. Controls are the responsibility of the internal audit team. D. Controls are static and do not change.