[Q48-Q64] Easily To Pass New CCAK Premium Exam Updated [Jul 30, 2022] : Exam for engine : http://blog.test4engine.com

NEW QUESTION 48
Which of the following is the MOST feasible way to validate the performance of CSPs for the delivery of technology resources?

Cloud compliance program

Legacy IT compliance program

Internal audit program

Service organization controls report

NEW QUESTION 49
Changes to which of the following will MOST likely influence the expansion or reduction of controls required to remediate the risk arising from changes to an organization’s SaaS vendor?

Risk exceptions policy

Contractual requirements

Risk appetite

Board oversight

NEW QUESTION 50
Which plan will guide an organization on how to react to a security incident that might occur on the organization’s systems, or that might be affecting one of their service providers?

Incident Response Plans

Security Incident Plans

Unexpected Event Plans

Emergency Incident Plans

NEW QUESTION 51
The Open Certification Framework is structured on three levels of trust. Those three levels of trust are:

CSA STAR Self-Assessment, STAR Certification & Attestation (Third-party Assessment), STAR Compliance

CSA STAR Audit, STAR Certification & Attestation (Third-party Assessment), STAR Continuous

CSA STAR Self-Assessment, STAR Certification & Attestation (Third-party Assessment), STAR Monitoring and Control

CSA STAR Self-Assessment, STAR Certification & Attestation (Third-party Assessment), STAR Continuous

NEW QUESTION 52
When using a SaaS solution, who is responsible for application security?

The cloud service provider only

The cloud service consumer only

Both cloud consumer and the enterprise

Both cloud provider and the consumer

NEW QUESTION 53
Which governance domain deals with evaluating how cloudcomputing affects compliance with internal security policies and various legal requirements, such as regulatory and legislative?

Legal Issues: Contracts and Electronic Discovery

Infrastructure Security

Compliance and Audit Management

Information Governance

Governance and Enterprise Risk Management

NEW QUESTION 54
Which of the following is an example of integrity technical impact?

The cloud provider reports a breach of customer personal data from an unsecured server.

A hacker using a stolen administrator identity alerts the discount percentage in the product database.

A DDoS attack renders the customer’s cloud inaccessible for 24 hours.

An administrator inadvertently click on Phish bait exposing his company to a ransomware attack.

NEW QUESTION 55
When performing audits in relation to Business Continuity Management and Operational Resilience strategy, what would be the MOST critical aspect to audit in relation to the strategy of the cloud customer that should be formulated jointly with the cloud service provider?

Validate if the strategy covers unavailability of all components required to operate the business-as-usual or in disrupted mode, in parts or total- when impacted by a disruption.

Validate if the strategy covers all aspects of Business Continuity and Resilience planning, taking inputs from the assessed impact and risks, to consider activities for before, during, and after a disruption.

Validate if the strategy covers all activities required to continue and recover prioritized activities within identified time frames and agreed capacity, aligned to the risk appetite of the organization including the invocation of continuity plans and crisis management capabilities.

Validate if the strategy is developed by both cloud service providers and cloud service consumers within the acceptable limits of their risk appetite.

NEW QUESTION 56
How should controls be designed by an organization?

By the internal audit team

Using the ISO27001 framework

By the cloud provider

Using the organization’s risk management framework

NEW QUESTION 57
Which of the following standards is designed to be used by organizations for cloud services that intend to select controls within the process of implementing an Information Security Management System based on ISO/IEC 27001?

ISO/IEC 27017:2015

CSA Cloud Control Matrix (CCM)

NIST SP 800-146

ISO/IEC 27002

NEW QUESTION 58
In the context of Infrastructure as a Service (IaaS), a vulnerability assessment will scan virtual machines to identify vulnerabilities in:

both operating system and application infrastructure contained within the CSP’s instances.

both operating system and application infrastructure contained within the customer’s instances

only application infrastructure contained within the CSP’s instances.

only application infrastructure contained within the customer’s instances.

NEW QUESTION 59
As a developer building codes into a container in a DevSecOps environment, which of the following is the appropriate place(s) to perform security tests?

Within developer’s laptop

Within the CI/CD server

Within version repositories

Within the CI/CD pipeline

NEW QUESTION 60
Which statement best describes why it is important to know how data is being accessed?

The devices used to access data have different storage formats.

The devices used to access data use a variety of operating systems and may have different programs installed on them.

The device may affect data dispersion.

The devices used to access data use a variety of applications or clients and may have different security characteristics.

The devices used to access data may have differentownership characteristics.

NEW QUESTION 61
To support customer’s verification of the CSP claims regarding their responsibilities according to the shared responsibility model, which of the following tools and techniques is appropriate?

Contractual agreement

Internal audit

External audit

Security assessment

NEW QUESTION 62
Cloud Control Matrix (CCM) controls can be used by cloud customers to:

develop new security baselines for the industry.

define different control frameworks for different cloud service providers.

facilitate communication with their legal department.

build an operational cloud risk management program.

NEW QUESTION 63
If there are gaps in network logging data,what can you do?

Nothing. There are simply limitations around the data that can be logged in the cloud.

Ask the cloud provider to open more ports.

You can instrument the technology stack with your own logging.

Ask the cloud provider to close more ports.

Nothing. The cloud provider must make the information available.

NEW QUESTION 64
Your SLA with your cloudprovider ensures continuity for all services.

False

True

[Q48-Q64] Easily To Pass New CCAK Premium Exam Updated [Jul 30, 2022]

ISACA CCAK Exam Syllabus Topics:

How much does an Isaca CCAK Exam cost?

What does Riverbed offer their employees in terms of salary and benefits?