CCAK

CCAK practice questions, page 8 of 13, with answer review and explanations.

Question 36

A cloud service provider does not allow audits using automated tools as these tools could be considered destructive techniques for the cloud environment. Which of the following aspects of the audit will be constrained?

  1. Purpose
  2. Objectives
  3. Nature of relationship
  4. Scope

Question 37

An organization has an ISMS implemented, following ISO 27001 and Annex A controls. The CIO would like to migrate some of the infrastructure to the cloud. Which of the following standards would BEST assist in identifying controls to consider for this migration?

  1. ISO/IEC 27701
  2. ISO/IEC 22301
  3. ISO/IEC 27002
  4. ISO/IEC 27017

Question 38

An organization is in the initial phases of cloud adoption. It is not very knowledgeable about cloud security and cloud shared responsibility models. Which of the following approaches is BEST suited for such an organization to evaluate its cloud security?

  1. Use of an established standard/regulation to map controls and use as the audit criteria
  2. For efficiency reasons, use of its on-premises systems’ audit criteria to audit the cloud environment
  3. As this is the initial stage, the ISO/IEC 27001 certificate shared by the cloud service provider is sufficient for audit and compliance purposes.
  4. Development of the cloud security audit criteria based on its own internal audit test plans to ensure appropriate coverage

Question 39

Which of the following controls framework should the cloud customer use to assess the overall security risk of a cloud provider?

  1. SOC3 - Type2
  2. Cloud Control Matrix (CCM)
  3. SOC2 - Type1
  4. SOC1 - Type1

Question 40

Which of the following aspects of risk management involves identifying the potential reputational harm and/or financial harm when an incident occurs?

  1. Mitigations
  2. Residual risk
  3. Likelihood
  4. Impact Analysis