[Dec-2021] Use Real CCAK Dumps Free Sample Questions and Practice Test Engine
Pass ISACA CCAK exam - questions - convert Tets Engine to PDF
NEW QUESTION 44
Which layer is the most important for securing because it is considered to be the foundation for secure cloud operations?
- A. Metastructure
- B. Infostructure
- C. Infrastructure
- D. Datastructure
- E. Applistructure
Answer: C
NEW QUESTION 45
To understand their compliance alignments and gaps with a cloud provider, what must cloud customers rely on?
- A. Provider documentation
- B. Provider run audits and reports
- C. Third-party attestations
- D. EDiscovery tools
- E. Provider and consumer contracts
Answer: C
NEW QUESTION 46
What is the newer application development methodology and philosophy focused on automation of application development and deployment?
- A. SecDevOps
- B. DevOps
- C. Agile
- D. Scrum
- E. BusOps
Answer: B
NEW QUESTION 47
Which attack surfaces, if any, does virtualization technology introduce?
- A. The hypervisor
- B. All of the above
- C. Configuration and VM sprawl issues
- D. Virtualization management components apart from the hypervisor
Answer: B
NEW QUESTION 48
Who is responsible for the security of the physical infrastructure and virtualization platform?
- A. The cloud consumer
- B. The responsibility is split equally
- C. The majority is covered by the consumer
- D. Itdepends on the agreement
- E. The cloud provider
Answer: E
NEW QUESTION 49
Which of the following should be an IS auditor's GREATEST concern when reviewing an outsourcing arrangement with a third-party cloud service provider to host personally identifiable data?
- A. Fees are charged based on the volume of data stored by the host.
- B. The organization's servers are not compatible with the third party's infrastructure
- C. The outsourcing contract does not contain a right-to-audit clause.
- D. The data is not adequately segregated on the host platform.
Answer: D
NEW QUESTION 50
Dynamic Application Security Testing (DAST) might be limited or require pre-testing permission from the provider.
- A. False
- B. True
Answer: B
NEW QUESTION 51
What is true of companies considering a cloud computing business relationship?
- A. The confidentiality agreements between companies using cloud computing services is limited legally to the company, not the provider.
- B. The cloud computing companies are absolved of all data security and associated risks through contracts and data laws.
- C. The companies using the cloud providers are the custodians ofthe data entrusted to them.
- D. The laws protecting customer data arebased on the cloud provider and customer location only.
- E. The cloud computing companies own all customer data.
Answer: C
NEW QUESTION 52
What item below allows disparate directory services and independent security domains to be interconnected?
- A. Federation
- B. Cloud
- C. Coalition
- D. Union
- E. Intersection
Answer: A
NEW QUESTION 53
REST APIs are the standard for web-based services because they run over HTTPS and work well across diverse environments.
- A. False
- B. True
Answer: B
NEW QUESTION 54
An audit has identified that business units have purchased cloud-based applications without ITs support. What is the GREATEST risk associated with this situation?
- A. The applications may not reasonably protect data.
- B. The applications could be modified without advanced notice.
- C. The application purchases did not follow procurement policy.
- D. The applications are not included in business continuity plans (BCPs).
Answer: D
NEW QUESTION 55
APIs and web services require extensive hardening and must assume attacks from authenticated and unauthenticated adversaries.
- A. False
- B. True
Answer: B
NEW QUESTION 56
CCM: A hypothetical company called: "Health4Sure" is located in the United States and provides cloud based services fortracking patient health. The company is compliant with HIPAA/HITECH Act among other industry standards. Health4Sure decides to assess the overall security of their cloud service against the CCM toolkit so that they will be able to present this document topotential clients.
Which of the following approach would be most suitable to assess the overall security posture of Health4Sure's cloud service?
- A. The CCM domain controls are mapped to HIPAA/HITECH Act and therefore Health4Sure could verify the CCM controls already covered as a result of their compliance with HIPPA/HITECH Act. They could then assess the remaining controls thoroughly. This approach saves time while being able to assess the company's overall security posture in an efficient manner.
- B. The CCM columns are mapped to HIPAA/HITECH Act and therefore Health4Sure could verify the CCM controls already covered ad a result of their compliance with HIPPA/HITECH Act. They could then assess the remaining controls. This approach will save time.
- C. The CCM domains are not mapped to HIPAA/HITECH Act. Therefore Health4Sure should assess the security posture of their cloud service against each and every control in the CCM. This approach will allow a thorough assessment of the security posture.
Answer: C
NEW QUESTION 57
Which concept is a mapping of an identity, including roles, personas, and attributes, to an authorization?
- A. Federated Identity Management
- B. Authoritative source
- C. Authentication
- D. Access control
- E. Entitlement
Answer: E
NEW QUESTION 58
An IS department is evaluated monthly on its cost-revenue ratio user satisfaction rate, and computer downtime This is BEST zed as an application of.
- A. risk framework
- B. control self-assessment (CSA)
- C. value chain analysis
- D. balanced scorecard
Answer: D
NEW QUESTION 59
Which of the following cloud deployment models would BEST meet the needs of a startup software development organization with limited initial capital?
- A. Public
- B. Community
- C. Hybrid
- D. Private
Answer: A
NEW QUESTION 60
What factors should you understand about the data specifically due to legal, regulatory, and jurisdictional factors?
- A. The actualsize of the data and the storage format
- B. The implications of storing complex information on simple storage systems
- C. Thephysical location of the data and how it is accessed
- D. The language of the data and how it affects the user
- E. The fragmentation and encryption algorithms employed
Answer: B
NEW QUESTION 61
ENISA: A reason for risk concerns of a cloud provider being acquired is:
- A. Mass layoffs may occur
- B. Provider may change physical location
- C. Resource isolation may fail
- D. Non-binding agreements put at risk
- E. Arbitrary contract termination by acquiring company
Answer: D
NEW QUESTION 62
Sending data to a provider's storage over an API is likely as much morereliable and secure than setting up your own SFTP server on a VM in the same provider
- A. False
- B. True
Answer: B
NEW QUESTION 63
An IS auditor is a member of an application development team that is selecting software. Which of the following would impair the auditor's independence?
- A. verifying the weighting of each selection criteria
- B. Approving the vendor selection methodology
- C. Witnessing the vendor selection process
- D. Reviewing the request for proposal (RFP)
Answer: B
NEW QUESTION 64
Segregation of duties would be compromised if:
- A. application programmers moved programs into production.
- B. application programmers accessed test data.
- C. database administrators (DBAs) modified the structure of user tables.
- D. operations staff modified batch schedules.
Answer: B
NEW QUESTION 65
Use elastic servers when possible and move workloads to new instances.
- A. False
- B. True
Answer: B
NEW QUESTION 66
Which term is used to describe the use of tools to selectively degrade portions of the cloud to continuously test business continuity?
- A. PlannedOutages
- B. Chaos Engineering
- C. Resiliency Planning
- D. Expected Engineering
- E. Organized Downtime
Answer: B
NEW QUESTION 67
When deploying Security as a Service in a highly regulated industry or environment, what should bothparties agree on in advance and include in the SLA?
- A. The cost per incident for security breaches of regulated information.
- B. The metrics defining the service level required to achieve regulatory objectives.
- C. The type of security software which meets regulations and the number of licenses that will be needed.
- D. The regulations that are pertinent to the contract and how to circumvent them.
- E. The duration of time that a security violation can occur before the client begins assessing regulatory fines.
Answer: B
NEW QUESTION 68
......
Pass Your CCAK Exam Easily - Real CCAK Practice Dump Updated Dec 04, 2021: https://www.actualtorrent.com/CCAK-questions-answers.html
2021 Realistic Verified Free ISACA CCAK Exam Questions : https://drive.google.com/open?id=1_5m6ej-6FICc3sMtoGZb6_KtcRpkTfRY