[Oct-2021] CCAK Dumps Full Questions - Cloud Security Alliance Exam Study Guide
Exam Questions and Answers for CCAK Study Guide
NEW QUESTION 36
Which of the following would be MOST important to update once a decision has been made to outsource a critical application to a cloud service provider?
- A. IT budget
- B. Business impact analysis (BIA)
- C. Project portfolio
- D. IT resource plan
Answer: B
NEW QUESTION 37
Which of the following should be the PRIMARY concern of an IS auditor during a review of an external IT service level agreement (SLA) for computer operations?
- A. Lack of software escrow provisions
- B. Vendor has exclusive control of IT resources
- C. No employee succession plan
- D. Changes in services are not tracked
Answer: D
NEW QUESTION 38
CCM: A hypothetical company called: "Health4Sure" is located in the United States and provides cloud based services fortracking patient health. The company is compliant with HIPAA/HITECH Act among other industry standards. Health4Sure decides to assess the overall security of their cloud service against the CCM toolkit so that they will be able to present this document topotential clients.
Which of the following approach would be most suitable to assess the overall security posture of Health4Sure's cloud service?
- A. The CCM domains are not mapped to HIPAA/HITECH Act. Therefore Health4Sure should assess the security posture of their cloud service against each and every control in the CCM. This approach will allow a thorough assessment of the security posture.
- B. The CCM domain controls are mapped to HIPAA/HITECH Act and therefore Health4Sure could verify the CCM controls already covered as a result of their compliance with HIPPA/HITECH Act. They could then assess the remaining controls thoroughly. This approach saves time while being able to assess the company's overall security posture in an efficient manner.
- C. The CCM columns are mapped to HIPAA/HITECH Act and therefore Health4Sure could verify the CCM controls already covered ad a result of their compliance with HIPPA/HITECH Act. They could then assess the remaining controls. This approach will save time.
Answer: A
NEW QUESTION 39
ENISA: "VMhopping" is:
- A. Improper management of VM instances, causing customer VMs to be commingled with other customer systems.
- B. Using a compromised VM to exploit a hypervisor, used to take control of other VMs.
- C. Looping within virtualized routing systems.
- D. Lack of vulnerability management standards.
- E. Instability in VM patch management causing VM routing errors.
Answer: B
NEW QUESTION 40
Network logs from cloud providers are typically flow records, not full packet captures.
- A. True
- B. False
Answer: A
NEW QUESTION 41
Which of the following should be of GREATEST concern to an IS auditor reviewing actions taken during a forensic investigation?
- A. The investigation report does not indicate a conclusion.
- B. The handling procedures of the attacked system are not documented.
- C. An image copy of the attacked system was not taken.
- D. The proper authorities were not notified.
Answer: D
NEW QUESTION 42
Which statement best describes why it is important to know how data is being accessed?
- A. The devices used to access data have different storage formats.
- B. The devices used to access data may have differentownership characteristics.
- C. The devices used to access data use a variety of operating systems and may have different programs installed on them.
- D. The device may affect data dispersion.
- E. The devices used to access data use a variety of applications or clients and may have different security characteristics.
Answer: E
NEW QUESTION 43
Which attack surfaces, if any, does virtualization technology introduce?
- A. All of the above
- B. The hypervisor
- C. Configuration and VM sprawl issues
- D. Virtualization management components apart from the hypervisor
Answer: A
NEW QUESTION 44
How does running applications on distinct virtual networks and only connecting networksas needed help?
- A. It reduces hardware costs
- B. It enables you to configure applications around business groups
- C. It reduces the blast radius of a compromised system
- D. It locks down access and provides stronger data security
- E. It provides dynamic and granular policies with less management overhead
Answer: C
NEW QUESTION 45
Why is a service type of network typically isolated on different hardware?
- A. It manages resource pools for cloud consumers
- B. It manages the traffic between other networks
- C. It requires distinct access controls
- D. It has distinct functions from other networks
- E. It requires unique security
Answer: B
NEW QUESTION 46
How can virtual machine communications bypass network security controls?
- A. VM images can contain rootkits programmed to bypass firewalls
- B. Hypervisors depend upon multiple network interfaces
- C. VM communications may use a virtual network on the same hardware host
- D. Most network security systems do not recognize encrypted VM traffic
- E. The guest OS can invoke stealth mode
Answer: C
NEW QUESTION 47
What is true of companies considering a cloud computing business relationship?
- A. The confidentiality agreements between companies using cloud computing services is limited legally to the company, not the provider.
- B. The cloud computing companies are absolved of all data security and associated risks through contracts and data laws.
- C. The cloud computing companies own all customer data.
- D. The laws protecting customer data arebased on the cloud provider and customer location only.
- E. The companies using the cloud providers are the custodians ofthe data entrusted to them.
Answer: E
NEW QUESTION 48
How does virtualized storage help avoid data loss if a drive fails?
- A. Drives are backed up, swapped, and archived constantly
- B. Data loss is unavoidable with drive failures
- C. Full back ups weekly
- D. Multiple copies indifferent locations
- E. Incremental backups daily
Answer: D
NEW QUESTION 49
If there are gaps in network logging data,what can you do?
- A. Nothing. The cloud provider must make the information available.
- B. Ask the cloud provider to open more ports.
- C. You can instrument the technology stack with your own logging.
- D. Nothing. There are simply limitations around the data that can be logged in the cloud.
- E. Ask the cloud provider to close more ports.
Answer: C
NEW QUESTION 50
Which of the following is a perceived advantage or disadvantage of managing enterprise risk for cloud deployments?
- A. More physical control over assets and processes.
- B. None of the above.
- C. Decreased requirement for proactive management of relationship and adherence to contracts.
- D. Increased need, but reduction in costs, for managing risks accepted by the cloud provider.
- E. Greater reliance on contracts, audits, and assessments due to lack of visibility or management.
Answer: E
NEW QUESTION 51
An organization recently implemented a cloud document storage solution and removed the ability for end users to save data to their local workstation hard drives Which of the following findings should be the IS auditor's GREATEST concern?
- A. Mobile devices are not encrypted.
- B. Users have not been trained on the new system.
- C. Users are not required to sign updated acceptable
- D. The business continuity plan (BCP) was not updated.
Answer: D
NEW QUESTION 52
What is true of searching data across cloud environments?
- A. You might not have the ability oradministrative rights to search or access all hosted data.
- B. The cloud provider must conduct the search with the full administrative controls.
- C. Search and discovery time is alwaysfactored into a contract between the consumer and provider.
- D. You can easily search across your environment using any E-Discovery tool.
- E. All cloud-hosted email accounts are easily searchable.
Answer: A
NEW QUESTION 53
To understand their compliance alignments and gaps with a cloud provider, what must cloud customers rely on?
- A. Provider and consumer contracts
- B. EDiscovery tools
- C. Third-party attestations
- D. Provider run audits and reports
- E. Provider documentation
Answer: C
NEW QUESTION 54
Which of the following is the GREATEST concern associated with migrating computing resources to a cloud virtualized environment?
- A. An increase in inherent vulnerability
- B. An increase in residual risk
- C. An increase in the potential for data leakage
- D. An increase in the number of e-discovery requests
Answer: C
NEW QUESTION 55
Sending data to a provider's storage over an API is likely as much morereliable and secure than setting up your own SFTP server on a VM in the same provider
- A. True
- B. False
Answer: A
NEW QUESTION 56
......
Certificate of Cloud Auditing Knowledge Free Update With 100% Exam Passing Guarantee: https://www.freepdfdump.top/CCAK-valid-torrent.html
Real Exam Questions & Answers - ISACA CCAK Dump is Ready: https://drive.google.com/open?id=1AGKBmYg6PF1m66C3632DevXfeyZ2sals
