Nest 0 Cart
Nest Account
Popular Exams
All Categories...
Nest
Nest 0
Contact
Log In / Sign Up
Copyright 2024 © store. All rights reserved.
Home ISACA CCAK

ISACA CCAK Exam Practice Questions (P. 1)

  • Full Access (325 questions)
  • Six months of Premium Access
  • Access to one million comments
  • Seamless ChatGPT Integration
  • Ability to download PDF files
  • Anki Flashcard files for revision
  • No Captcha & No AdSense
  • Advanced Exam Configuration
Get Contributor Access
Question #1
Changes to which of the following will MOST likely influence the expansion or reduction of controls required to remediate the risk arising from changes to an organization’s SaaS vendor?
  1. A
    Risk exceptions policy
  2. B
    Contractual requirements
  3. C
    Risk appetite
  4. D
    Board oversight

Correct Answer: B ?️

Question #2
A CSP contracts for a penetration test to be conducted on its infrastructures. The auditor engages the target with no prior knowledge of its defenses, assets, or channels. The CSP’s security operation center is not notified in advance of the scope of the audit and the test vectors. Which mode is selected by the CSP?
  1. A
    Double gray box
  2. B
    Tandem
  3. C
    Reversal
  4. D
    Double blind

Correct Answer:
D

Question #3
Due to cloud audit team resource constraints, an audit plan as initially approved cannot be completed. Assuming that the situation is communicated in the cloud audit report, which course of action is MOST relevant?
  1. A
    Focusing on auditing high-risk areas
  2. B
    Testing the adequacy of cloud controls design
  3. C
    Relying on management testing of cloud controls
  4. D
    Testing the operational effectiveness of cloud controls

Correct Answer:
A

Question #4
In an organization, how are policy violations MOST likely to occur?
  1. A
    By accident
  2. B
    Deliberately by the ISP
  3. C
    Deliberately
  4. D
    Deliberately by the cloud provider

Correct Answer:
A

Question #5
Which of the following is the BEST tool to perform cloud security control audits?
  1. A
    General Data Protection Regulation (GDPR)
  2. B
    ISO 27001
  3. C
    Federal Information Processing Standard (FIPS) 140-2
  4. D
    CSA Cloud Control Matrix (CCM)

Correct Answer:
D

Question #6
Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, ports, and by compensating controls. Which of the following controls BEST matches this control description?
  1. A
    Network Security
  2. B
    Change Detection
  3. C
    Virtual Instance and OS Hardening
  4. D
    Network Vulnerability Management

Correct Answer:
A

Question #7
After finding a vulnerability in an internet-facing server of an organization, a cybersecurity criminal is able to access an encrypted file system and successfully manages to overwrite part of some files with random data. In reference to the Top Threats Analysis methodology, how would you categorize the technical impact of this incident?
  1. A
    As an integrity breach
  2. B
    As control breach
  3. C
    As an availability breach
  4. D
    As a confidentiality breach

Correct Answer: A ?️

Question #8
Organizations maintain mappings between the different control frameworks they adopt to:
  1. A
    help identify controls with common assessment status.
  2. B
    avoid duplication of work when assessing compliance.
  3. C
    help identify controls with different assessment status.
  4. D
    start a compliance assessment using latest assessment.

Correct Answer: B ?️

Question #9
SAST testing is performed by:
  1. A
    scanning the application source code.
  2. B
    scanning the application interface.
  3. C
    scanning all infrastructure components.
  4. D
    performing manual actions to gain control of the application.

Correct Answer:
A

Question #10
When a client’s business process changes, the CSP SLA should:
  1. A
    be reviewed, but the SLA cannot be updated.
  2. B
    not be reviewed, but the cloud contract should be cancelled immediately.
  3. C
    not be reviewed as the SLA cannot be updated.
  4. D
    be reviewed and updated if required.

Correct Answer:
D

Next Questions

All Pages