Free ISACA CCAK Exam Dumps Questions & Answers

Account design in the cloud should be driven by:

• A.  security requirements.
• B.  business continuity policies.
• C.  organizational structure.
• D.  management structure.

As Infrastructure as a Service (laaS) cloud service providers often do not allow the cloud service customers to perform on-premise audits, the BEST approach for the auditor should be to:

• A.  use other sources of available data for evaluating the customer's controls.
• B.  escalate the lack of support from the provider to the regulatory authority.
• C.  refrain from auditing the provider's security controls due to lack of cooperation.
• D.  recommend that the customer not use the services provided by the provider.

For an auditor auditing an organization's cloud resources, which of the following should be of GREATEST concern?

• A.  The organization does not perform periodic reviews or control monitoring for its cloud environment, but it has a documented audit plan and performs an audit for its cloud environment every alternate year.
• B.  The risk management team reports to the head of audit.
• C.  The organization's IT team does not include resources with cloud certifications.
• D.  The organization does not have separate policies for governing its cloud environment.

Which of the following is a direct benefit of mapping the Cloud Controls Matrix (CCM) to other international standards and regulations?

• A.  CCM mapping entitles cloud service providers to be listed as an approved supplier for tenders and government contracts.
• B.  CCM mapping entitles cloud service providers to be certified under the CSA STAR program.
• C.  CCM mapping enables cloud service providers and customers alike to streamline their own compliance and security efforts.
• D.  CCM mapping enables an uninterrupted data flow and in particular the export of personal data across different jurisdictions.

A large healthcare provider within the United States is seeking a cloud service provider offering Software as a Service (SaaS) for core business systems. The selected provider MUST comply with which of the following regulations?

• A.  HIPAA
• B.  FISMA
• C.  GLBA
• D.  GDPR