Question 1

When auditing a Software as a Service (SaaS) cloud service provider, which of the following observations would be of GREATEST concern to the auditor?

Options :

A : The provider was in breach of a couple of service level agreements (SLAs) in the past year.

B : The audit trails are available for 3-4 days and are typically overwritten as soon as the disk reaches its capacity.

C : Only an executive summary of the annual penetration testing report was made available by the provider for the review. It had details about the criticality of the vulnerabilities and the plan and timeline to mitigate them, but the detailed penetration testing report was not made available.

D : In case of a breach in the provider’s environment involving the organization-s data, the provider sends the breach notification to the organization-s breach notification shared mailbox that is documented in the service agreement.

Answer: B

Question 2

Which of the following BEST ensures adequate restriction on the number of people who can access the pipeline production environment?

Options :

A : Ensuring segregation of duties in the production and development pipelines

B : Role-based access controls in the production and development pipelines.

C : Separation of production and development pipelines

D : Periodic review of the Cl/CD pipeline audit logs to identify any access violations

Answer: B

Question 3

Which of the following is MOST relevant to determine whether an organization is a risk taker or is risk-averse?

Options :

A : Risk management methodology

B : Risk culture

C : Risk heat map

D : Risk appetite

Answer: D

Question 4

The Cloud Octagon Model was developed to support organizations:

Options :

A : risk assessment methodology

B : risk treatment methodology.

C : incident response methodology.

D : incident detection methodology.

Answer: A

Question 5

Which of the following is MOST important to ensure effective cloud application controls are maintained in an organization?

Options :

A : Exception reporting

B : Third-party vendor involvement

C : Application team internal review

D : Control self-assessment (CSA)

Answer: A

Smartly Prepare Exam with Free Online CCAK Practice Test

Buying Options: