最新的ISACA CCAK免費考試真題

問題1

Which of the following is MOST important to ensure effective cloud application controls are maintained in an organization?

A. Application team internal review

B. Control self-assessment (CSA)

C. Third-party vendor involvement

D. Exception reporting

正確答案: D

說明：（僅 Fast2test 成員可見）

問題2

A cloud service customer is looking to subscribe to a finance solution provided by a cloud service provider. The provider has clarified that the audit logs cannot be taken out of the cloud environment by the customer to its security information and event management (SIEM) solution for monitoring purposes. Which of the following should be the GREATEST concern to the auditor?

A. The provider does not maintain audit logs in their environment.

B. The customer cannot monitor its cloud subscription on its own and must rely on the provider for monitoring purposes.

C. The audit logs are overwritten every 30 days, and all past audit trail is lost.

D. The audit trails are backed up regularly, but the backup is not encrypted.

正確答案: B

說明：（僅 Fast2test 成員可見）

問題3

When applying the Top Threats Analysis methodology following an incident, what is the scope of the technical impact identification step?

A. Determine the impact on the financial, operational, compliance, and reputation of the organization.

B. Determine the impact on the physical and environmental security of the organization, excluding informational assets.

C. Determine the impact on the controls that were selected by the organization to respond to identified risks.

D. Determine the impact on confidentiality, integrity, and availability of the information system.

正確答案: D

說明：（僅 Fast2test 成員可見）

問題4

Which of the following is the MOST important audit scope document when conducting a review of a cloud service provider?

A. Updated audit work program

B. Testing procedure to be performed

C. Processes and systems to be audited

D. Documentation criteria for the audit evidence

正確答案: C

說明：（僅 Fast2test 成員可見）

問題5

Which of the following is a good candidate for continuous auditing?

A. Procedures

B. Cryptography and authentication

C. Documentation quality

D. Governance

正確答案: B

說明：（僅 Fast2test 成員可見）

問題6

The BEST method to report continuous assessment of a cloud provider's services to the Cloud Security Alliance (CSA) is through:

A. Cloud Controls Matrix (CCM) assessment by a third-party auditor on a periodic basis.

B. SOC 2 Type 2 attestation.

C. a set of dedicated application programming interfaces (APIs).

D. tools selected by the third-party auditor.

正確答案: C

說明：（僅 Fast2test 成員可見）

問題7

Which of the following is a PRIMARY benefit of using a standardized control framework?

A. It enables consultants to speed up the implementation of management systems, thus reducing costs.

B. It enables the organization to implement an effective process of control measurement.

C. It enables senior management to receive regular and detailed executive reports easily.

D. It enables auditors to assess an information system based on a well-defined set of controls.

正確答案: D

問題8

Which of the following enables auditors to conduct gap analyses of what a cloud service provider offers versus what the customer requires?

A. Using a standardized control framework

B. The experience gained over the years

C. The as-is and to-be enterprise architecture (EA

D. Understanding the customer risk profile

正確答案: A

說明：（僅 Fast2test 成員可見）

問題9

The FINAL decision to include a material finding in a cloud audit report should be made by the:

A. cloud auditor.

B. organization's chief information security officer (CISO)

C. organization's chief executive officer (CEO).

D. auditee's senior management.

正確答案: A

說明：（僅 Fast2test 成員可見）

最新的ISACA Certificate of Cloud Auditing Knowledge - CCAK免費考試真題

聯系我們

站內鏈接

最新更新