Question 1

When cloud customers are unable to satisfy their payment obligations, which type of termination is triggered by the cloud service provider?

Options :

A : Termination for the missed payment

B : Termination at the end of the term

C : Termination for convenience

D : Termination for cause

Answer: D

Question 2

Supply chain agreements between a cloud service provider and cloud customers should, at a minimum, include:

Options :

A : Organization chart of the CSP

B : Policies and procedures of the cloud customer

C : Audits, assessments and independent verification of compliance certifications with agreement terms

D : Regulatory guidelines impacting the cloud customer

Answer: C

Question 3

Which of the following is an example of availability technical impact?

Options :

A : A distributed denial of service (DDoS) attack renders the customer-s cloud inaccessible for 24 hours.

B : The cloud provider reports a breach of customer personal data from an unsecured server.

C : An administrator inadvertently clicked on phish bait, exposing the company to a ransomware attack.

D : A hacker using a stolen administrator identity alters the discount percentage in the product database

Answer: A

Question 4

When auditing a Software as a Service (SaaS) cloud service provider, which of the following observations would be of GREATEST concern to the auditor?

Options :

A : The provider was in breach of a couple of service level agreements (SLAs) in the past year.

B : The audit trails are available for 3-4 days and are typically overwritten as soon as the disk reaches its capacity.

C : Only an executive summary of the annual penetration testing report was made available by the provider for the review. It had details about the criticality of the vulnerabilities and the plan and timeline to mitigate them, but the detailed penetration testing report was not made available.

D : In case of a breach in the provider’s environment involving the organization-s data, the provider sends the breach notification to the organization-s breach notification shared mailbox that is documented in the service agreement.

Answer: B

Question 5

To ensure integration of security testing is implemented on large code sets in environments where time to completion is critical, what form of validation should an auditor expect?

Options :

A : Parallel testing

B : Full application stack unit testing

C : Regression testing

D : Functional verification

Answer: C

Free CCAK Mock Exam – Practice Online Confidently

Buying Options: