Question 1

The MAIN difference between Cloud Control Matrix (CCM) and Consensus Assessment Initiative Questionnaire (CAIQ) is that:

Options :

A : CCM assesses the presence of controls, whereas CAIQ assesses overall security of a service.

B : CCM has a set of security questions, whereas CAIQ has a set of security controls.

C : CCM has 14 domains and CAIQ has 16 domains.

D : CCM provides a controls framework, whereas CAIQ provides industry-accepted ways to document which security controls exist in IaaS, PaaS, and SaaS offerings.

Answer: D

Question 2

Supply chain agreements between a cloud service provider and cloud customers should, at a minimum, include:

Options :

A : Organization chart of the CSP

B : Policies and procedures of the cloud customer

C : Audits, assessments and independent verification of compliance certifications with agreement terms

D : Regulatory guidelines impacting the cloud customer

Answer: C

Question 3

When capturing compliance objectives within an organization’s cloud policy, it is MOST important for stakeholders to:

Options :

A : take into consideration the organization’s risk appetite

B : measure the operating effectiveness of existing controls.

C : seek input from external subject matter experts.

D : follow a structured decision-making process.

Answer: A

Question 4

Which of the following is MOST important to manage risk from cloud vendors who might accidentally introduce unnecessary risk to an organization by adding new features to their solutions?

Options :

A : Deploying new features using cloud orchestration tools

B : Performing prior due diligence of the vendor

C : Establishing responsibility in the vendor contract

D : Implementing service level agreements (SLAs) around changes to baseline configurations

Answer: D

Question 5

Which of the following is the BEST way for a client to enforce a policy violation committed by a cloud service provider (CSP)?

Options :

A : The violation is agreed upon and documented

B : Nothing can be done to enforce violations as this is a cloud service.

C : The violation is agreed to verbally by the CSP.

D : Violations will be automatically enforced so no action is needed

Answer: A

Free CCAK Mock Exam – Practice Online Confidently

Buying Options: