Question 1

An auditor is reviewing an organization’s virtual machines (VMs) hosted in the cloud. The organization utilizes a configuration management (CM) tool to enforce password policies on its VMs. Which of the following is the BEST approach for the auditor to use to review the operating effectiveness of the password requirement?

Options :

A :

The auditor should not rely on the CM tool and its settings, and for thoroughness should review the password configuration on the set of sample VMs.

B :

Review the relevant configuration settings on the CM tool and check whether the CM tool agents are operating effectively on the sample VMs.

C :

As it is an automated environment, reviewing the relevant configuration settings on the CM tool would be sufficient.

D :

Review the incident records for any incidents relating to brute force attacks or password compromise in the last 12 months and investigate whether the root cause of the incidents was due to in appropriate password policy configured on the VMs.

Answer: B

Question 2

An auditor wants to get information about the operating effectiveness of controls addressing privacy, availability, and confidentiality of a service organization. Which of the following can BEST help to gain the required information?

Options :

A : SOC2 Type 2 report

B : ISAE 3402 report

C : SOC1 Type 1 report

D : ISO/IEC 27001 certification

Answer: A

Question 3

Which of the following is an example of integrity technical impact?

Options :

A : The cloud provider reports a breach of customer personal data from an unsecured server

B : A hacker using a stolen administrator identity alerts the discount percentage in the product database.

C : A DDoS attack renders the customer’s cloud inaccessible for 24 hours.

D : An administrator inadvertently clicked on Phish bait exposing his company to a ransomware attack.

Answer: B

Question 4

Who would be BEST suited to mitigate on a daily basis the risk related to development and operations practices in a public cloud?

Options :

A : Risk management team

B : DevOps team

C : Internal audit team

D : Cloud infrastructure team

Answer: B

Question 5

From an auditor perspective, which of the following BEST describes shadow IT?

Options :

A : An opportunity to diversify the cloud control approach

B : A weakness in the cloud compliance posture

C : A strength of disaster recovery (DR) planning

D : A risk that jeopardizes business continuity planning

Answer: D

Free CCAK Mock Exam – Practice Online Confidently

Buying Options: