Question 1

Which of the following would be a logical starting point for an auditor who has been engaged to assess the security of an organization’s DevOps pipeline?

Options :

A : Verify the inclusion of security gates in the pipeline.

B : Conduct an architectural assessment.

C : Review the CI/CD pipeline audit logs.

D : Verify separation of development and production pipelines.

Answer: C

Question 2

What data center and physical security measures should a cloud customer consider when assessing a cloud service provider?

Options :

A : Assess use of monitoring systems to control ingress and egress points of entry to the data center

B : Implement physical security perimeters to safeguard personnel, data and information systems.

C : Conduct a due diligence to verify the cloud provider applies adequate physical security measures.

D : Review internal policies and procedures for relocation of hardware and software to an offsite location

Answer: C

Question 3

Which of the following cloud models prohibits penetration testing?

Options :

A : Hybrid Cloud

B : Private Cloud

C : Public Cloud

D : Community Cloud

Answer: B

Question 4

Supply chain agreements between a cloud service provider and cloud customers should, at a minimum, include:

Options :

A : Organization chart of the CSP

B : Policies and procedures of the cloud customer

C : Audits, assessments and independent verification of compliance certifications with agreement terms

D : Regulatory guidelines impacting the cloud customer

Answer: C

Question 5

What is below the waterline in the context of cloud operationalization?

Options :

A : The controls operated by the cloud access security broker (CASB)

B : The controls operated by both

C : The controls operated by the customer

D : The controls operated by the cloud service provider

Answer: D

Free CCAK Mock Exam – Practice Online Confidently

Buying Options: