CCAK 試験問題を無料オンラインアクセス

Which of the following helps an organization to identify control gaps and shortcomings in the context of cloud computing?

• A.Walk-through peer review
• B.Periodic documentation review
• C.Monitoring effectiveness
• D.User security awareness training

A cloud service provider utilizes services of other service providers for its cloud service. Which of the following is the BEST approach for the auditor while performing the audit for the cloud service?

• A.As the relationship between the cloud service provider and its service providers is governed by separate contracts between them, there is no need for the auditor to review the services
• B.As the contract for the cloud service is between the cloud customer and the cloud service provider, there is no need for the auditor to review the services provided by the service providers.
• C.The auditor should review the relationship between the cloud service provider and its service provider to help direct and estimate the level of effort and analysis the auditor should apply.
• D.The auditor should review the service providers' security controls even more strictly, as they are further separated from the cloud customer.

An auditor is reviewing an organization's virtual machines (VMs) hosted in the cloud. The organization utilizes a configuration management (CM) tool to enforce password policies on its VMs. Which of the following is the BEST approach for the auditor to use to review the operating effectiveness of the password requirement?

• A.As it is an automated environment, reviewing the relevant configuration settings on the CM tool would be sufficient.
• B.The auditor should not rely on the CM tool and its settings, and for thoroughness should review the password configuration on the set of sample VMs.
• C.Review the incident records for any incidents relating to brute force attacks or password compromise in the last 12 months and investigate whether the root cause of the incidents was due to in appropriate password policy configured on the VMs.
• D.Review the relevant configuration settings on the CM tool and check whether the CM tool agents are operating effectively on the sample VMs.

Which of the following aspects of risk management involves identifying the potential reputational and financial harm when an incident occurs?

• A.Mitigation
• B.Residual risk
• C.Impact analysis
• D.Likelihood

The MOST important factor to consider when implementing cloud-related controls is the:

• A.risk ownership
• B.risk reporting.
• C.shared responsibility model.
• D.effectiveness of the controls.