[2026] ISACA Certificate of Cloud Auditing Knowledge

문제1

In cloud computing, which KEY subject area relies on measurement results and metrics?

A. Infrastructure as a Service (IaaS) storage and network

B. Service level agreements (SLAs)

C. Platform as a Service (PaaS) development environment

D. Software as a Service (SaaS) application services

정답: B

설명: (Fast2test 회원만 볼 수 있음)

문제2

"Policies and procedures shall be established, and supporting business processes and technical measures implemented, for maintenance of several items ensuring continuity and availability of operations and support personnel." Which of the following types of controls BEST matches this control description?

A. System maintenance

B. System development maintenance

C. Operations maintenance

D. Equipment maintenance

정답: C

문제3

To support a customer's verification of the cloud service provider claims regarding its responsibilities according to the shared responsibility model, which of the following tools and techniques is appropriate?

A. Contractual agreement

B. Internal audit

C. Security assessment

D. External audit

정답: A

설명: (Fast2test 회원만 볼 수 있음)

문제4

Which of the following is the PRIMARY component to determine the success or failure of an organization's cloud compliance program?

A. Defining the metrics and indicators to monitor the implementation of the compliance program

B. Selecting the external frameworks that will be used as reference

C. Determining the risk treatment options to be used in the compliance program

D. Mapping who possesses the information and data that should drive the compliance goals

정답: D

설명: (Fast2test 회원만 볼 수 있음)

문제5

Which of the following is a category of trust in cloud computing?

A. Background-based trust

B. Transparency-based trust

C. Reputation-based trust

D. Loyalty-based trust

정답: C

설명: (Fast2test 회원만 볼 수 있음)

문제6

Which of the following is a KEY benefit of using the Cloud Controls Matrix (CCM)?

A. CCM V4 is an improved version from CCM V3.0.1.

B. CCM uses a specific control for Infrastructure as a Service (laaS).

C. CCM utilizes an ITIL framework to define the capabilities needed to manage the IT services and security services.

D. CCM maps to existing security standards, best practices, and regulations.

정답: D

설명: (Fast2test 회원만 볼 수 있음)

문제7

The PRIMARY purpose of Open Certification Framework (OCF) for the CSA STAR program is to:

A. enable the cloud service provider to prioritize resources to meet its own requirements.

B. ensure understanding of true risk and perceived risk by the cloud service users

C. provide global, accredited, and trusted certification of the cloud service provider.

D. facilitate an effective relationship between the cloud service provider and cloud client.

정답: C

설명: (Fast2test 회원만 볼 수 있음)

문제8

During an audit, it was identified that a critical application hosted in an off-premises cloud is not part of the organization's disaster recovery plan (DRP). Management stated that it is responsible for ensuring the cloud service provider has a plan that is tested annually. What should be the auditor's NEXT course of action?

A. Review the security white paper of the provider.

B. Plan an audit of the provider

C. Review the provider's audit reports.

D. Review the contract and DR capability.

정답: D

설명: (Fast2test 회원만 볼 수 있음)

문제9

Which of the following is a tool that visually depicts the gaps in an organization's security capabilities?

A. Cloud security alliance (CSA) cloud control matrix

B. Requirements traceability matrix

C. Cloud security alliance (CSA) enterprise architecture (EA)

D. Colored impact and likelihood risk matrix

정답: C

문제10

Which of the following is the BEST method to demonstrate assurance in the cloud services to multiple cloud customers?

A. Provider self-assessment and technical documents

B. External attestation and certification audit reports

C. Reputation of the service provider in the industry

D. Provider's financial stability report and market value

정답: B

설명: (Fast2test 회원만 볼 수 있음)

문제11

To qualify for CSA STAR attestation for a particular cloud system, the SOC 2 report must cover:

A. ISO/IEC 27001:2013 controls.

B. all Cloud Controls Matrix (CCM) controls and TSPC security principles.

C. Cloud Controls Matrix (CCM) and ISO/IEC 27001:2013 controls.

D. maturity model criteria.

정답: C

설명: (Fast2test 회원만 볼 수 있음)

문제12

A cloud service provider utilizes services of other service providers for its cloud service. Which of the following is the BEST approach for the auditor while performing the audit for the cloud service?

A. As the contract for the cloud service is between the cloud customer and the cloud service provider, there is no need for the auditor to review the services provided by the service providers.

B. As the relationship between the cloud service provider and its service providers is governed by separate contracts between them, there is no need for the auditor to review the services

C. The auditor should review the relationship between the cloud service provider and its service provider to help direct and estimate the level of effort and analysis the auditor should apply.

D. The auditor should review the service providers' security controls even more strictly, as they are further separated from the cloud customer.

정답: C

설명: (Fast2test 회원만 볼 수 있음)

문제13

To promote the adoption of secure cloud services across the federal government by

A. To provide agencies of the federal government a dedicated tool to certify Authority to Operate (ATO)

B. To publish a comprehensive and official framework for the secure implementation of controls for cloud security

C. To providing a standardized approach to security and risk assessment

D. To enable 3PAOs to perform independent security assessments of cloud service providers

정답: C

설명: (Fast2test 회원만 볼 수 있음)

문제14

Which of the following provides the BEST evidence that a cloud service provider's continuous integration and continuous delivery (CI/CD) development pipeline includes checks for compliance as new features are added to its Software as a Service (SaaS) applications?

A. Frequent compliance checks are performed for development environments.

B. Compliance tests are automated and integrated within the Cl tool.

C. Third-party security libraries are continuously kept up to date.

D. Developers keep credentials outside the code base and in a secure repository.

정답: B

설명: (Fast2test 회원만 볼 수 있음)

문제15

Application programming interfaces (APIs) are likely to be attacked continuously by bad actors because they:

A. are the asset with private IP addresses.

B. act as a very effective backdoor.

C. could be poorly designed.

D. are generally the most exposed part.

정답: D

설명: (Fast2test 회원만 볼 수 있음)

ISACA Certificate of Cloud Auditing Knowledge - CCAK무료 덤프문제 풀어보기

우리와 연락하기

유용한 링크

최신 업데이트