Get Isaca CCAK Exam Practice Questions - Real and Updated

Answer : B

A double blind penetration test is a type of pen test where the hacker has no prior knowledge of the target's defenses, assets, or channels, and the target's security team is not notified in advance of the scope of the audit and the test vectors. This mode simulates a real-world attack scenario, where both the attacker and the defender have to rely on their skills and resources to achieve their objectives.A double blind penetration test can help evaluate the effectiveness of the target's security posture, detection and response capabilities, and incident management procedures12.

What is Penetration Testing | Step-By-Step Process & Methods | Imperva

7 Types of Penetration Testing: Guide to Pentest Methods & Types

Answer : B

From a compliance perspective, reviewing logs is crucial when evaluating the effectiveness of Infrastructure as Code (IaC) deployments. Logs provide a detailed record of events, changes, and operations that have occurred within the IaC environment. They are essential for tracking the deployment process, identifying issues, and verifying that the infrastructure has been configured and is operating as intended. Logs can also be used to ensure that the IaC deployments comply with security policies and regulatory requirements, making them a vital artifact for assessors.

Reference= The importance of logs in assessing IaC deployments is supported by cybersecurity best practices, which recommend the use of logs for auditable records of changes to template files and for tracking resource protection1.Additionally, ISACA's resources on securing IaC highlight the role of logs in providing transparency and enabling infrastructure blueprints to be audited and reviewed for common errors or misconfigurations2.

Answer : B

A security categorization of the information systems should be performed first to properly implement the NIST SP 800-53 r4 control framework in an organization. Security categorization is the process of determining the potential impact on organizational operations, organizational assets, individuals, other organizations, and the Nation resulting from a loss of confidentiality, integrity, or availability of an information system and the information processed, stored, or transmitted by that system. Security categorization is based on the application of FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, which defines three levels of impact: low, moderate, and high. Security categorization is the first step in the Risk Management Framework (RMF) described in NIST SP 800-37, Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. Security categorization helps to identify the security requirements for the information system and to select an initial set of baseline security controls from NIST SP 800-53 r4, Security and Privacy Controls for Federal Information Systems and Organizations.The baseline security controls can then be tailored and supplemented as needed to address specific organizational needs, risk factors, and compliance obligations12.

SP 800-53 Rev. 4, Security & Privacy Controls for Federal Info Sys ...

SP 800-37 Rev. 2, Risk Management Framework for Information ...

Answer : C

Cryptography and authentication are good candidates for continuous auditing, as they are critical aspects of cloud security that require constant monitoring and verification. Cryptography and authentication refer to the methods and techniques that ensure the confidentiality, integrity, and availability of data and communications in the cloud environment. Cryptography involves the use of encryption algorithms and keys to protect data from unauthorized access or modification. Authentication involves the use of credentials and tokens to verify the identity and access rights of users or devices. Continuous auditing can help to assess the effectiveness and compliance of cryptography and authentication controls, such as data encryption, key management, password policies, multifactor authentication, single sign-on, etc.Continuous auditing can also help to detect and alert any anomalies or issues that may compromise or affect cryptography and authentication, such as data breaches, key leakage, password cracking, unauthorized access, etc123.

Procedures (A) are not good candidates for continuous auditing, as they are not specific or measurable aspects of cloud security that can be easily automated or tested. Procedures refer to the steps or actions that are performed to achieve a certain objective or result in a specific domain or context. Procedures may vary depending on the type, nature, or complexity of the task or process involved. Continuous auditing requires a clear and consistent definition of the expected outcome or output, as well as the criteria or metrics to evaluate it.Procedures may not provide such a definition or criteria, and may require human judgment or interpretation to assess their effectiveness or compliance123.

Governance (B) is not a good candidate for continuous auditing, as it is not a specific or measurable aspect of cloud security that can be easily automated or tested. Governance refers to the framework or system that defines the roles, responsibilities, policies, standards, procedures, and practices for managing and overseeing an organization or a domain. Governance may involve multiple stakeholders, such as management, board of directors, regulators, auditors, customers, etc., who have different interests, expectations, or perspectives. Continuous auditing requires a clear and consistent definition of the expected outcome or output, as well as the criteria or metrics to evaluate it.Governance may not provide such a definition or criteria, and may require human judgment or interpretation to assess its effectiveness or compliance123.

Documentation quality (D) is not a good candidate for continuous auditing, as it is not a specific or measurable aspect of cloud security that can be easily automated or tested. Documentation quality refers to the degree to which the documents that describe or support an organization or a domain are accurate, complete, consistent, relevant, and understandable. Documentation quality may depend on various factors, such as the purpose, audience, format, style, language, structure, content, etc., of the documents involved. Continuous auditing requires a clear and consistent definition of the expected outcome or output, as well as the criteria or metrics to evaluate it.Documentation quality may not provide such a definition or criteria, and may require human judgment or interpretation to assess its effectiveness or compliance123.Reference:=

Cloud Audits: A Guide for Cloud Service Providers - Cloud Standards ...

Cloud Audits: A Guide for Cloud Service Customers - Cloud Standards ...

Cloud Auditing Knowledge: Preparing for the CCAK Certificate Exam

Answer : D

The Cloud Octagon Model was developed to support organizations' risk assessment methodology. Risk assessment is the process of identifying, analyzing, and evaluating the risks associated with a cloud computing environment. The Cloud Octagon Model provides a logical approach to holistically deal with security aspects involved in moving to the cloud by introducing eight dimensions that need to be considered: procurement, IT governance, architecture, development and engineering, service providers, risk processes, data classification, and country.The model aims to reduce risks, improve effectiveness, manageability, and security of cloud solutions12.

Cloud Octagon Model | CSA

Cloud Security Alliance Releases Cloud Octagon Model