CCAK

Some of the reasons to integrate security in the early stages of the systems development life cycle include (select all that apply):

What are example benefits of including dynamic application security testing (DAST) in software security testing? (Select all that apply.)

Which of the following is not a primary function of a version control repository? (Select the BEST answer.)

What technology should be considered and assessed to manage the extensive credentials typically embedded and used by CI/CD pipelines?

5. On what elements should the auditor rely for auditability and accountability in a DevSecOps approach? (Select all that apply.)

In continuous integration pipelines, pull requests refer to what type of operations?

Which of the following is not primarily a security-specific type of test?

Which of the following is a key concept for auditors regarding testing in a continuous integration/continuous deployment (CI/CD) pipeline?

Which of the following is true when assessing a function as a service (serverless) functions in a public cloud provider environment?

A technical control is one part of a broader set of mitigations. An organization should consider how a specific control mitigates the risk. Which of the following describes another consideration that will help determine whether a specific control is needed?

1. Which of these elements are part of cloud policy?

1. When evaluating a cloud provider’s maturity and ability to execute, the customer should consider which of the following?

1. For cloud trust and transparency, what are some key considerations that the cloud customer needs to be aware of? (two)

1. Considering that cloud security is based on the shared responsibility model, select the controls that are usually the responsibility of the cloud consumer:

In SaaS, which risk has shared responsibility by both the cloud customer and CSP?

1. Which of these parties should be included in a CSP compliance scope?

1. When reviewing proposed policies, what is the remit of a policy approval board?

When obtaining assurances from providers, what differentiates cloud services providers from non-cloud providers?

Which of the following uses public key infrastructure to provide trust in cloud computing?

Which of the following describes valid methods for measuring cloud trust?

1. Experiential measurement and the CSA STAR initiative
2. Internal measurement and reported incidents
3. CSA STAR initiative and customer internal review
4. Customer internal review and internal measurement

Risk assessments performed on a business-critical software-as-a-service (SaaS) solution have identified inefficient access controls with weak authentication and authorization methods. Access control exploitations are expected to occur once every three months. According to the ENISA/risk treatment domain, which of the following options would the auditor recommend?

1. Ask the SaaS cloud service provider to fix the control weakness. 
2. Develop and implement solutions. 
3. Restrict the use of SaaS.
4. Identify alternatives to manage the risk. 

What is the objective of a cloud compliance program? (Select the correct answer.)

   A. To ensure all aspects related to the cloud adoption in an organization adhere to the requirements for which it is accountable.

   B. To determine the risk appetite and risk tolerance of the organization.

   C. To drive decisions for the measures put in place by the organization.

   D. To validate the organization is aligned with their competition and can remain competitive.

2. What is the difference between legacy and cloud compliance programs?

   A. There is no difference.

   B. Cloud compliance relies on systems with defined boundaries.

   C. Legacy compliance programs have complete control and responsibility for the infrastructure and all requirements that keep it secure.

   D. Cloud compliance programs rely on third parties for the delivery of technology with complete control and influence over the quality, availability and reliability of the service being provided.

3. What is a cloud governance and strategy audit?

   A. An audit that evaluates the framework of the organization for defining requirements, performing risk assessments, monitoring controls, reporting adherence and developing a strategic plan for the cloud.

   B. An audit that covers logging, monitoring, scanning and alerting of a system, account or environment, and can be achieved using real-time automated scripts or manual testing.

   C. A review of all user and service accounts, and permission within your information system boundaries, including on-premises systems, cloud environments and other applications.

   D. An audit performed against technical, administrative and/or physical controls as defined in the organization policies and procedures.

4. Select ALL the correct statements concerning legal and regulatory requirements, standards and security frameworks in the cloud:

   A. They serve to guide the cloud controls program of an organization.

   B. They should be monitored to ensure that changes in the requirements are promptly reflected in the cloud compliance program.

   C. They are important for when designing the cloud compliance program, but not so relevant during the execution phase.

   D. The majority of the laws and regulations are cloud specific.

5. In a DevOps IT environment, the following team is responsible for mitigating and/or managing risk on a daily basis:

   A. Internal Audit

   B. Risk Management

   C. DevOps

   D. Quality Assurance

6. Due to the shared responsibility model, control operationalization in the cloud (select all that apply):

   A. Is different from what it is in traditional on-premises IT environments.

   B. Involves a combined effort from multiple parties.

   C. Is simpler than control operationalization in traditional on-premises IT environments.

   D. Should replicate the control environment of traditional on-premises IT environments.

7. What is a common way to come up with metrics that support a decision process?

8. What is FedRAMP?

Which Domain is AIS?

What domain is AAC?

What Domain is BCR?

Which Domain is CCC?

Which Domain is DSI?

Which domain is DCS

Which domain is EKM

HRS?

IAM

IVS

GRM?