Online Access Free CCAK Practice Test

An auditor is reviewing an organization's virtual machines (VMs) hosted in the cloud. The organization utilizes a configuration management (CM) tool to enforce password policies on its VMs. Which of the following is the BEST approach for the auditor to use to review the operating effectiveness of the password requirement?

• A.The auditor should not rely on the CM tool and its settings, and for thoroughness should review the password configuration on the set of sample VMs.
• B.As it is an automated environment, reviewing the relevant configuration settings on the CM tool would be sufficient.
• C.Review the incident records for any incidents relating to brute force attacks or password compromise in the last 12 months and investigate whether the root cause of the incidents was due to in appropriate password policy configured on the VMs.
• D.Review the relevant configuration settings on the CM tool and check whether the CM tool agents are operating effectively on the sample VMs.

Which objective is MOST appropriate to measure the effectiveness of password policy?

• A.The number of related incidents decreases.
• B.Newly created account credentials satisfy requirements.
• C.Attempts to log with weak credentials increases.
• D.The number of related incidents increases.

Which of the following types of risk is associated specifically with the use of multi-cloud environments in an organization?

• A.Risk of unauthorized access to customer and business data
• B.Risk of reduced visibility and control
• C.Risk of supply chain visibility and validation
• D.Risk of service reliability and uptime

Why should the results of third-party audits and certification be relied on when analyzing and assessing the cybersecurity risks in the cloud?

• A.To contrast the risk generated by the loss of control
• B.To establish an audit mindset within the organization
• C.To establish an accountability culture within the organization
• D.To reinforce the role of the internal audit function

Which of the following is an example of availability technical impact?

• A.An administrator inadvertently clicked on phish bait, exposing the company to a ransomware attack.
• B.A hacker using a stolen administrator identity alters the discount percentage in the product database
• C.A distributed denial of service (DDoS) attack renders the customer's cloud inaccessible for 24 hours.
• D.The cloud provider reports a breach of customer personal data from an unsecured server.