Online Access Free CCAK Exam Questions

Which of the following has been provided by the Federal Office for Information Security in Germany to support customers in selecting, controlling, and monitoring their cloud service providers?

• A.BSI IT-basic protection catalogue
• B.German IDW PS 951
• C.BSI Criteria Catalogue C5
• D.Multi-Tier Cloud Security (MTCS)

Which of the following is an example of reputational business impact?

• A.The cloud provider fails to report a breach of customer personal data from an unsecured server, resulting in GDPR fines of 10 million euros.
• B.While the breach was reported in a timely manner to the CEO, the CFO and CISO blamed each other in public, resulting in a loss of public confidence that led the board to replace all three.
• C.A hacker using a stolen administrator identity brings down the Software as a Service (SaaS) sales and marketing systems, resulting in the inability to process customer orders or manage customer relationships.
• D.A distributed denial of service (DDoS) attack renders the customer's cloud inaccessible for 24 hours, resulting in millions in lost sales.

The Cloud Computing Compliance Controls Catalogue (C5) framework is maintained by which of the following agencies?

• A.Federal Office for Information Security in Germany (BSI) / Bundesamt fur Sicherheit in der Informationstechnik (BSI)
• B.National Cybersecurity Agency of France (ANSSI) / Agency national de la securite des systems information (ANSSI)
• C.National Institute of Standards and Technology (NIST)
• D.National Security Agency (NSA)

Which of the following is the MOST significant difference between a cloud risk management program and a traditional risk management program?

• A.Virtualization of the IT landscape
• B.Risk management practices adopted by the cloud service provider
• C.Hosting sensitive information in the cloud environment
• D.Shared responsibility model

Which of the following is an example of a corrective control?

• A.All new employees having standard access rights until their manager approves privileged rights
• B.A central antivirus system installing the latest signature files before allowing a connection to the network
• C.Privileged access to critical information systems requiring a second factor of authentication using a soft token
• D.Unsuccessful access attempts being automatically logged for investigation