ISACA CCAK Certificate of Cloud Auditing Knowledge Online Training

Question #41

What legal documents should be provided to the auditors in relation to risk management?

A . Enterprise cloud strategy and policy
B . Contracts and service level agreements (SLAs) of cloud service providers
C . Policies and procedures established around third-party risk assessments
D . Inventory of third-party attestation reports

Question #42

In relation to testing business continuity management and operational resilience, an auditor should review which of the following database documentation?

A . Database backup and replication guidelines
B . System backup documentation
C . Incident management documentation
D . Operational manuals

Reveal Solution Hide Solution

Question #43

The MOST critical concept for managing the building and testing of code in DevOps is:

A . continuous build.
B . continuous delivery.
C . continuous integration.
D . continuous deployment.

Reveal Solution Hide Solution

Question #44

What is a sign that an organization has adopted a shift-left concept of code release cycles?

A . Large entities with slower release cadences and geographically dispersed systems
B . A waterfall model to move resources through the development to release phases
C . Maturity of start-up entities with high-iteration to low-volume code commits
D . Incorporation of automation to identify and address software code problems early

Reveal Solution Hide Solution

Question #45

Which of the following can be used to determine whether access keys are stored in the source code or any other configuration files during development?

A . Static code review
B . Dynamic code review
C . Vulnerability scanning
D . Credential scanning

Reveal Solution Hide Solution

Question #46

What is an advantage of using dynamic application security testing (DAST) over static application security testing (SAST) methodology?

A . DAST is slower but thorough.
B . Unlike SAST, DAST is a black box and programming language agnostic.
C . DAST can dynamically integrate with most continuous integration and continuous delivery (CI/CD) tools.
D . DAST delivers more false positives than SAST

Reveal Solution Hide Solution

Question #47

Which of the following BEST ensures adequate restriction on the number of people who can access the pipeline production environment?

A . Separation of production and development pipelines
B . Ensuring segregation of duties in the production and development pipelines
C . Role-based access controls in the production and development pipelines
D . Periodic review of the continuous integration and continuous delivery (CI/CD) pipeline audit logs to identify any access violations

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

Role-based access controls (RBAC) are a method of restricting access to resources based on the roles of individual users within an organization. RBAC allows administrators to assign permissions to roles, rather than to specific users, and then assign users to those roles. This simplifies the management of access rights and reduces the risk of unauthorized or excessive access. RBAC is especially important for ensuring adequate restriction on the number of people who can access the pipeline production environment, which is the final stage of the continuous integration and continuous delivery (CI/CD) process where code is deployed to the end-users. Access to the production environment should be limited to only those who are responsible for deploying, monitoring, and maintaining the code, such as production engineers, release managers, or site reliability engineers. Developers, testers, or other stakeholders should not have access to the production environment, as this could compromise the security, quality, and performance of the code. RBAC can help enforce this separation of duties and responsibilities by defining different roles for different pipeline stages and granting appropriate permissions to each role. For example, developers may have permission to create, edit, and test code in the development pipeline, but not to deploy or modify code in the production pipeline.

Conversely, production engineers may have permission to deploy, monitor, and troubleshoot code in the production pipeline, but not to create or edit code in the development pipeline. RBAC can also help implement the principle of least privilege, which states that users should only have the minimum level of access required to perform their tasks. This reduces the attack surface and minimizes the potential damage in case of a breach or misuse. RBAC can be configured at different levels of granularity, such as at the organization, project, or object level, depending on the needs and complexity of the organization. RBAC can also leverage existing identity and access management (IAM) solutions, such as Azure Active Directory or AWS IAM, to integrate with cloud services and applications.

Reference: Set pipeline permissions – Azure Pipelines

Azure DevOps: Access, Roles and Permissions

Cloud Computing ― What IT Auditors Should Really Know

Question #48

The PRIMARY purpose of Open Certification Framework (OCF) for the CSA STAR program is to:

A . facilitate an effective relationship between the cloud service provider and cloud client.
B . enable the cloud service provider to prioritize resources to meet its own requirements.
C . provide global, accredited, and trusted certification of the cloud service provider.
D . ensure understanding of true risk and perceived risk by the cloud service users

Reveal Solution Hide Solution

Question #49

An auditor identifies that a cloud service provider received multiple customer inquiries and requests for proposal (RFPs) during the last month.

Which of the following What should be the BEST recommendation to reduce the provider’s burden?

A . The provider can answer each customer individually.
B . The provider can direct all customer inquiries to the information in the CSA STAR registry.
C . The provider can schedule a call with each customer.
D . The provider can share all security reports with customers to streamline the process

Reveal Solution Hide Solution

Question #50

Which of the following is the MOST important audit scope document when conducting a review of a cloud service provider?

A . Documentation criteria for the audit evidence
B . Testing procedure to be performed
C . Processes and systems to be audited
D . Updated audit work program

Reveal Solution Hide Solution