Free CCAK Exam Braindumps (page: 22)

Page 22 of 78

Which of the following would be a logical starting point for an auditor who has been engaged to assess the security of an organization’s DevOps pipeline?

  1. Verify the inclusion of security gates in the pipeline.
  2. Conduct an architectural assessment.
  3. Review the CI/CD pipeline audit logs.
  4. Verify separation of development and production pipelines.

Answer(s): C


Reference:

https://cntemngwa.medium.com/how-to-assess-and-audit-devops-security-to-improve- businessvalue-10e81a2a6fd5



Which of the following are the three MAIN phases of the cloud controls matrix (CCM) mapping methodology?

  1. Plan --> Develop --> Release
  2. Deploy --> Monitor --> Audit
  3. Initiation --> Execution --> Monitoring and Controlling
  4. Preparation --> Execution --> Peer Review and Publication

Answer(s): D


Reference:

https://docplayer.net/153476370-Methodology-for-the-mapping-of-the-cloud-controls-matrixccm.html (page 5)



A large organization with subsidiaries in multiple locations has a business requirement to organize IT systems to have identified resources reside in particular locations with organizational personnel. Which access control method will allow IT personnel to be segregated across the various locations?

  1. Role Based Access Control
  2. Attribute Based Access Control
  3. Policy Based Access Control
  4. Rule Based Access Control

Answer(s): A



Which of the following is the MOST feasible way to validate the performance of CSPs for the delivery of technology resources?

  1. Cloud compliance program
  2. Legacy IT compliance program
  3. Internal audit program
  4. Service organization controls report

Answer(s): D



Page 22 of 78



Post your Comments and Discuss ISACA CCAK exam with other Community members:

ccak commented on June 08, 2023
ccak is hard
Anonymous
upvote