CCAK Exam Questions and Answers | Exam-Dumps (Page: 5)

QUESTION: 21 Exam Topic: Section 1

Which of the following is MOST important to consider when developing an effective threat model during the introduction of a new SaaS service into a customer organization’s architecture? The threat model:

recognizes the shared responsibility for risk management between the customer and the CSP.
leverages SaaS threat models developed by peer organizations.
is developed by an independent third-party with expertise in the organization’s industry sector.
considers the loss of visibility and control from transitioning to the cloud.

Answer(s): A

Reveal Solution Next Question

QUESTION: 22 Exam Topic: Section 1

While performing the audit, the auditor found that an object storage bucket containing PII could be accessed by anyone on the Internet. Given this discovery, what should be the most appropriate action for the auditor to perform?

Highlighting the gap to the audit sponsor at the sponsor’s earliest possible availability
Asking the organization’s cloud administrator to immediately close the gap by updating the configuration settings and making the object storage bucket private and hence inaccessible from the Internet
Documenting the finding in the audit report and sharing the gap with the relevant stakeholders
Informing the organization’s internal audit manager immediately about the gap

Answer(s): C

Reference:

https://www.isaca.org/resources/isaca-journal/issues/2020/volume-1/is-audit-basics-thecomponents-of-the-it-audit-report

Reveal Solution Next Question

QUESTION: 23 Exam Topic: Section 1

To qualify for CSA STAR attestation for a particular cloud system, the SOC 2 report must cover:

ISO/I?? 27001: 2013 controls.
maturity model criteria.
all Cloud Control Matrix (CCM) controls and TSPC security principles.
Cloud Control Matrix (CCM) and ISO/IEC 27001:2013 controls.

Answer(s): C

Reference:

https://downloads.cloudsecurityalliance.org/star/attestation/GuidelinesforCPAsv2.pdf (8)

Reveal Solution Next Question

QUESTION: 24 Exam Topic: Section 1

Which of the following is MOST important to consider when an organization is building a compliance program for the cloud?

The rapidly changing service portfolio and architecture of the cloud.
Cloud providers should not be part of the compliance program.
The fairly static nature of the service portfolio and architecture of the cloud.
The cloud is similar to the on-premise environment in terms of compliance.

Answer(s): A

Reveal Solution Next Question

QUESTION: 25 Exam Topic: Section 1

When developing a cloud compliance program, what is the PRIMARY reason for a cloud customer to review which cloud services will be deployed?

To determine how those services will fit within its policies and procedures
To determine the total cost of the cloud services to be deployed
To confirm which vendor will be selected based on the compliance with security requirements
To confirm if the compensating controls implemented are sufficient for the cloud

Answer(s): A

Reference:

https://www.isaca.org/credentialing/certificate-of-cloud-auditing-knowledge

Reveal Solution Next Question

ISACA CCAK Exam (page: 5) ISACA Certificate of Cloud Auditing Knowledge Updated on: 12-Feb-2026

QUESTION: 21 Exam Topic: Section 1

QUESTION: 22 Exam Topic: Section 1

Reference:

QUESTION: 23 Exam Topic: Section 1

Reference:

QUESTION: 24 Exam Topic: Section 1

QUESTION: 25 Exam Topic: Section 1

Reference:

ISACA CCAK Exam (page: 5)
ISACA Certificate of Cloud Auditing Knowledge
Updated on: 12-Feb-2026