CCAK 無料問題集「ISACA Certificate of Cloud Auditing Knowledge」

（A）at the end of the development cycle.

（B）at the beginning of the development cycle.

（C）in all development steps.

（D）after go-live.

（A）GDPR

（B）DPA

（C）DPIA

（D）HIPAA

（A）client organization has a clear understanding of the provider's suppliers.

（B）suppliers are accountable for the provider's service that they are providing.

（C）client organization does not need to worry about the provider's suppliers, as this is the provider's responsibility.

（D）client organization and provider are both responsible for the provider's suppliers.

（A）While the breach was reported in a timely manner to the CEO, the CFO and CISO blamed each other in public, resulting in a loss of public confidence that led the board to replace all three.

（B）The cloud provider fails to report a breach of customer personal data from an unsecured server, resulting in GDPR fines of 10 million euros.

（C）A hacker using a stolen administrator identity brings down the Software as a Service (SaaS) sales and marketing systems, resulting in the inability to process customer orders or manage customer relationships.

（D）A distributed denial of service (DDoS) attack renders the customer's cloud inaccessible for 24 hours, resulting in millions in lost sales.

（A）Database backup and replication guidelines

（B）System backup documentation

（C）Incident management documentation

（D）Operational manuals

（A）Cryptography and authentication

（B）Procedures

（C）Documentation quality

（D）Governance

（A）Statements made by management in response to specific inquiries

（B）A project management technique to demonstrate management's involvement in key project stages

（C）A mechanism to represent organizational structure

（D）A person or group of persons representing executive management during audits

（A）Monthly

（B）Annually

（C）Quarterly

（D）Biannually

（A）Results from automated testing

（B）Source code within build scripts

（C）Output from threat modeling exercises

（D）Service level agreements (SLAs)

（A）As a control breach

（B）As an availability breach

（C）As an integrity breach

（D）As a confidentiality breach

（A）Perform a cloud vendor assessment every time there is a change to data flows.

（B）Manage compliance obligations through a structured risk management process.

（C）Develop risk metrics to show how the organization is meeting the obligations.

（D）Communicate the organization's risk appetite across cloud service providers.

（A）Data input and output integrity routines

（B）Assessment of contractual and regulatory requirements for customer access

（C）Testing in accordance with leading industry standards such as OWASP

（D）Establishment of policies and procedures across multiple system interfaces, jurisdictions, and business functions to prevent improper disclosure, alteration, or destruction

（A）15014001

（B）15027701

（C）15027017

（D）15022301

（A）Who owns the cloud services strategy?

（B）Who owns the cloud strategy?

（C）Who owns the cloud portfolio strategy?

（D）Who owns the cloud governance strategy?