Free CCAK Questions for ISACA Certificate of Cloud Auditing Knowledge CCAK Exam as PDF & Practice Test Engine

Exam Code/Number: CCAK
Exam Name/Title: Certificate of Cloud Auditing Knowledge
Certification Provider: ISACA
Corresponding Certification: Cloud Security Alliance

Exam Questions: 207
Updated On: Oct 06, 2026

Question #1

Which of the following MOST enhances the internal stakeholder decision-making process for the remediation of risks identified from an organization's cloud compliance program?

A. Reporting emerging threats to senior stakeholders

B. Automating risk monitoring and reporting processes

C. Monitoring key risk indicators (KRIs) for multi-cloud environments

D. Establishing ownership and accountability

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #2

Which of the following are independent assessment organizations that verify cloud providers' security implementations and provide the overall risk posture of a cloud environment for a FedRAMP security authorization decision?

A. FedRAMP Program Management Office (FedRAMP PMO)

B. FedRAMP Joint Authorization Boards (JABs)

C. American Association of Laboratory Accreditation (A2LA)

D. Third-party Assessment Organizations (3PAOs)

Discussion 0

Correct Answer: D Vote an answer

Question #3

An auditor identifies that a cloud service provider received multiple customer inquiries and requests for proposal (RFPs) during the last month. Which of the following What should be the BEST recommendation to reduce the provider's burden?

A. The provider can share all security reports with customers to streamline the process

B. The provider can direct all customer inquiries to the information in the CSA STAR registry.

C. The provider can answer each customer individually.

D. The provider can schedule a call with each customer.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #4

Which of the following is the PRIMARY area for an auditor to examine in order to understand the criticality of the cloud services in an organization, along with their dependencies and risks?

A. Contractual documents of the cloud service provider

B. Turtle diagram

C. Data security process flow

D. Heat maps

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #5

Which of the following aspects of risk management involves identifying the potential reputational and financial harm when an incident occurs?

A. Mitigation

B. Likelihood

C. Impact analysis

D. Residual risk

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #6

Which of the following approaches encompasses social engineering of staff, bypassing of physical access controls, and penetration testing?

A. Red team

B. White box

C. Gray box

D. Blue team

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #7

Which of the following is an example of availability technical impact?

A. A distributed denial of service (DDoS) attack renders the customer's cloud inaccessible for 24 hours.

B. An administrator inadvertently clicked on phish bait, exposing the company to a ransomware attack.

C. A hacker using a stolen administrator identity alters the discount percentage in the product database

D. The cloud provider reports a breach of customer personal data from an unsecured server.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #8

Which objective is MOST appropriate to measure the effectiveness of password policy?

A. Attempts to log with weak credentials increases.

B. The number of related incidents increases.

C. The number of related incidents decreases.

D. Newly created account credentials satisfy requirements.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #9

Which of the following is a cloud-specific security standard?

A. 15022301

B. 15014001

C. 15027701

D. 15027017

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #10

A large healthcare provider within the United States is seeking a cloud service provider offering Software as a Service (SaaS) for core business systems. The selected provider MUST comply with which of the following regulations?

A. GDPR

B. GLBA

C. FISMA

D. HIPAA

Discussion 0

Correct Answer: D Vote an answer

Question #11

The PRIMARY purpose of Open Certification Framework (OCF) for the CSA STAR program is to:

A. provide global, accredited, and trusted certification of the cloud service provider.

B. ensure understanding of true risk and perceived risk by the cloud service users.

C. enable the cloud service provider to prioritize resources to meet its own requirements.

D. facilitate an effective relationship between the cloud service provider and cloud client.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Free CCAK Questions for ISACA Certificate of Cloud Auditing Knowledge CCAK Exam as PDF & Practice Test Engine

Download Free ISACA CCAK Demo