Practice CCAK Exam Online

Question 1

In which control should a cloud service provider, upon request, inform customers of compliance impact and risk, especially if customer data is used as part of the services?

A : Service Provider control

B : Impact and Risk control

C : Data Inventory control

D : Compliance control

Answer: A

Question 2

"Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, ports, and by compensating controls." Which of the following types of controls BEST matches this control description?

A : Network Security

B : Change Detection

C : Virtual Instance and OS Hardening

D : Network Vulnerability Management

Answer: A

Question 3

What should be an organization’s control audit schedule of a cloud service provider’s business continuity plan and operational resilience policy?

A : Annual

B : Quarterly

C : Monthly

D : Semi-annual

Answer: A

Question 4

Which of the following is a cloud-native solution designed to counter threats that do not exist within the enterprise?

A : Policy based access control

B : Attribute based access control

C : Rule based access control

D : Role based access control

Answer: A

Question 5

When auditing a Software as a Service (SaaS) cloud service provider, which of the following observations would be of GREATEST concern to the auditor?

A : The provider was in breach of a couple of service level agreements (SLAs) in the past year.

B : The audit trails are available for 3-4 days and are typically overwritten as soon as the disk reaches its capacity.

C : Only an executive summary of the annual penetration testing report was made available by the provider for the review. It had details about the criticality of the vulnerabilities and the plan and timeline to mitigate them, but the detailed penetration testing report was not made available.

D : In case of a breach in the provider’s environment involving the organization-s data, the provider sends the breach notification to the organization-s breach notification shared mailbox that is documented in the service agreement.

Answer: B

Name:	Certificate of Cloud Auditing Knowledge
Exam Code:	CCAK
Certification:	CSA Cloud Security
Vendor:	Cloud Security Alliance
Total Questions:	299
Last Updated:	Sep 30, 2026

Cloud Security Alliance CCAK Answers