CCAK Practice Questions

:

The CSA STAR Certification is based on criteria outlined in the Cloud Security Alliance (CSA) Cloud

Controls Matrix (CCM) in addition to ISO/IEC 27001 implementation. The CCM is a cybersecurity

control framework for cloud computing that covers 17 domains and 197 control objectives that

address all key aspects of cloud technology. ISO/IEC 27001 is a standard for information security

management systems that specifies the requirements for establishing, implementing, maintaining,

and continually improving an information security management system within the context of the

organization. The CSA STAR Certification demonstrates that a cloud service provider conforms to the

applicable requirements of ISO/IEC 27001, has addressed issues critical to cloud security as outlined

in the CCM, and has been assessed against the STAR Capability Maturity Model for the management

of activities in CCM control areas1. The CSA STAR Certification is a third-party independent

assessment of the security of a cloud service provider and provides a high level of assurance and

trust to customers2.

Reference:

CSA STAR Certification - Azure Compliance | Microsoft Learn

STAR | CSA

Reputation-based trust is a category of trust in cloud computing that relies on the feedback, ratings,

reviews, or recommendations of other users or third parties who have used or evaluated the cloud

service provider or the cloud service. Reputation-based trust reflects the collective opinion and

experience of the cloud community regarding the quality, reliability, security, and performance of the

cloud service provider or the cloud service. Reputation-based trust can help potential customers to

make informed decisions about choosing a cloud service provider or a cloud service based on the

reputation score or ranking of the provider or the service. Reputation-based trust can also motivate

cloud service providers to improve their services and maintain their reputation by meeting or

exceeding customer expectations.

Reputation-based trust is one of the most common and widely used forms of trust in cloud

computing, as it is easy to access and understand. However, reputation-based trust also has some

limitations and challenges, such as:

The accuracy and validity of the reputation data may depend on the source, method, and frequency

of data collection and aggregation. For example, some reputation data may be outdated, incomplete,

biased, manipulated, or falsified by malicious actors or competitors.

The interpretation and comparison of the reputation data may vary depending on the context,

criteria, and p

of the customers. For example, some customers may value different aspects

of the cloud service more than others, such as security, availability, cost, or functionality.

The trustworthiness and accountability of the reputation system itself may be questionable. For

example, some reputation systems may lack transparency, consistency, or standardization in their

design, implementation, or operation.

Therefore, reputation-based trust should not be the only factor for trusting a cloud service provider

or a cloud service. Customers should also consider other forms of trust in cloud computing, such as

evidence-based trust, policy-based trust, or certification-based trust

According to the ISACA Cloud Auditing Knowledge Certificate Study Guide, the auditor should review

the relationship between the cloud service provider and its service provider to help direct and

estimate the level of effort and analysis the auditor should apply1. The auditor should understand

the nature and scope of the services provided by the service provider, the contractual obligations and

service level agreements, the security and compliance requirements, and the monitoring and

reporting mechanisms. The auditor should also assess the risks and controls associated with the

service provider, and determine if additional audit procedures are needed to obtain sufficient

assurance.

The other options are not the best approach for the auditor. Option A is too strict and might not be

feasible or necessary, depending on the type and level of services provided by the service provider.

Option C is too lax and might overlook significant risks and gaps in the cloud service. Option D is too

narrow and might ignore the impact of the service provider on the cloud customer’s business

context. Reference:

ISACA Cloud Auditing Knowledge Certificate Study Guide, page 13-14.

The three main phases of the Cloud Controls Matrix (CCM) mapping methodology are preparation,

execution, and peer review and publication. The CCM mapping methodology is a process to map the

CCM controls to other standards, regulations, or frameworks that are relevant for cloud security. The

mapping helps to identify the commonalities and differences between the CCM and the other

standards, regulations, or frameworks, and to provide guidance for cloud service providers and

customers on how to achieve compliance with multiple requirements using the CCM. The mapping

methodology consists of the following phases1:

Preparation: This phase involves defining the scope, objectives, and deliverables of the mapping

project, as well as identifying the stakeholders, resources, and tools needed. This phase also includes

conducting a preliminary analysis of the CCM and the other standard, regulation, or framework to be

mapped, and establishing the mapping criteria and rules.

Execution: This phase involves performing the actual mapping of the CCM controls to the other

standard, regulation, or framework using a spreadsheet template. This phase also includes

documenting the mapping results, providing explanations and justifications for each mapping

decision, and resolving any issues or conflicts that may arise during the mapping process.

Peer Review and Publication: This phase involves validating and verifying the quality and accuracy of

the mapping results by conducting a peer review with subject matter experts from both the CCM

working group and the other standard, regulation, or framework organization. This phase also

includes finalizing and publishing the mapping document as a CSA artifact, and communicating and

promoting the mapping to the relevant audiences.

Reference := Methodology for the Mapping of the Cloud Controls Matrix1

A dot release of the Cloud Controls Matrix (CCM) indicates a technical change (revision, addition, or

deletion) of a number of controls that is smaller than 10% compared to the previous full release. A

dot release is a minor update to the CCM that reflects the feedback from the cloud security

community and the changes in the cloud technology landscape. A dot release does not change the

domain structure or the overall scope of the CCM, but rather improves the clarity, accuracy, and

relevance of the existing controls. A dot release is denoted by a decimal number after the major

version number, such as CCM v4.1 or CCM v4.2. The current version of the CCM is v4.0, which was

released in October 20211.

The other options are incorrect because:

A . a revision of the CCM domain structure: A revision of the CCM domain structure is a major change

that affects the organization and categorization of the controls into different domains. A revision of

the CCM domain structure requires a full release, not a dot release, and is denoted by an integer

number, such as CCM v3 or CCM v42.

C . the introduction of new control frameworks mapped to previously published CCM controls: The

introduction of new control frameworks mapped to previously published CCM controls is an

additional feature that enhances the usability and applicability of the CCM. The introduction of new

control frameworks mapped to previously published CCM controls does not require a dot release or

a full release, but rather an update to the mapping table that shows the relationship between the

CCM controls and other industry-accepted security standards, regulations, and frameworks3.

D . technical change (revision, addition, or deletion) of a number of controls that is greater than 10%

compared to the previous full release: A technical change (revision, addition, or deletion) of a

number of controls that is greater than 10% compared to the previous full release is a significant

change that affects the content and scope of the CCM. A technical change (revision, addition, or

deletion) of a number of controls that is greater than 10% compared to the previous full release

requires a full release, not a dot release, and is denoted by an integer number, such as CCM v3 or

CCM v42.

Reference:

Cloud Controls Matrix (CCM) - CSA

The CSA Cloud Controls Matrix (CCM) V4: Raising the cloud security bar

Cloud Security Alliance Releases New Cloud Controls Matrix Auditing Guidelines

APIs are likely to be attacked continuously by bad actors because they are generally the most

exposed part of an application or system. APIs serve as the interface between different components

or services, and often expose sensitive data or functionality to the outside world. APIs can be

accessed by anyone with an Internet connection, and can be easily discovered by scanning or

crawling techniques. Therefore, APIs are a prime target for attackers who want to exploit

vulnerabilities, steal data, or disrupt services.

Reference:

ISACA, Certificate of Cloud Auditing Knowledge (CCAK) Study Guide, 2021, p. 88-89.

OWASP, The Ten Most Critical API Security Risks - OWASP Foundation, 2019, p. 4-5

Database backup and replication guidelines are essential for ensuring the availability and integrity of

data in the event of a disruption or disaster. They describe how the data is backed up, stored,

restored, and synchronized across different locations and platforms. An auditor should review these

guidelines to verify that they are aligned with the business continuity objectives, policies, and

procedures of the organization and the cloud service provider. The auditor should also check that the

backup and replication processes are tested regularly and that the results are documented and

reported. Reference:

ISACA, Certificate of Cloud Auditing Knowledge (CCAK) Study Guide, 2021, p. 96

Cloud Security Alliance (CSA), Cloud Controls Matrix (CCM) v4.0, 2021, BCR-01: Business Continuity

Planning/Resilience

Supply chain agreements between a cloud service provider and cloud customers should, at a

minimum, include audits, assessments, and independent verification of compliance certifications

with agreement terms. This is because cloud services involve multiple parties in the supply chain,

such as cloud providers, sub-providers, brokers, carriers, and auditors. Each party may have different

roles and responsibilities in delivering the cloud services and ensuring their quality, security, and

compliance. Therefore, it is important for the cloud customers to have visibility and assurance of the

performance and compliance of the cloud providers and their sub-providers. Audits, assessments,

and independent verification of compliance certifications are methods to evaluate the effectiveness

of the controls and processes implemented by the cloud providers and their sub-providers to meet

the agreement terms. These methods can help the cloud customers to identify any gaps or risks in

the supply chain and to take corrective actions if needed. This is part of the Cloud Control Matrix

(CCM) domain COM-04: Audit Assurance & Compliance, which states that "The organization should

have a policy and procedures to conduct audits and assessments of cloud services and data to verify

compliance with applicable regulatory frameworks, contractual obligations, and industry

standards."12 Reference := CCAK Study Guide, Chapter 3: Cloud Compliance Program, page 551;

Practical Guide to Cloud Service Agreements Version 2.02

Establishing ownership and accountability most enhances the internal stakeholder decision-making

process for the remediation of risks identified from an organization’s cloud compliance program.

Cloud compliance refers to the principle that cloud-delivered systems must comply with the

standards required by their customers. Compliance requirements may include data protection

regulations such as HIPAA, PCI DSS, GDPR, ISO/IEC 27001, NIST, and SOX. A cloud compliance

program is a set of policies, procedures, and controls that help an organization to achieve and

maintain compliance with these requirements12.

A cloud compliance program involves identifying, assessing, prioritizing, and mitigating the risks

associated with using cloud services. To effectively manage these risks, an organization needs to

establish ownership and accountability for each risk and its remediation. Ownership and

accountability mean assigning clear roles and responsibilities to the internal stakeholders who are

involved in the cloud compliance program, such as the cloud service provider, the cloud customer,

the cloud users, the cloud auditors, and the cloud regulators. By doing so, an organization can ensure

that the internal stakeholders have the authority, resources, and incentives to make timely and

informed decisions for the remediation of risks123.

The other options are not the most effective ways to enhance the internal stakeholder decision-

making process for the remediation of risks. Option A, automating risk monitoring and reporting

processes, is a good practice for improving the efficiency and accuracy of the cloud compliance

program, but it does not address the issue of who is responsible for making decisions based on the

monitoring and reporting results. Option B, reporting emerging threats to senior stakeholders, is a

good practice for increasing the awareness and visibility of the cloud compliance program, but it

does not address the issue of how to prioritize and respond to the emerging threats. Option D,

monitoring key risk indicators (KRIs) for multi-cloud environments, is a good practice for measuring

and tracking the performance and effectiveness of the cloud compliance program, but it does not

address the issue of how to align and coordinate the decisions across different cloud

environments123. Reference :=

Cloud Compliance Frameworks: What You Need to Know1

Cloud Compliance: What It Is + 8 Best Practices for Improving It2

Cloud Computing: Auditing Challenges - ISACA