Free CCAK sample questions

Correct answers: Verifying the integration of Static Application Security Testing (SAST) tools in the CI/CD pipeline.; Confirming that Dynamic Application Security Testing (DAST) is performed on the application in a staging environment.

SAST tools analyze the application's source code for vulnerabilities before it is compiled or run. This is a critical control for identifying security flaws early in the development lifecycle.

DAST tools test the application in its running state, simulating attacks to find vulnerabilities that may not be apparent in the static code. This is a crucial step to identify runtime and configuration issues.

Correct answer: False

This statement is false. In the IaaS model, the CSP is responsible for the security 'of' the cloud (i.e., the underlying infrastructure, hypervisor). The customer is responsible for security 'in' the cloud, which includes securing and patching the guest operating systems, middleware, and applications they install and manage on the IaaS instances. This is a fundamental concept of the shared responsibility model.

Correct answer: Developing and maintaining an accurate and comprehensive library of security and compliance policies as code.

The effectiveness of the entire continuous assurance model hinges on the quality and accuracy of the policies defined in the Policy Engine. Translating complex regulatory requirements (like NIST, FedRAMP, etc.) into precise, machine-readable code (e.g., using Open Policy Agent, Sentinel) is a highly specialized and ongoing effort. These policies must be continuously updated to reflect new threats, regulatory changes, and evolving architectures. An inaccurate or incomplete policy library will lead to false positives, false negatives, and ultimately, a loss of trust in the automated system.

Correct answer: Perform a gap analysis against the CSA Cloud Controls Matrix (CCM), mapping existing practices to controls and identifying deficiencies in documentation, policies, and technical implementations.

Before implementing new tools or procedures, it is essential to understand the current state and measure it against a recognized standard. A gap analysis using the CSA CCM provides a structured and comprehensive method to evaluate FinSecure's posture. This process will systematically identify all the deficiencies noted (lack of policies, decentralized logging, poor IAM), prioritize remediation efforts, and create a roadmap for building a mature compliance program. It addresses the root cause—the lack of a structured control framework—rather than just treating symptoms like deploying a SIEM.

Correct answer: The report does not address vulnerabilities within the custom web application, third-party libraries, and database configurations, which are the customer's responsibility.

According to the shared responsibility model for IaaS, the customer is responsible for everything from the guest OS upwards, including all applications, libraries, and configurations. The CSP's report only covers their part of the responsibility (the host OS). PCI DSS requires scanning for vulnerabilities across the entire technology stack, including the application layer. Therefore, the evidence is insufficient because it omits the customer's area of responsibility, which is a critical part of the in-scope environment.

Correct answer: The responses are provided by the CSP and have not been independently validated by a third party.

The key characteristic of STAR Level 1 is that it is a self-assessment. The CSP completes the CAIQ and attests to their own controls. While this provides transparency, it lacks the independent verification and assurance that comes from a third-party audit (found in STAR Level 2 certifications and attestations). An auditor can use the Level 1 submission as a starting point for due diligence but cannot rely on it as verified proof of control effectiveness.

Correct answer: DSP-10: Network Security

The DSP-10 control in CCM v4 focuses on Network Security, including requirements to 'restrict and monitor traffic between trusted and untrusted connections.' In the context of a serverless function, this translates to implementing strict egress filtering rules. By configuring the function's networking environment to only allow outbound connections to known, trusted endpoints (like the internal object storage service), any attempt to exfiltrate data to an unauthorized external endpoint would be blocked at the network level, directly mitigating the identified threat.

Correct answer: Level 2: Managed (or Repeatable)

At Level 2 (Managed/Repeatable), processes are documented and activities are planned and performed according to policy. However, implementation can be inconsistent and often reactive, relying on individual heroics rather than institutionalized, organization-wide practices. The scenario describes documented policies but inconsistent and reactive implementation, which is the hallmark of this level. Level 1 is chaotic with no documented processes. Level 3 (Defined) would require organization-wide standards and proactive implementation. Level 4 (Quantitatively Managed) involves metrics and data-driven management.

Correct answer: Service Level Agreement (SLA)

The Service Level Agreement (SLA) is the contractual document that defines the specific, measurable service levels the provider commits to, including timelines for critical security operations like access revocation. While an organization's internal policies define their requirements, the SLA codifies the provider's obligation. Therefore, the auditor must test against the contractually agreed-upon timeframe in the SLA to determine if the control is operating effectively from a customer assurance perspective.

Correct answer: To formally document the CSP's responsibilities for protecting Protected Health Information (PHI) and define the permissible uses of that PHI.

A Business Associate Agreement is a legally binding contract required by HIPAA. Its primary function is to ensure that the cloud provider (the Business Associate) understands and accepts its responsibility to safeguard PHI according to HIPAA rules. It contractually obligates the CSP to implement appropriate administrative, physical, and technical safeguards and defines what the CSP can and cannot do with the PHI. For an auditor, the BAA is critical evidence that the relationship and responsibilities regarding PHI protection have been formally established.