CCAK Practice Questions

Most major cloud providers allow customers to specify the geographic regions where their data is stored and replicated. An auditor must verify these settings are correctly configured to prevent data from being moved outside the permitted jurisdictions (the EU, in this case).

A preventive control, such as an AWS Service Control Policy (SCP) or Azure Policy, can enforce data residency at the organizational level by explicitly denying actions that would create resources or store data outside of designated EU regions. This is a critical technical enforcement of the governance policy.

Claims about RTO and RPO are best validated by actual performance. A documented plan only shows intent, not capability. The most reliable evidence is the result of a recent, comprehensive DR test that simulates a real-world failure. The report should detail the entire timeline from incident declaration to service restoration, allowing the auditor to verify if the 4-hour RTO was met. It should also verify the data restoration process to confirm the 1-hour RPO. Verification by an independent third party adds a significant level of assurance to the evidence.

A mature continuous assurance program must account for legitimate business needs that may temporarily deviate from standard policy. Simply disabling auto-remediation weakens security, while excluding teams creates security silos. The best approach is to establish a formal exception management process. This allows the marketing team to request a temporary, risk-assessed exception (e.g., a time-limited, pre-signed URL for the file instead of a public bucket). The process ensures that deviations are documented, approved by risk owners, and monitored with compensating controls, thus balancing security requirements with business agility.

The Interoperability & Portability (IPY) domain of the CSA CCM is specifically designed to address the risks of vendor lock-in. Its controls focus on the ability of the customer to move their data and applications between different cloud services. An auditor would examine the provider's adherence to these controls, such as providing data export capabilities in standard formats and using non-proprietary APIs, to assess the ease of migration.

Gray-box testing is a blend of white-box and black-box testing. The tester has some, but not all, information about the internal workings of the system. In this scenario, having user credentials but limited architectural knowledge fits the description perfectly. It allows the tester to assess security from the perspective of an authenticated user without having the full 'keys to the kingdom' that a white-box test would provide.

Immutability is the principle that logs, once written, cannot be altered or deleted. This is crucial for maintaining the integrity and trustworthiness of audit trails. Without immutability, a malicious actor (including a privileged insider) could cover their tracks by modifying logs. Common controls to achieve this include write-once-read-many (WORM) storage, shipping logs to a separate, highly restricted security account, or using blockchain-based logging services.

In a traditional on-premises environment, auditors test controls that are fully managed by the organization. In the cloud, many controls (e.g., physical security, hypervisor management) are the responsibility of the CSP. The auditor's focus must shift to critically evaluating the assurance documents provided by the CSP (like SOC 2 reports) to gain confidence in their controls. Simultaneously, the auditor must intensify the audit of the controls that are the customer's responsibility, such as IAM configuration, network security groups, and data encryption settings. This dual focus on third-party assurance and customer-side configuration is the most significant change.

The foundational step in governing a multi-cloud environment is to establish a common set of policies and standards that are not tied to any single provider. Mapping these to a universal framework like the CSA Cloud Controls Matrix (CCM) creates a single source of truth for security and compliance. This allows for consistent assessment and enforcement, regardless of the underlying cloud platform. Deploying tools (CSPM), creating a center of excellence, or auditing individual providers are subsequent steps that should be guided by this foundational governance framework.

The STA domain in the CSA CCM specifically addresses the risks associated with the cloud supply chain, including third-party data processors. Controls within this domain require organizations to manage and assess the security posture of their vendors, ensure contractual agreements are in place, and define responsibilities, including incident notification. The lack of specific breach notification clauses directly relates to the controls in the STA domain.

SAST tools analyze the application's source code for vulnerabilities before it is compiled or run. This is a critical control for identifying security flaws early in the development lifecycle.

DAST tools test the application in its running state, simulating attacks to find vulnerabilities that may not be apparent in the static code. This is a crucial step to identify runtime and configuration issues.