CCAK Sample Questions & Answers

Before implementing new tools or procedures, it is essential to understand the current state and measure it against a recognized standard. A gap analysis using the CSA CCM provides a structured and comprehensive method to evaluate FinSecure's posture. This process will systematically identify all the deficiencies noted (lack of policies, decentralized logging, poor IAM), prioritize remediation efforts, and create a roadmap for building a mature compliance program. It addresses the root cause—the lack of a structured control framework—rather than just treating symptoms like deploying a SIEM.

According to the shared responsibility model for IaaS, the customer is responsible for everything from the guest OS upwards, including all applications, libraries, and configurations. The CSP's report only covers their part of the responsibility (the host OS). PCI DSS requires scanning for vulnerabilities across the entire technology stack, including the application layer. Therefore, the evidence is insufficient because it omits the customer's area of responsibility, which is a critical part of the in-scope environment.

The key characteristic of STAR Level 1 is that it is a self-assessment. The CSP completes the CAIQ and attests to their own controls. While this provides transparency, it lacks the independent verification and assurance that comes from a third-party audit (found in STAR Level 2 certifications and attestations). An auditor can use the Level 1 submission as a starting point for due diligence but cannot rely on it as verified proof of control effectiveness.

The DSP-10 control in CCM v4 focuses on Network Security, including requirements to 'restrict and monitor traffic between trusted and untrusted connections.' In the context of a serverless function, this translates to implementing strict egress filtering rules. By configuring the function's networking environment to only allow outbound connections to known, trusted endpoints (like the internal object storage service), any attempt to exfiltrate data to an unauthorized external endpoint would be blocked at the network level, directly mitigating the identified threat.

At Level 2 (Managed/Repeatable), processes are documented and activities are planned and performed according to policy. However, implementation can be inconsistent and often reactive, relying on individual heroics rather than institutionalized, organization-wide practices. The scenario describes documented policies but inconsistent and reactive implementation, which is the hallmark of this level. Level 1 is chaotic with no documented processes. Level 3 (Defined) would require organization-wide standards and proactive implementation. Level 4 (Quantitatively Managed) involves metrics and data-driven management.

The Service Level Agreement (SLA) is the contractual document that defines the specific, measurable service levels the provider commits to, including timelines for critical security operations like access revocation. While an organization's internal policies define their requirements, the SLA codifies the provider's obligation. Therefore, the auditor must test against the contractually agreed-upon timeframe in the SLA to determine if the control is operating effectively from a customer assurance perspective.

A Business Associate Agreement is a legally binding contract required by HIPAA. Its primary function is to ensure that the cloud provider (the Business Associate) understands and accepts its responsibility to safeguard PHI according to HIPAA rules. It contractually obligates the CSP to implement appropriate administrative, physical, and technical safeguards and defines what the CSP can and cannot do with the PHI. For an auditor, the BAA is critical evidence that the relationship and responsibilities regarding PHI protection have been formally established.

This statement is false. The CAIQ (Consensus Assessments Initiative Questionnaire) is a questionnaire, typically completed by the CSP themselves as part of a self-assessment (STAR Level 1). It provides transparency into a CSP's security practices but does not constitute an audit report or an independent auditor's opinion. An independent auditor's opinion on control effectiveness would be found in reports like a SOC 2 Type II or an ISO 27001 certification, which correspond to STAR Level 2.

Most major cloud providers allow customers to specify the geographic regions where their data is stored and replicated. An auditor must verify these settings are correctly configured to prevent data from being moved outside the permitted jurisdictions (the EU, in this case).

A preventive control, such as an AWS Service Control Policy (SCP) or Azure Policy, can enforce data residency at the organizational level by explicitly denying actions that would create resources or store data outside of designated EU regions. This is a critical technical enforcement of the governance policy.

Claims about RTO and RPO are best validated by actual performance. A documented plan only shows intent, not capability. The most reliable evidence is the result of a recent, comprehensive DR test that simulates a real-world failure. The report should detail the entire timeline from incident declaration to service restoration, allowing the auditor to verify if the 4-hour RTO was met. It should also verify the data restoration process to confirm the 1-hour RPO. Verification by an independent third party adds a significant level of assurance to the evidence.