CCAK Questions Bank

This control specification aligns with the concept of independent audits, which are crucial for verifying that an organization adheres to its established policies, standards, procedures, and compliance obligations. The requirement for these reviews and assessments to be performed at least annually ensures ongoing compliance and the ability to address any areas of nonconformity. Independent audits provide an objective assessment and are essential for maintaining transparency and trust in the cloud services provided.

References = The Cloud Controls Matrix (CCM) specifically mentions the need for independent assessments to be conducted annually as part of the Audit Assurance and Compliance domain, which is detailed in the CCM’s guidelines and related documents provided by the Cloud Security Alliance (CSA)12.

A distributed denial of service (DDoS) attack renders the customer’s cloud inaccessible for 24 hours is an example of availability technical impact. Availability is the protection of data and services from disruption or denial, and it is one of the three dimensions of information security, along with confidentiality and integrity. Availability technical impact refers to the extent of damage or harm that a threat can cause to the availability of the information system and its components, such as servers, networks, applications, and data. A DDoS attack is a malicious attempt to overwhelm a target system with a large volume of traffic or requests from multiple sources, making it unable to respond to legitimate requests or perform its normal functions. A DDoS attack can cause a significant availability technical impact by rendering the customer’s cloud inaccessible for a prolonged period of time, resulting in loss of productivity, revenue, customer satisfaction, and reputation. References := CCAK Study Guide, Chapter 4: A Threat Analysis Methodology for Cloud Using CCM, page 81; What is a DDoS Attack? | Cloudflare

Transparent data encryption (TDE) is used for data and log files at rest. This means that TDE encrypts the database files on the disk and decrypts them when they are read into memory. TDE protects the data from unauthorized access or theft if the physical media, such as drives or backup tapes, are stolen or lost. TDE does not encrypt data across communication channels, data currently being processed, or data in random access memory (RAM). These types of data require different encryption methods, such as SSL/TLS, column encryption, or memory encryption12.

References:

Transparent data encryption (TDE) - SQL Server | Microsoft Learn

Transparent Data Encryption - Oracle Help Center

The Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing that can be used by cloud customers to build an operational cloud risk management program. The CCM provides guidance on which security controls should be implemented by which actor within the cloud supply chain, and maps the controls to industry-accepted security standards, regulations, and frameworks. The CCM can help cloud customers to assess the security posture of their cloud service providers, document their own responsibilities and requirements, and establish a baseline for cloud security assurance and compliance. References :=

Cloud Controls Matrix (CCM) - CSA1

What is the Cloud Controls Matrix (CCM)? - Cloud Security Alliance2

Certificate of Cloud Auditing Knowledge (CCAK) Study Guide, Chapter 5: Cloud Assurance Frameworks