Free Cloud Security Alliance CCAK Practice Exam Questions and Answers 2026

Start Learning with the Newest and 100% Free CCAK Exam Dumps Questions

Page: 1 / 60

Total 299 Questions | Updated On: Apr 01, 2026

Add To Cart

Question 1

Which of the following is MOST relevant to determine whether an organization is a risk taker or is risk-averse?

A : Risk management methodology

B : Risk culture

C : Risk heat map

D : Risk appetite

Answer: D

Question 2

Which of the following has been provided by the Federal Office for Information Security in Germany to support customers in selecting, controlling, and monitoring their cloud service providers?

A : German IDW PS 951

B : Multi-Tier Cloud Security (MTCS)

C : BSI Criteria Catalogue C5

D : BSI IT-basic protection catalogue

Answer: C

Question 3

During the cloud service provider evaluation process, which of the following BEST helps identify baseline configuration requirements?

A : Vendor requirements

B : Product benchmarks

C : Benchmark controls lists

D : Contract terms and conditions

Answer: C

Question 4

Which of the following contract terms is necessary to meet a company’s requirement that needs to move data from one CSP to another?

A : Drag and Drop

B : Lift and shift

C : Flexibility to move

D : Transition and data portability

Answer: D

Question 5

When auditing a Software as a Service (SaaS) cloud service provider, which of the following observations would be of GREATEST concern to the auditor?

A : The provider was in breach of a couple of service level agreements (SLAs) in the past year.

B : The audit trails are available for 3-4 days and are typically overwritten as soon as the disk reaches its capacity.

C : Only an executive summary of the annual penetration testing report was made available by the provider for the review. It had details about the criticality of the vulnerabilities and the plan and timeline to mitigate them, but the detailed penetration testing report was not made available.

D : In case of a breach in the provider’s environment involving the organization-s data, the provider sends the breach notification to the organization-s breach notification shared mailbox that is documented in the service agreement.

Answer: B

Page: 1 / 60

Total 299 Questions | Updated On: Apr 01, 2026

Add To Cart