Isaca CCAK Dumps - Pass Certificate of Cloud Auditing Knowledge Exam in First Attempt 2026

According to the CCAK Study Guide, the business continuity management and operational resilience strategy of the cloud customer should be formulated jointly with the cloud service provider, as they share the responsibility for ensuring the availability and recoverability of the cloud services. The strategy should cover all aspects of business continuity and resilience planning, taking inputs from the assessed impact and risks, to consider activities for before, during, and after a disruption. These activities include prevention, mitigation, response, recovery, restoration, and improvement.The strategy should also define the roles and responsibilities of both parties, the communication channels and escalation procedures, the testing and exercising plans, and the review and update mechanisms1

The other options are not correct because:

Option B is not correct because the strategy should not only be developed within the acceptable limits of the risk appetite, but also aligned with the business objectives and stakeholder expectations of both parties.The risk appetite is only one of the factors that influence the strategy formulation1

Option C is not correct because the strategy should not only cover the activities required to continue and recover prioritized activities within identified time frames and agreed capacity, but also consider the activities for before and after a disruption, such as prevention, mitigation, improvement, etc.The strategy should also include other elements such as roles and responsibilities, communication channels, testing plans, etc1

Implementing service level agreements (SLAs) around changes to baseline configurations is the most important way to manage risk from cloud vendors who might accidentally introduce unnecessary risk to an organization by adding new features to their solutions. A service level agreement (SLA) is a contract or a part of a contract that defines the expected level of service, performance, and quality that a cloud vendor will provide to an organization.An SLA can also specify the roles and responsibilities, the communication channels, the escalation procedures, and the penalties or remedies for non-compliance12.

Implementing SLAs around changes to baseline configurations can help an organization to manage the risk from cloud vendors who might add new features to their solutions without proper testing, validation, or notification. Baseline configurations are the standard or reference settings for a system or a network that are used to measure and maintain its security and performance.Changes to baseline configurations can introduce new vulnerabilities, errors, or incompatibilities that can affect the functionality, availability, or security of the system or network34. Therefore, an SLA can help an organization to ensure that the cloud vendor follows a change management process that includes steps such as risk assessment, impact analysis, approval, documentation, notification, testing, and rollback. An SLA can also help an organization to monitor and verify the changes made by the cloud vendor and to report and resolve any issues or incidents that may arise from them.

The other options are not the most effective ways to manage the risk from cloud vendors who might add new features to their solutions. Option A, deploying new features using cloud orchestration tools, is not a good way to manage the risk because cloud orchestration tools are used to automate and coordinate the deployment and management of complex cloud services and resources. Cloud orchestration tools do not address the issue of whether the new features added by the cloud vendor are necessary, secure, or compatible with the organization's system or network. Option B, performing prior due diligence of the vendor, is not a good way to manage the risk because prior due diligence is a process that involves evaluating and verifying the background, reputation, capabilities, and compliance of a potential cloud vendor before entering into a contract with them. Prior due diligence does not address the issue of how the cloud vendor will handle changes to their solutions after the contract is signed. Option C, establishing responsibility in the vendor contract, is not a good way to manage the risk because establishing responsibility in the vendor contract is a process that involves defining and assigning the roles and obligations of both parties in relation to the cloud service delivery and performance. Establishing responsibility in the vendor contract does not address the issue of how the cloud vendor will communicate and coordinate with the organization about changes to their solutions.Reference:=

What is an SLA?Best practices for service-level agreements | CIO1

Service Level Agreements - Cloud Security Alliance2

What is Baseline Configuration?- Definition from Techopedia3

Baseline Configuration - Cloud Security Alliance4

Change Management - Cloud Security Alliance

Incident Response - Cloud Security Alliance

What is Cloud Orchestration? - Definition from Techopedia

Due Diligence - Cloud Security Alliance

Contractual Security Requirements - Cloud Security Alliance

In the context of cloud operationalization, ''below the waterline'' refers to the aspects of cloud services that are managed and controlled by the cloud service provider (CSP) rather than the customer. This analogy is often used to describe the shared responsibility model in cloud computing, where the CSP is responsible for the infrastructure's security and stability, akin to the submerged part of an iceberg that supports the structure above water. The customer, on the other hand, is responsible for managing the controls and security measures ''above the waterline,'' which include the applications, data, and access management they deploy in the cloud environment.

Reference= The information provided is based on standard cloud computing models and the shared responsibility concept, which is a fundamental principle discussed in cloud auditing and security literature, including the CCAK curriculum and related resources1.

Visibility to the source code within build scripts would give an auditor the best view of design and implementation decisions when an organization uses programmatic automation for Infrastructure as a Service (IaaS) deployments. IaaS is a cloud service model that provides virtualized computing resources, such as servers, storage, network, and operating systems, over the internet. Programmatic automation is the process of using code or scripts to automate the provisioning, configuration, management, and monitoring of the cloud infrastructure.Build scripts are files that contain commands or instructions to create or modify the cloud infrastructure according to the desired specifications.12

An auditor can use the source code within build scripts to gain insight into how the organization designs and implements its cloud infrastructure.The source code can reveal the following information3:

The type, size, and number of cloud resources that are provisioned and deployed

The configuration settings and parameters that are applied to the cloud resources

The security controls and policies that are enforced on the cloud resources

The dependencies and relationships between the cloud resources

The testing and validation methods that are used to verify the functionality and performance of the cloud resources

The logging and auditing mechanisms that are used to track and record the changes and activities on the cloud resources

By reviewing the source code within build scripts, an auditor can evaluate whether the organization follows the best practices and standards for cloud infrastructure design and implementation, such as scalability, reliability, security, compliance, and efficiency. An auditor can also identify any gaps or risks in the organization's cloud infrastructure and provide recommendations for improvement.

The auditor's next course of action should be to review the contract and DR capability of the cloud service provider. This will help the auditor to verify if the provider has a DR plan that meets the organization's requirements and expectations, and if the provider has evidence of testing and validating the plan annually. The auditor should also check if the contract specifies the roles and responsibilities of both parties, the RTO and RPO values, the SLA terms, and the penalties for non-compliance.

Reviewing the security white paper of the provider (option A) might give some information about the provider's security practices and controls, but it might not be sufficient or relevant to assess the DR plan. Reviewing the provider's audit reports (option B) might also provide some assurance about the provider's compliance with standards and regulations, but it might not address the specific DR needs of the organization. Planning an audit of the provider (option D) might be a possible course of action, but it would require more time and resources, and it might not be feasible or necessary if the contract and DR capability are already satisfactory.Reference:

Disaster recovery planning guide

Audit a Disaster Recovery Plan

How to Maintain and Test a Business Continuity and Disaster Recovery Plan