Isaca Updated CCAK Exam Questions and Answers by inara

 A dot release of the Cloud Controls Matrix (CCM) indicates a technical change (revision, addition, or deletion) of a number of controls that is smaller than 10% compared to the previous full release. A dot release is a minor update to the CCM that reflects the feedback from the cloud security community and the changes in the cloud technology landscape. A dot release does not change the domain structure or the overall scope of the CCM, but rather improves the clarity, accuracy, and relevance of the existing controls. A dot release is denoted by a decimal number after the major version number, such as CCM v4.1 or CCM v4.2. The current version of the CCM is v4.0, which was released in October 20211.

The other options are incorrect because:

A. a revision of the CCM domain structure: A revision of the CCM domain structure is a major change that affects the organization and categorization of the controls into different domains. A revision of the CCM domain structure requires a full release, not a dot release, and is denoted by an integer number, such as CCM v3 or CCM v42.

C. the introduction of new control frameworks mapped to previously published CCM controls: The introduction of new control frameworks mapped to previously published CCM controls is an additional feature that enhances the usability and applicability of the CCM. The introduction of new control frameworks mapped to previously published CCM controls does not require a dot release or a full release, but rather an update to the mapping table that shows the relationship between the CCM controls and other industry-accepted security standards, regulations, and frameworks3.

D. technical change (revision, addition, or deletion) of a number of controls that is greater than 10% compared to the previous full release: A technical change (revision, addition, or deletion) of a number of controls that is greater than 10% compared to the previous full release is a significant change that affects the content and scope of the CCM. A technical change (revision, addition, or deletion) of a number of controls that is greater than 10% compared to the previous full release requires a full release, not a dot release, and is denoted by an integer number, such as CCM v3 or CCM v42.

References:

Cloud Controls Matrix (CCM) - CSA

The CSA Cloud Controls Matrix (CCM) V4: Raising the cloud security bar

Cloud Security Alliance Releases New Cloud Controls Matrix Auditing Guidelines

 ISO/IEC 15027017 is a cloud-specific security standard that provides guidelines for information security controls applicable to the provision and use of cloud services. It is based on ISO/IEC 27002, which is a general standard for information security management, but it also includes additional controls and implementation guidance that specifically relate to cloud services. ISO/IEC 15027017 is intended to help both cloud service providers and cloud service customers to enhance the security and confidentiality of their cloud environment and to comply with relevant regulatory requirements and industry standards.12 References := ISO/IEC 27017:2015 - Information technology — Security techniques — Code of practice for information security controls based on ISO/IEC 27002 for cloud services1; Cloud Security Standards: ISO, PCI, GDPR and Your Cloud - Exabeam3; ISO/IEC 27017 - Wikipedia2

Regression testing is a type of software testing that confirms that a recent program or code change has not adversely affected existing features1 It involves re-running functional and non-functional tests to ensure that previously developed and tested software still performs as expected after a change2 Regression testing is suitable for large code sets in environments where time to completion is critical, as it can help detect and prevent defects, improve quality, and enable faster delivery of secure software. Regression testing can be automated to reduce manual errors, speed up feedback loops, and increase efficiency and reliability3

The other options are not correct because:

Option A is not correct because parallel testing is a type of software testing that involves testing multiple applications or subsystems concurrently to reduce the test time4 Parallel testing does not necessarily ensure the integration of security testing, as it depends on the quality and coverage of the test cases and scenarios used for each application or subsystem. Parallel testing may also introduce challenges such as synchronization, coordination, and communication among the testers and developers5

Option B is not correct because full application stack unit testing is a type of software testing that involves testing individual units or components of an application in isolation to verify their functionality, logic, interfaces, and performance6 Full application stack unit testing does not ensure the integration of security testing, as it does not consider the interactions and dependencies among the units or components, or the behavior of the application as a whole. Unit testing is typically performed by developers at an early stage of the software development life cycle, and may not cover all the security aspects or requirements of the application7

Option C is not correct because functional verification is a type of software testing that involves verifying that the software meets the specified requirements and satisfies the user needs. Functional verification does not ensure the integration of security testing, as it does not focus on how the software is designed or configured, or how it handles malicious or unexpected inputs. Functional verification is typically performed by quality assurance teams at a later stage of the software development life cycle, and may not detect all the security vulnerabilities or risks of the software.

References: 1: Wikipedia. Regression testing - Wikipedia. [Online]. Available: 3. [Accessed: 14-Apr-2023]. 2: Katalon. What is Regression Testing? Definition, Tools, Examples - Katalon. [Online]. Available: 4. [Accessed: 14-Apr-2023]. 3: BMC Software. Shift Left Testing: What, Why & How To Shift Left – BMC Software | Blogs. [Online]. Available: 3. [Accessed: 14-Apr-2023]. 4: Guru99. What is Parallel Testing? with Example - Guru99. [Online]. Available: . [Accessed: 14-Apr-2023]. 5: LambdaTest. Parallel Testing In Selenium WebDriver | LambdaTest Blog. [Online]. Available: . [Accessed: 14-Apr-2023]. 6: Guru99. What is Unit Testing? Types & Examples - Guru99. [Online]. Available: . [Accessed: 14-Apr-2023]. 7: Software Testing Help. Unit Testing Vs Integration Testing: Difference Between These Two - SoftwareTestingHelp.com Blog. [Online]. Available: . [Accessed: 14-Apr-2023]. : Guru99. What is Functional Testing? Types & Examples - Guru99. [Online]. Available: . [Accessed: 14-Apr-2023]. : Software Testing Help. Functional Testing Vs Non-Functional Testing - SoftwareTestingHelp.com Blog. [Online]. Available: . [Accessed: 14-Apr-2023].

The Cloud Controls Matrix (CCM) is a cybersecurity control framework specifically designed for cloud computing environments. A key benefit of using the CCM is that it maps to existing security standards, best practices, and regulations. This mapping allows organizations to ensure that their cloud security posture aligns with industry-recognized frameworks, thereby facilitating compliance and security assurance efforts. The CCM’s comprehensive set of control objectives covers all key aspects of cloud technology and provides guidance on which security controls should be implemented by various actors within the cloud supply chain.

References = This answer is supported by the information provided in the Cloud Controls Matrix documentation and related resources, which highlight the CCM’s alignment with other security standards and its role in helping organizations navigate the complex landscape of cloud security and compliance12.