ISACA CCOA QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Cloud Governance (Questions 1–15)
1. Which of the following is the PRIMARY responsibility of a cloud governance framework?
A) Managing cloud vendor contracts
B) Aligning cloud strategy with business objectives
C) Configuring cloud security groups
D) Monitoring cloud resource utilization
Answer: B
Rationale: Cloud governance ensures that cloud computing activities align with and support the organization's
business objectives, risk appetite, and compliance requirements. While contracts, security, and monitoring are
components, alignment with business strategy is the primary purpose.
2. Who retains ultimate accountability for data security in a public cloud environment?
A) The cloud service provider
B) The cloud auditor
,C) The cloud customer (data owner)
D) The third-party vendor
Answer: C
Rationale: Under the shared responsibility model, the cloud customer always retains accountability for their data,
even though the CSP may be responsible for some security controls. Accountability cannot be fully outsourced.
3. Which cloud deployment model involves infrastructure shared by multiple organizations with common
interests?
A) Public cloud
B) Private cloud
C) Community cloud
D) Hybrid cloud
Answer: C
, Rationale: A community cloud is shared by several organizations that have similar concerns (e.g., compliance,
security, jurisdiction). A public cloud is open to the general public, private is single-organization, and hybrid is a
combination.
4. An organization is considering moving sensitive customer data to the cloud. What should be done FIRST?
A) Select a cloud service provider
B) Perform a risk assessment
C) Migrate the data
D) Negotiate the SLA
Answer: B
Rationale: A risk assessment should be performed first to identify risks, determine data classification, and
evaluate whether the cloud is appropriate. All other steps follow from understanding the risk profile.
5. Which of the following BEST describes "data sovereignty"?
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Cloud Governance (Questions 1–15)
1. Which of the following is the PRIMARY responsibility of a cloud governance framework?
A) Managing cloud vendor contracts
B) Aligning cloud strategy with business objectives
C) Configuring cloud security groups
D) Monitoring cloud resource utilization
Answer: B
Rationale: Cloud governance ensures that cloud computing activities align with and support the organization's
business objectives, risk appetite, and compliance requirements. While contracts, security, and monitoring are
components, alignment with business strategy is the primary purpose.
2. Who retains ultimate accountability for data security in a public cloud environment?
A) The cloud service provider
B) The cloud auditor
,C) The cloud customer (data owner)
D) The third-party vendor
Answer: C
Rationale: Under the shared responsibility model, the cloud customer always retains accountability for their data,
even though the CSP may be responsible for some security controls. Accountability cannot be fully outsourced.
3. Which cloud deployment model involves infrastructure shared by multiple organizations with common
interests?
A) Public cloud
B) Private cloud
C) Community cloud
D) Hybrid cloud
Answer: C
, Rationale: A community cloud is shared by several organizations that have similar concerns (e.g., compliance,
security, jurisdiction). A public cloud is open to the general public, private is single-organization, and hybrid is a
combination.
4. An organization is considering moving sensitive customer data to the cloud. What should be done FIRST?
A) Select a cloud service provider
B) Perform a risk assessment
C) Migrate the data
D) Negotiate the SLA
Answer: B
Rationale: A risk assessment should be performed first to identify risks, determine data classification, and
evaluate whether the cloud is appropriate. All other steps follow from understanding the risk profile.
5. Which of the following BEST describes "data sovereignty"?
