CCSP Exams 01 Flashcards
Your organization needs to conform to the highest levels of FIPS-140 cryptographic standards in order to meet contractual obligations. Your manager has tasked you with investigating options to meet this requirement. Which technology are you most likely to recommend?
KVM
Bastion host
DRS
HSM
Answer: HSM
Which of the following is not a primary function of a network security group (NSG)?
Filtering traffic based on source and destination addresses
Applying rules for handling network traffic
Controlling traffic flow based on protocols
Encrypting data at rest
Answer: Encrypting data at rest
“Encrypting data at rest” is correct. Encrypting data at rest is not a primary function of NSGs.
The other answers are incorrect because they are all primary functions of NSGs
What is the primary focus of most DNS attacks?
Overloading DNS servers to cause downtime
Extracting sensitive data from DNS queries
Gaining unauthorized access to DNS servers
Redirecting traffic to malicious sites
Answer: Redirecting traffic to malicious sites
“Redirecting traffic to malicious sites” is correct. The primary focus of most DNS attacks is redirecting traffic to malicious sites.
“Gaining unauthorized access to DNS servers” is incorrect because unauthorized access is a means, not the primary focus.
“Overloading DNS servers to cause downtime” is incorrect because overloading servers is a type of DoS attack, not the primary focus of most DNS attacks.
“Extracting sensitive data from DNS queries” is incorrect because extracting data is not the primary focus of most DNS attacks.
Which of the following is not a primary function of IPSec?
Operating at the application layer
Authenticating packets during transmission
Encrypting packets during transmission
Negotiating security policies between two parties
Answer: Operating at the application layer
“Operating at the application layer” is correct. IPSec does not operate at the application layer; it operates at the Internet network layer.
The other answers are incorrect because encrypting packets, authenticating packets, and negotiating security policies are all primary functions of IPSec.
Which of the following is a primary advantage of using Windows Server Core as a baseline in cloud environments?
It supports legacy applications out of the box.
It includes all Windows Server roles and features.
It provides a GUI-based management interface.
It offers a reduced attack surface
Answer: It offers a reduced attack surface
“It offers a reduced attack surface” is correct. Windows Server Core offers a reduced attack surface due to its minimalistic installation.
“It provides a GUI-based management interface” is incorrect because Windows Server Core does not provide a GUl-based interface.
“It includes all Windows Server roles and features” is incorrect because Windows Server Core does not include all roles and features.
“It supports legacy applications out of the box” is incorrect because supporting legacy applications is not a primary advantage of Windows Server Core.
What is the primary benefit of cloud platforms in terms of efficiency for an organization?
Increased software updates
Reduced hardware maintenance
Enhanced user experience
Improved in-house catering services
Answer: Reduced hardware maintenance
“Reduced hardware maintenance” is correct. One of the main benefits of cloud platforms is that organizations don’t have to worry about maintaining physical hardware.
“Enhanced user experience” is incorrect because although cloud platforms can enhance user experience, that’s not a primary benefit in terms of efficiency.
“Increased software updates” is incorrect because while cloud platforms might offer regular software updates, that’s not a primary benefit in terms of efficiency.
“Improved in-house catering services” is incorrect because in-house catering services have nothing to do with cloud platforms.
In cloud environments, why is it essential to consider data sovereignty regulations?
To comply with local data storage and processing regulations
To enhance user experience
To ensure data redundancy
To reduce operational costs
Answer: To comply with local data storage and processing regulations
“To comply with local data storage and processing regulations” is correct. Data sovereignty regulations dictate how data should be stored and processed in specific geographical locations.
“To ensure data redundancy” is incorrect because data sovereignty is primarily about compliance, not redundancy.
“To enhance user experience” is incorrect because user experience isn’t the primary concern of data sovereignty.
“To reduce operational costs” is incorrect because compliance with data sovereignty might increase costs due to specific storage requirements.
Which cloud deployment model involves a combination of private and public cloud resources?
Hybrid cloud
Public cloud
Community loud
Private cloud
Answer: Hybrid cloud
“Hybrid cloud” is correct. A hybrid cloud involves a combination of private and public cloud resources.
“Public cloud” is incorrect because a public cloud is solely based on public cloud resources.
“Private cloud” is incorrect because a private cloud is based on private resources, typically within an organization.
“Community loud” is incorrect because a community cloud is shared by several organizations with common concerns.
In cloud computing, what is the primary purpose of orchestration?
Ensuring data redundancy
Limiting data access to specific users
Automating and coordinating complex cloud tasks and workflows
Focusing on in-house application development
Answer: Automating and coordinating complex cloud tasks and workflows
“Automating and coordinating complex cloud tasks and workflows” is correct. Orchestration in cloud computing is about automating and coordinating complex tasks and workflows.
“Ensuring data redundancy” is incorrect because ensuring data redundancy is not the primary purpose of orchestration.
“Limiting data access to specific users” is incorrect because limiting data access is not the primary purpose of orchestration.
“Focusing on in-house application development” is incorrect because in-house application development isn’t directly related to orchestration.
Why is it crucial to understand and evaluate the risk management program of a cloud provider?
Because the cloud customer’s data will be stored externally and out of their control
Because it helps in negotiating better pricing with the cloud provider
Because it is a mandatory requirement for all cloud customers
Because the cloud provider’s risk acceptance will directly impact the customer’s security
Answer: Because the cloud provider’s risk acceptance will directly impact the customer’s security
“Because the cloud provider’s risk acceptance will directly impact the customer’s security” is correct because the risk decisions of a cloud provider can have direct implications on the security of a cloud customer.
“Because the cloud customer’s data will be stored externally and out of their control” is incorrect because while external storage of data is a concern, it doesn’t directly address the importance of understanding the provider’s risk management.
“Because it helps in negotiating better pricing with the cloud provider” is incorrect as the primary concern is security, not pricing.
“Because it is a mandatory requirement for all cloud customers” is incorrect as it’s not a mandatory requirement for all cloud customers.
When considering a startup as a potential cloud provider, what is a significant concern for organizations?
Startups often have innovative features not found in established providers.
The longevity and stability of startups can be uncertain.
Startups always have a smaller customer base, ensuring better support.
Established providers are always more expensive than startups.
Answer: The longevity and stability of startups can be uncertain.
“The longevity and stability of startups can be uncertain” is correct because startups, being new entrants, might not have a proven track record, making their long-term stability uncertain.
“Startups often have innovative features not found in established providers” is incorrect because while startups might have innovative features, it’s not the primary concern when selecting a provider.
“Startups always have a smaller customer base, ensuring better support” is incorrect because a smaller customer base doesn’t always guarantee better support.
“Established providers are always more expensive than startups” is incorrect because pricing varies and is not solely based on the age of the company.
With a cloud environment, who is responsible for the collection of data pursuant to an eDiscovery order?
The application owner
The cloud provider
The cloud customer
Both the cloud provider and cloud customer
Answer: Both the cloud provider and cloud customer
“Both the cloud provider and cloud customer” is correct.
Both the cloud provider and the cloud customer share responsibility for data collection and preservation, pursuant to an eDiscovery order.
The other answers are incorrect.
With an laaS implementation, which of the following metrics would not be used as a factor in determining costs for the cloud customer?
Storage
Number of users
Memory
CPU
Answer: Number of users
“Number of users” is correct because the actual number of users is irrelevant to cloud costs.
“Memory” is incorrect as memory used is a direct component of costs with laaS.
“Storage” is incorrect as storage used is a direct component of costs with laaS.
“CPU” is incorrect as CPU used is a direct component of costs with laas.
Your company has tasked you with getting your legacy systems and applications connected with new cloud-based services that management has decided are critical to core business services.
Which role would you be assuming under this directive?
Cloud service administrator
Cloud service business manager
Cloud service user
Cloud service integrator
Answer: Cloud service integrator
“Cloud service integrator” is correct as a cloud service integrator is responsible for connecting and integrating existing services and applications with cloud-based services.
“Cloud service administrator” is incorrect because a cloud service administrator is responsible for testing, monitoring, and securing cloud services.
“Cloud service user” is incorrect because a cloud service user is someone that consumes cloud services.
“Cloud service business manager” is incorrect because a cloud service business manager is responsible for overseeing the billing, auditing, and procurement of cloud services.
Which concept BEST describes the capability of a cloud environment to automatically scale a system or application based on its current resource demands?
On-demand self-service
Measured service
Rapid elasticity
Resource pooling
Answer: Rapid elasticity
“Rapid elasticity” is correct. Rapid elasticity allows a cloud environment to automatically add or remove resources to or from a system or application based on its current demands.
Whereas a traditional data center model would require standby hardware and substantial effort to add resources in response to load increases, a cloud environment can easily and rapidly expand to meet resource demands, so long as the application is properly implemented for it. The other answers are incorrect.
Which attribute of data poses the biggest challenge for data discovery?
Quality
Volume
Labels
Format
Answer: Quality
Quality” is correct. The main problem when it comes to data discovery is the quality of the data that analysis is being performed against.
Data that is malformed, incorrectly stored or labeled, or incomplete makes it very difficult to use analytical tools against.
The other answers are incorrect.
Which regulatory system pertains to the protection of healthcare data?
HIPAA
HFCA
HAS
HITECH
Answer: HIPAA
“HIPAA” is correct. The Health Insurance Portability and Accountability Act (HIPAA) sets stringent requirements in the United States for the protection of healthcare records.
The other answers are incorrect.
Which of the following best describes the concept of multi-tenancy in cloud computing?
Multiple cloud providers collaborating on a single project
Multiple applications running on a single server
Multiple users sharing a single instance of a software application
Multiple servers dedicated to a single application
Multiple users sharing a single instance of a software application
“Multiple users sharing a single instance of a software application” is correct because multi-tenancy refers to a single instance of a software application serving multiple customers or “tenants”.
“Multiple cloud providers collaborating on a single project” is incorrect because multi-tenancy does not involve multiple cloud providers collaborating on a project.
“Multiple applications running on a single server” is incorrect because while multiple applications can run on a single server, it doesn’t define multi-tenancy.
“Multiple servers dedicated to a single application” is incorrect because dedicating multiple servers to a single application is not related to the concept of multi-tenancy.
Which of the following is the biggest concern or challenge with using encryption?
Efficiency
Dependence on keys
Cipher strength
Protocol standards
Answer: Dependence on keys
“Dependence on keys” is correct. No matter what kind of application, system, or hosting model is used, encryption is 100 percent dependent on encryption keys. Properly securing the keys and the exchange of them is the biggest and most important challenge of encryption systems.
The other answers are incorrect.
Which of the following best describes the Software Assurance Forum for Excellence in Code (SAFECode)?
A cloud service model
A threat modeling methodology
A software licensing platform
An organization promoting secure software development practices
Answer: An organization promoting secure software development practices
An organization promoting secure software development practices” is correct because SAFECode is an organization that promotes best practices for secure software development.
“A cloud service model” is incorrect because SAFECode is not a service model related to cloud computing.
“A threat modeling methodology” is incorrect because SAFECode is not a methodology for threat modeling.
“A software licensing platform” is incorrect because SAFECode does not provide software licensing platforms.
What role does encryption play in cloud data protection?
Enhances data visibility
Protects data from unauthorized access
Reduces data size
Speeds up data transfer
Answer: Protects data from unauthorized access
“protects data from unauthorized access” is correct because encryption protects data by making it unreadable to unauthorized individuals.
“Reduces data size” is incorrect because encryption doesn’t typically reduce data size; in fact, it might increase it slightly.
“Enhances data visibility” is incorrect because encryption aims to reduce unauthorized data visibility.
“Speeds up data transfer” is incorrect because encryption doesn’t inherently speed up data transfer.
Which statement accurately describes the proper sequence of ISC2 phases in the data cycle process?
a) Store, Create, use, share, archive, and destroy
b) Use, store, Create, share, archive, and destroy
c) destroy, store, use, share, archive, and create
d) create, store, use, share, archive, and destroy
Answer: d) create, store, use, share, archive, and destroy
Which of the following is the appropriate risk response when the identified risk falls within the organizational risk tolerance?
a) Risk Mitigation
b) Risk Acceptance
c) Risk Transfer
d) Risk Avoidance
Answer: b Risk Acceptance
Which of the following is an appropriate risk response when the identified risk exceeds the organizational risk tolerance?
a) Risk Mitigation
b) Risk Acceptance
c) Risk Transfer
d) Risk Avoidance
Answer: d) Risk Avoidance
