Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCSP Exam > Flash Cards > Flashcards

Flash Cards

1
Q

Who determines under what circumstances a private cloud meets the policies and needs of an organization’s strategic goals and contractual requirements (from a technical perspective)?

A

Cloud architect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

This open source IaaS platform was developed to assist IaaS cloud providers in creating, deploying, and managing services through a single “stack” of features for the cloud environment.

A

Apache CloudStack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

This term refers to the increasing diversity of cloud services available today as opposed to those same services being provided locally or on premise.

A

Anything-as-a-Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

This form of cloud storage involves the enterprise and storage service being separate, with data stored outside the confines of the enterprise environment.

A

Public cloud storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

This term refers to the idea of leveraging cloud computing as a way of creating offsite storage with little or no hardware requirements for the enterprise.

A

Online backup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

The purpose of this document is to ensure appropriate security requirements and controls are applied to all U.S. federal government information and information management systems.

A

NIST 800-53

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

This form of cloud storage applies to storing mobile device data in the cloud while providing access to the stored data from anywhere.

A

Mobile cloud storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

This type of cloud storage involves using both public cloud and enterprise private cloud storage.

A

Hybrid cloud storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

This term describes software applications that help the business in solving enterprise problems.

A

Enterprise application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

This term refers to an open source platform for cloud computing and IaaS in a private cloud environment.

A

Eucalyptus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

This term refers to the accreditation used to distinguish between secure and well-established crypto modules produced in the private sector. It stands as a certification for those producers who need them to be used in regulated industries that typically collect, store, transfer, and share data that is deemed to be sensitive in nature but not classified.

A

FIPS 140-2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the term used when a virtual desktop infrastructure is outsourced to a third party?

A

Desktop as a Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

This term refers to the ability of individuals to store their data over the Internet using a storage service provider as opposed to the data being stored locally on a disk or tape backup.

A

Cloud backup solutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

This term describes a kind of computing model that relies on sharing compute resources in a remote location as opposed to the use of local servers or personal devices to handle computing processes.

A

Cloud computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is an organization that buys hosting services with the intent of reselling them to its own customers?

A

Cloud computing reseller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The testing of load and performance capabilities on the services and applications provided by cloud computing providers is designed to ensure optimal performance and scalability under varying conditions. What is it called?

A

Cloud testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

One type of hosting occurs when hosting services are made available on demand. As opposed to a single physical or virtual server, cloud services are set up to utilize multiple connected servers that are part of the cloud infrastructure.

A

Cloud server hosting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

This type of database is accessible from the cloud provider on demand over the Internet to the user/customer.

A

Cloud database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

This specification is engineered to ease the management of multiple applications, which include packaging and delivery across public and private cloud platforms.

A

Cloud Application Management for Platforms (CAMP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

This term refers to the processes involved with making available cloud providers, clients, and applications, resulting in the creation of a public cloud computing environment.

A

Cloud enablement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

The term, often used in place of Platform as a Service (PaaS), describes an association with cloud computing.

A

Cloud OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the processes involved in the transitioning of a part or all of a company’s data, applications, and services from a traditional on-premises enterprise environment to one in the cloud where information can be accessed from anywhere, anytime?

A

Cloud migration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

The service provider that offers storage, computing, and/or software applications that are available across the Internet from anywhere, anytime.

A

Cloud provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

The ability for a consumer or user to be able to move their associated applications and/or data between competing cloud providers or between public and private clouds.

A

Cloud portability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Selecting which applications and services that will reside in the public cloud, and which will not, is the first stage in the process resulting in the deployment of a company’s cloud strategy. What is it known as?

A

Cloud provisioning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

The person who adapts, ports, and deploys applications to a target environment.

A

Cloud application architect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

The process of utilizing cloud management tools to ensure that cloud computing services are working properly through the use of software and technologies designed for operation and monitoring of cloud applications, data, and services.

A

Cloud management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

A shortened phrase used to describe applications accessed via the cloud. These applications are never installed locally and are always accessed over the Internet.

A

Cloud apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

A type of storage whereby an organization’s data is stored in and accessible from any location of distributed and connected components of cloud computing.

A

Cloud storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

This person is responsible for all for the implementation, monitoring, and maintenance of the cloud environment either within the organization or on behalf of an organization as a vendor.

A

Cloud administrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

These individuals are tasked with development for the cloud infrastructure. Their development efforts may include client tools, solutions engagements, and system components.

A

Cloud developer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

A third party who manages and distributes remote, cloud-based data backup services, and solutions from a central datacenter location.

A

Cloud backup service provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Software that is hosted in the cloud on remote servers and performs accounting functions.

A

Cloud computing accounting software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

One type of cloud storage wherein cloud and enterprise storage both reside inside the enterprise behind the firewall.

A

Private cloud storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

This enables the IT infrastructure to become more adaptive to changing business needs and requirements.

A

Cloud data architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

This service offers customers the ability to rent hardware, OS, storage, and network capacity over the Internet from a cloud service provider.

A

Infrastructure as a Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

This form of cloud storage involves storing an individual’s data in the cloud, allowing that person access from anywhere, anytime

A

Personal cloud storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

A collection of distributed and connected resources used for storing and managing data online in the cloud.

A

Storage cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

This model hosts software by a cloud vendor or service provider and is available to customers over network resources.

A

Software as a Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

These technologies describe what enables cloud computing to be a real and highly scalable service offering due to decreased costs and resource sharing across multiple tenants and environments.

A

Virtualization technologies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

These cloud computing and services are designed for a particular vertical industry such as banking, healthcare, or some other specific-use application.

A

Vertical cloud computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

This term describes what happens when a customer is unable to leave, migrate, or transfer to an alternate cloud provider due to technical or nontechnical constraints.

A

Vendor lock-in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

A model for examining the nature and severity of threats whose name is derived from and based on the following six categories: Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.

A

STRIDE threat model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

This term refers to a type of testing environment where untested code changes and experimentation from the production can occur safely in isolation. It is usually used in the context of software development, including web development and revision control.

A

Sandbox

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

When testing an application or software product in an operating state, we use this.

A

Dynamic application security testing (DAST)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

This method of computer access control uses authentication factors from at least two of three categories of knowledge factors; what the user knows, what the user has, and/or what the user is.

A

Multifactor authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

This term is used in describing capabilities of a network to differentiate and provide differing qualities of service to various types of network traffic over different communication technologies such as ATM, Ethernet, and IP routed networks.

A

Quality of service (QoS)

48
Q

The encapsulation of application software from the underlying operating system on which it is executed

A

Virtualization encapsulation

49
Q

This security discipline is about enabling the right individual’s access to the right resources at the right time for the right reasons.

A

Identity access management (IAM)

50
Q

This standard is designed for the exchange of authentication and authorization data between security domains.

A

Security Assertion Markup Language (SAML)

51
Q

Routines, standards, protocols, and tools for connecting software applications to web-based services, applications, or tools.

A

Application programming interface (API)

52
Q

This term identifies an arrangement among multiple enterprises that allows subscribers or users to use the same identification data or credentials, and to obtain access to the networks and all associated resources of the enterprises participating in the arrangement.

A

Federated identity management

53
Q

This type of filter, appliance, or server plug-in is used to apply a set of rules to HTTP conversations in real time as a way of protecting from common attacks such as cross-site scripting or SQL injection.

A

A web application firewall (WAF)

54
Q

This standard, which introduces definitions, concepts, principles, and processes involved in application security, provides an overview of application security.

A

ISO/IEC 27034-1

55
Q

This involves making a structurally similar yet inauthentic copy of an organization’s data that is then used strictly for purposes of software testing and user training

A

Data masking

56
Q

This subset of an ONF contains only information necessary for reaching a targeted level of trust for a specific business application.

A

Application Normative Framework (ANF)

57
Q

This is a set of technologies aimed at analyzing source code, byte code, and binaries for coding and design conditions that show indications of security vulnerabilities.

A

Static application security testing (SAST)

58
Q

A security technology used for the monitoring and analysis of database activity. It operates independently of the database management system (DBMS) and is independent of any native DBMS-resident auditing or native logs such as trace or transaction logs.

A

Database activity monitoring (DAM)

59
Q

When the number of users connected to a system or systems exceeds the number that can be fully supported simultaneously.

A

Oversubscription

60
Q

Using two or more storage servers in tandem in order to increase performance, capacity, and/or reliability. This technique also distributes the workloads and ensures access to all files from all servers at all times regardless of physical location of data.

A

Storage clusters

61
Q

The framework of items that contains all of the components of application security best practices that are catalogued and leveraged by the enterprise.

A

Organizational Normative Framework (ONF)

62
Q

This type of cloud offering is provisioned for open use by the public. It can be owned, managed, or operated by any combination such as a business, academic institution, or government organization and exists on the premises of the cloud provider.

A

Public cloud

63
Q

One phase of the SDLC where all functional features of the system used in development are described independently of any computer platform.

A

Logical design

64
Q

This international standard was developed to develop and maintain an information systems management system (ISMS), which is composed of interrelated elements that organizations use to manage information security risks and to support the CIA triad.

A

ISO/IEC 27001:2013

65
Q

These are often used as decoys and consist of a computer, data, or a network site that appear to be part of a legitimate network but are in fact bogus. They are isolated and monitored for activity in the hopes of discovering information about possible malicious attacks or attackers.

A

Honeypots

66
Q

The use of many smaller disks, as opposed to a single large one, that when configured allows the drives to be placed in a group, thereby increasing performance and redundancy and reducing the chances of data loss.

A

Redundant array of inexpensive disks (RAID)

67
Q

These devices are used to securely store and manage encryption keys. The keys can be used for such purposes as securing data transmissions and protecting log files.

A

Hardware Security Module (HSM)

68
Q

This configuration is used to isolate network components, such as web servers, that are accessible by untrusted networks and therefore external attacks.

A

Demilitarized zone (DMZ)

69
Q

A set of processes and structures used to effectively manage all risks to an enterprise.

A

Enterprise risk management

70
Q

This type of storage is broken down into objects, which include additional metadata (content type, redundancy required, creation dates, etc.) They are accessed through APIs and often a web interface.

A

Object storage

71
Q

This term describes the relationship between shareholders and stakeholders versus senior management of the corporation.

A

Corporate governance

72
Q

This controls the entire infrastructure. As such, part of it will be exposed to customers independent of their location, thus making it a highly valued asset to be protected.

A

Management plane

73
Q

This term describes the granting the right of access to a program, process, or user.

A

Authorization

74
Q

This term describes the process or act of verification of eligibility of a station, originator, or individual to access specific categories of information. It is also designed to protect against fraudulent transmissions by establishing validity of the transmission or its originator.

A

Authentication

75
Q

Still a developing concept, this partly addresses the management of network components, the objective of which is to provide a control plane that can manage network traffic via an abstraction layer as opposed to direct device management.

A

Software defined networking (SDN)

76
Q

This service replicates data across the global Internet.

A

Content delivery network (CDN)

77
Q

This framework is designed to enable cooperation between cloud consumers and provider in demonstrating appropriate risk management.

A

Security Alliance’s Cloud Control Matrix (CCM)

78
Q

A managed database service, usually stored and operated in the cloud.

A

Database as a Service

79
Q

This methodology and toolset allow security professionals to leverage a common set of solutions to fulfill common needs in assessing the status of both their internal IT and cloud provider’s security capabilities and to create a roadmap to meet those needs.

A

TCI Reference Architecture

80
Q

This type of risk assessment uses a set of methods, principles, and rules based on the use of numbers. It also supports cost–benefit analyses of alternative risk responses.

A

Quantitative risk assessment

81
Q

This monitors inbound and outbound data packets from the device on which it is installed and alerts users or admins only if suspicious activity is detected.

A

Host intrusion-detection systems (HIDS)

82
Q

This particular cloud infrastructure is composed of two or more distinct and different cloud infrastructures (private, community, or public) and still remains a unique entity while bound together by standardized or proprietary technologies that enables data and application portability (e.g., cloud bursting, for load balancing between clouds).

A

Hybrid cloud

83
Q

The database used for mapping DNS domain names to various types of data such as IP addresses. This hierarchical database permits us to use human-readable or “friendly” names, such as www.isc2.org, to locate computers and resources associated with that name without having to know the IP address associated with the object.

A

Domain Name System (DNS)

84
Q

A newer, more secure form of the original, that involves a suite of extensions to add security to the DNS protocol that enables DNS responses to be validated. Specifically, it provides for origin authority, data integrity in responses, and authenticated denial of existence.

A

Domain Name System Security Extensions (DNSSEC)

85
Q

This type of cloud infrastructure is provisioned for use by a single entity (organization, corporation, etc.) consisting of many consumers. It can be owned, operated, and/or managed by the organization itself, a third party, or some combination of the two and may exist either on or off premises.

A

Private cloud

86
Q

This type of cloud infrastructure is designed for use by a specific community of organizations with shared concerns (e.g., mission, security requirements, policy, and/or compliance considerations).

A

Community cloud

87
Q

This type of networking model for cloud deployments is designed with standard perimeter protection mechanisms, with the underlying storage and IP networks converged to maximize benefits for the cloud workload.

A

Converged networking model

88
Q

This term is often referred to as a device but is actually a method of analyzing risk in software systems. It involves a centralized collection and monitoring of security- and event-related logs from in-scope systems. It then provides for the correlation of different events and early detection of attacks.

A

Security information and event management (SIEM)

89
Q

This type of assessment typically employs methods, principles, or rules for assessing risk based on non-numerical values such as high, medium, and low.

A

Qualitative assessment

90
Q

This protocol allows separate channels to carry presentation data, serial device communication, licensing, and highly encrypted data (keyboard and mouse activity).

A

Remote Desktop Protocol (RDP)

91
Q

This networking model uses a layered approach with physical switches at the top layer and logical separation occurring at the hypervisor level.

A

Traditional networking model

92
Q

This term describes datacenter networks, logically divided into smaller, isolated networks that share the physical networking gear but operate separately without visibility into other logical networks.

A

Multitenancy

93
Q

This determines in which legal jurisdiction a dispute will be heard when a conflict of law occurs.

A

Doctrine of the Proper Law

94
Q

This particular SOC report on controls at service organizations is relevant to the user entities’ internal controls over financial reporting.

A

Service Organizations Controls 1 (SOC 1)

95
Q

This law was passed as a means to protect shareholders as well as the general public from accounting errors and fraudulent practices.

A

Sarbanes-Oxley Act (SOX)

96
Q

The process of identifying, collecting, documenting, structuring, and communicating information from various sources in order to enable educated and swift decision making to occur.

A

Information gathering

97
Q

This banking law was enacted as a way of controlling the ways that financial institutions safeguard the private information of individuals with whom they conduct business.

A

Gramm-Leach-Bliley Act (GLBA)

98
Q

The rules, statues, and body of law that define conduct that is prohibited by the government and are designed to protect the safety and well-being of the public.

A

Criminal law

99
Q

This term refers to processes involved where electronic data is sought, located, secured, and searched for with the intent of using it as evidence in criminal or civil proceedings.

A

eDiscovery

100
Q

This international law introduces significant changes for data processor and controllers, including the concept of consent, transfers abroad, the right to be forgotten, establishment of the role of “data protection officer” access requests, home state regulation, and increased sanctions.

A

EU General Data Protection (EGDP) Regulation 2012

101
Q

This law from 1986 was created as part of the Electronic Communications Privacy Act and provides for privacy protection of certain types of electronic communication and computing services from unauthorized access or interception.

A

Stored Communication Act

102
Q

This body of rights, obligations, and remedies describes the remedies and reliefs for anyone suffering harm as a result of the wrongful act or acts of another.

A

Tort law

103
Q

This report on Controls at a Service Organization are focused on the security, availability, processing integrity, confidentiality, and privacy of the organization and its controls.

A

Service Organization Controls 2 (SOC 2)

104
Q

This 1988 act relates to the regulation with respect to the handling of personal information about individuals, including the collection, use, storage, and disclosure of personal information, and access to and the ability to correct misinformation.

A

Australian Privacy Act 1988

105
Q

In 1996 this healthcare law was passed that provided national standards for electronic healthcare transactions, and national identifiers for providers, health plans, and employers

A

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

106
Q

This process is a way of deliberately destroying the encryption keys used to originally encrypt data.

A

Crypto-shredding

107
Q

This technique involves the splitting up and storing of encrypted information across different cloud storage services. It is virtually impossible to reconstruct without the proper keys.

A

Bit splitting

108
Q

This important activity determines the impact of losing support of any particular resource to an organization, helps establish the escalation of that loss over time, identifies the minimum resources needed to recover the support or asset, and prioritizes the recovery processes and supporting systems.

A

Business impact analysis (BIA)

109
Q

This term refers to the security and encryption designed to prevent unauthorized copying and limitation of distribution to those who have purchased the rights.

A

Digital Rights Management (DRM)

110
Q

This activity is designed to prevent unauthorized data exfiltration.

A

Data loss prevention

111
Q

These mechanisms act to restrict a list of possible actions down to allowed or permitted actions.

A

Control

112
Q

This special mathematical code allows encryption hardware and/or software to encrypt and decipher encrypted messages.

A

Encryption key

113
Q

The overt or secret writing technique using a bidirectional mathematical algorithm that transforms plain text into unintelligible cipher text.

A

Encryption

114
Q

This method of erasure uses strong magnets for scrambling data on magnetic media such as hard drives and tape so that data is not recoverable.

A

Degaussing

115
Q

This special type of encryption or encryption technique allows encrypted data to be processed without first decrypting. It is extremely slow due to the intense mathematical calculations and as a result is not practical at this time.

A

Homomorphic encryption

116
Q

This cloud model provides a complete infrastructure and allows companies to install software on provisioned servers and control the configuration of all devices.

A

Infrastructure as a Service (IaaS)

117
Q

This activity revolves around the generation, storage, distribution, deletion, archiving, and application of keys in accordance with security policies.

A

Key management

CCSP Exam (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions