Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CCSP-GratisEaxm > Question #001-100 > Flashcards

Question #001-100 Flashcards

(100 cards)

Start Studying
1
Q

Which of the following is not a component of contractual PII?
A. Scope of processing
B. Value of data
C. Location of data
D. Use of subcontractors

A

Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
Explanation:
The value of data itself has nothing to do with it being considered a part of contractua

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which of the following concepts refers to a cloud customer paying only for the resources and offerings they use within a cloud environment, and only for the duration that they are consuming them?
A. Consumable service
B. Measured service
C. Billable service
D. Metered service

A

Correct Answer: B
Section: (none) Explanation
Explanation/Reference:
Explanation:
Measured service is where cloud services are delivered and billed in a metered way, where the cloud customer only pays for those that they actually use, and for the duration of time that they use them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

QUESTION 3
Which of the following roles involves testing, monitoring, and securing cloud services for an organization?
A. Cloud service integrator
B. Cloud service business manager
C. Cloud service user
D. Cloud service administrator

A

Correct Answer: D Section: (none) Explanation
Explanation/Reference:
Explanation:
The cloud service administrator is responsible for testing cloud services, monitoring services, administering security for services, providing usage reports on cloud services, and addressing problem reports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which data formats are most commonly used with the REST API?
A. JSON and SAML
B. XML and SAML
C. XML and JSON
D. SAML and HTML

A

Correct Answer: C
Section: (none) Explanation
Explanation/Reference:
Explanation:
JavaScript Object Notation (JSON) and Extensible Markup Language (XML) are the most commonly used data formats for the Representational State Transfer (REST) API, and are typically implemented with caching for increased scalability and performance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which of the following threat types involves an application that does not validate authorization for portions of itself after the initial checks?
A. Injection
B. Missing function-level access control
C. Cross-site request forgery
D. Cross-site scripting

A

Correct Answer: B
Section: (none) Explanation
Explanation/Reference:
Explanation:
It is imperative that an application perform checks when each function or portion of the application is accessed, to ensure that the user is properly authorized to access it. Without continual checks each time a function is accessed, an attacker could forge requests to access portions of the application where authorization has not been granted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which of the following roles involves overseeing billing, purchasing, and requesting audit reports for an organization within a cloud environment?
A. Cloud service user
B. Cloud service business manager
C. Cloud service administrator
D. Cloud service integrator

A

Correct Answer: B
Section: (none) Explanation
Explanation/Reference:
Explanation:
The cloud service business manager is responsible for overseeing business and billing administration, purchasing cloud services, and requesting audit reports when necessary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which of the following cloud aspects complicates eDiscovery?
A. Resource pooling
B. On-demand self-service
C. Multitenancy
D. Measured service

A

Correct Answer: C
Section: (none) Explanation
Explanation/Reference:
Explanation:
With multitenancy, eDiscovery becomes more complicated because the data collection involves extra steps to ensure that only those customers or systems that are within scope are turned over to the requesting authority.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does the management plane typically utilize to perform administrative functions on the hypervisors that it has access to?
A. Scripts
B. RDP
C. APIs
D. XML

A

Correct Answer: C
Section: (none) Explanation
Explanation/Reference:
Explanation:
The functions of the management plane are typically exposed as a series of remote calls and function executions and as a set of APIs. These APIs are typically leveraged through either a client or a web portal, with the latter being the most common.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a serious complication an organization faces from the perspective of compliance with international operations?
A. Different certifications
B. Multiple jurisdictions
C. Different capabilities
D. Different operational procedures

A

Correct Answer: B
Section: (none) Explanation
Explanation/Reference:
Explanation:
When operating within a global framework, a security professional runs into a multitude of jurisdictions and requirements, and many times they might be in contention with one other or not clearly applicable. These requirements can include the location of the users and the type of data they enter into systems, the laws governing the organization that owns the application and any regulatory requirements they may have, as well as the appropriate laws and regulations for the jurisdiction housing the IT resources and where the data is actually stored, which might be multiple jurisdictions as well.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which of the following standards primarily pertains to cabling designs and setups in a data center?
A. IDCA
B. BICSI
C. NFPA
D. Uptime Institute

A

Correct Answer: B
Section: (none) Explanation
Explanation/Reference:
Explanation:
The standards put out by Building Industry Consulting Service International (BICSI) primarily cover complex cabling designs and setups for data centers, but also include specifications on power, energy efficiency, and hot/cold aisle setups.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which of the following is NOT a criterion for data within the scope of eDiscovery?
A. Possession
B. Custody
C. Control
D. Archive

A

Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
Explanation: eDiscovery pertains to information and data that is in the possession, control, and custody of an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which United States law is focused on accounting and financial practices of organizations?
A. Safe Harbor
B. GLBA
C. SOX
D. HIPAA

A

Correct Answer: C
Section: (none) Explanation
Explanation/Reference: Explanation:
The Sarbanes-Oxley (SOX) Act is not an act that pertains to privacy or IT security directly, but rather regulates accounting and financial practices used by organizations. It was passed to protect stakeholders and shareholders from improper practices and errors, and it sets forth rules for compliance, regulated and enforced by the Securities and Exchange Commission (SEC). The main influence on IT systems and operations is the requirements it sets for data retention, specifically in regard to what types of records must be preserved and for how long.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which of the following storage types is most closely associated with a database-type storage implementation?
A. Object
B. Unstructured
C. Volume
D. Structured

A

Correct Answer: D
Section: (none) Explanation
Explanation/Reference:
Explanation:
Structured storage involves organized and categorized data, which most closely resembles and operates like a database system would.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which of the following roles is responsible for overseeing customer relationships and the processing of financial transactions?
A. Cloud service manager
B. Cloud service deployment
C. Cloud service business manager
D. Cloud service operations manager

A

Correct Answer: C
Section: (none) Explanation
Explanation/Reference:
Explanation:
The cloud service business manager is responsible for overseeing business plans and customer relationships as well as processing financial transactions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the biggest benefit to leasing space in a data center versus building or maintain your own?
A. Certification
B. Costs
C. Regulation
D. Control

A

Correct Answer: B
Section: (none) Explanation
Explanation/Reference:
Explanation:
When leasing space in a data center, an organization can avoid the enormous startup and building costs associated with a data center, and can instead leverage economies of scale by grouping with other organizations and sharing costs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which aspect of cloud computing will be most negatively impacted by vendor lock-in?
A. Elasticity
B. Reversibility
C. Interoperability
D. Portability

A

Correct Answer: D
Section: (none)
Explanation
Explanation/Reference:
Explanation:
A cloud customer utilizing proprietary APIs or services from one cloud provider that are unlikely to be available from another cloud provider will most negatively impact portability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which of the following APIs are most commonly used within a cloud environment?
A. REST and SAML
B. SOAP and REST
C. REST and XML
D. XML and SAML

A

Correct Answer: B
Section: (none) Explanation
Explanation/Reference:
Explanation:
Simple Object Access Protocol (SOAP) and Representational State Transfer (REST) are the most commonly used APIs within a cloud environment. Extensible Markup Language (XML) and Security Assertion Markup Language (SAML) are both standards for exchanging encoded data between two parties, with XML being for more general use and SAML focused on authentication and authorization data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which of the following roles is responsible for obtaining new customers and securing contracts and agreements?
A. Inter-cloud provider
B. Cloud service broker
C. Cloud auditor
D. Cloud service developer

A

Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
Explanation:
The cloud service broker is responsible for obtaining new customers, analyzing the marketplace, and securing contracts and agreements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which term relates to the application of scientific methods and practices to evidence?
A. Forensics
B. Methodical
C. Theoretical
D. Measured

A

Correct Answer: A
Section: (none) Explanation
Explanation/Reference: Explanation:
Forensics is the application of scientific and methodical processes to identify, collect, preserve, analyze, and summarize/report digital information and evidence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the primary reason that makes resolving jurisdictional conflicts complicated?
A. Different technology standards
B. Costs
C. Language barriers
D. Lack of international authority

A

Correct Answer: D
Section: (none) Explanation
Explanation/Reference:
Explanation:
With international operations, systems ultimately cross many jurisdictional boundaries, and many times, they conflict with each other. The major hurdle to overcome for an organization is the lack of an ultimate international authority to mediate such conflicts, with a likely result of legal efforts in each jurisdiction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

GAAPs are created and maintained by which organization?
A. ISO/IEC
B. AICPA
C. PCI Council
D. ISO

A

Correct Answer: B
Section: (none) Explanation
Explanation/Reference:
Explanation:
The AICPA is the organization responsible for generating and maintaining what are the Generally Accepted Accounting Practices in the United States.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which of the following roles is responsible for preparing systems for the cloud, administering and monitoring services, and managing inventory and assets?
A. Cloud service business manager
B. Cloud service deployment manager
C. Cloud service operations manager
D. Cloud service manager

A

Correct Answer: C
Section: (none)
Explanation
Explanation/Reference:
Explanation:
The cloud service operations manager is responsible for preparing systems for the cloud, administering and monitoring services, providing audit data as requested or required, and managing inventory and assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which protocol allows a system to use block-level storage as if it was a SAN, but over TCP network traffic instead?
A. SATA
B. iSCSI
C. TLS
D. SCSI

A

Correct Answer: B
Section: (none) Explanation
Explanation/Reference:
Explanation:
iSCSI is a protocol that allows for the transmission and use of SCSI commands and features over a TCP-based network. iSCSI allows systems to use block-level storage that looks and behaves as a SAN would with physical servers, but to leverage the TCP network within a virtualized environment and cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which of the cloud deployment models is used by popular services such as iCloud, Dropbox, and OneDrive?
A. Hybrid
B. Public
C. Private
D. Community

A

Correct Answer: B Section: (none) Explanation
Explanation/Reference:
Explanation:
Popular services such as iCloud, Dropbox, and OneDrive are all publicly available and are open to any user for free, with possible add-on services offered for a cost.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Which is the appropriate phase of the cloud data lifecycle for determining the data's classification? A. Create B. Use C. Share D. Store
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Any time data is created, modified, or imported, the classification needs to be evaluated and set from the earliest phase to ensure security is always properly maintained for the duration of its lifecycle.
26
Which jurisdiction lacks specific and comprehensive privacy laws at a national or top level of legal authority? A. European Union B. Germany C. Russia D. United States
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: The United States lacks a single comprehensive law at the federal level addressing data security and privacy, but there are multiple federal laws that deal with different industries.
27
Which of the following threat types can occur when encryption is not properly applied or insecure transport mechanisms are used? A. Security misconfiguration B. Insecure direct object references C. Sensitive data exposure D. Unvalidated redirects and forwards
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Sensitive data exposure occurs when information is not properly secured through encryption and secure transport mechanisms; it can quickly become an easy and broad method for attackers to compromise information. Web applications must enforce strong encryption and security controls on the application side, but secure methods of communications with browsers or other clients used to access the information are also required. Security misconfiguration occurs when applications and systems are not properly configured for security, often a result of misapplied or inadequate baselines. Insecure direct object references occur when code references aspects of the infrastructure, especially internal or private systems, and an attacker can use that knowledge to glean more information about the infrastructure. Unvalidated redirects and forwards occur when an application has functions to forward users to other sites, and these functions are not properly secured to validate the data and redirect requests, thus allowing spoofing for malware or phishing attacks.
28
Which type of cloud model typically presents the most challenges to a cloud customer during the "destroy" phase of the cloud data lifecycle? A. IaaS B. DaaS C. SaaS D. PaaS
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: With many SaaS implementations, data is not isolated to a particular customer but rather is part of the overall application. When it comes to data destruction, a particular challenge is ensuring that all of a customer's data is completely destroyed while not impacting the data of other customers.
29
hich of the following may unilaterally deem a cloud hosting model inappropriate for a system or application? A. Multitenancy B. Certification C. Regulation D. Virtualization
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Some regulations may require specific security controls or certifications be used for hosting certain types of data or functions, and in some circumstances they may be requirements that are unable to be met by any cloud provider.
30
Which of the following is considered an internal redundancy for a data center? A. Power distribution units B. Network circuits C. Power substations D. Generators
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Power distribution units are internal to a data center and supply power to internal components such as racks, appliances, and cooling systems. As such, they are considered an internal redundancy.
31
Which of the following represents a control on the maximum amount of resources that a single customer, virtual machine, or application can consume within a cloud environment? A. Share B. Reservation C. Provision D. Limit
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Limits are put in place to enforce a maximum on the amount of memory or processing a cloud customer can use. This can be done either on a virtual machine or as a comprehensive whole for a customer, and is meant to ensure that enormous cloud resources cannot be allocated or consumed by a single host or customer to the detriment of other hosts and customers.
32
Which of the following roles is responsible for peering with other cloud services and providers? A. Cloud auditor B. Inter-cloud provider C. Cloud service broker D. Cloud service developer
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: The inter-cloud provider is responsible for peering with other cloud services and providers, as well as overseeing and managing federations and federated services.
33
Which of the following does NOT relate to the hiding of sensitive data from data sets? A. Obfuscation B. Federation C. Masking D. Anonymization
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Federation pertains to authenticating systems between different organizations.
34
Which of the following are the storage types associated with IaaS? A. Volume and object B. Volume and label C. Volume and container D. Object and target
Correct Answer: A Section: (none) Explanation Explanation/Reference:
35
Which of the following represents a prioritization of applications or cloud customers for the allocation of additional requested resources when there is a limitation on available resources? A. Provision B. Limit C. Reservation D. Share
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: The concept of shares within a cloud environment is used to mitigate and control the request for resource allocations from customers that the environment may not have the current capability to allow. Shares work by prioritizing hosts within a cloud environment through a weighting system that is defined by the cloud provider. When periods of high utilization and allocation are reached, the system automatically uses scoring of each host based on its share value to determine which hosts get access to the limited resources still available. The higher the value a particular host has, the more resources it will be allowed to utilize.
36
Which of the following statements accurately describes VLANs? A. They are not restricted to the same data center or the same racks. B. They are not restricted to the name rack but restricted to the same data center. C. They are restricted to the same racks and data centers. D. They are not restricted to the same rack but restricted to same switches.
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: A virtual area network (VLAN) can span any networks within a data center, or it can span across different physical locations and data centers.
37
What must be secured on physical hardware to prevent unauthorized access to systems? A. BIOS B. SSH C. RDP D. ALOM
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: BIOS is the firmware that governs the physical initiation and boot up of a piece of hardware. If it is compromised, an attacker could have access to hosted systems and make configurations changes to expose or disable some security elements on the system.
38
What type of PII is regulated based on the type of application or per the conditions of the specific hosting agreement? A. Specific B. Contractual C. regulated D. Jurisdictional
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Contractual PII has specific requirements for the handling of sensitive and personal information, as defined at a contractual level. These specific requirements will typically document the required handling procedures and policies to deal with PII. They may be in specific security controls and configurations, required policies or procedures, or limitations on who may gain authorized access to data and systems.
39
Which concept BEST describes the capability for a cloud environment to automatically scale a system or application, based on its current resource demands? A. On-demand self-service B. Resource pooling C. Measured service D. Rapid elasticity
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Rapid elasticity allows a cloud environment to automatically add or remove resources to or from a system or application based on its current demands. Whereas a traditional data center model would require standby hardware and substantial effort to add resources in response to load increases, a cloud environment can easily and rapidly expand to meet resources demands, so long as the application is properly implemented for it.
40
If you're using iSCSI in a cloud environment, what must come from an external protocol or application? A. Kerberos support B. CHAP support C. Authentication D. Encryption
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: iSCSI does not natively support encryption, so another technology such as IPsec must be used to encrypt communications.
41
Which of the following pertains to a macro level approach to data center design rather than the traditional tiered approach to data centers? A. IDCA B. NFPA C. BICSI D. Uptime Institute
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: The standards put out by the International Data Center Authority (IDCA) have established the Infinity Paradigm, which is intended to be a comprehensive data center design and operations framework. The Infinity Paradigm shifts away from many models that rely on tiered architecture for data centers, where each successive tier increases redundancy. Instead, it emphasizes data centers being approached at a macro level, without a specific and isolated focus on certain aspects to achieve tier status.
42
Why does a Type 1 hypervisor typically offer tighter security controls than a Type 2 hypervisor? A. A Type 1 hypervisor also controls patching of its hosted virtual machines ensure they are always secure. B. A Type 1 hypervisor is tied directly to the bare metal and only runs with code necessary to perform its specific mission. C. A Type 1 hypervisor performs hardware-level encryption for tighter security and efficiency. D. A Type 1 hypervisor only hosts virtual machines with the same operating systems as the hypervisor.
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Type 1 hypervisors run directly on top of the bare metal and only contain the code and functions required to perform their purpose. They do not rely on any other systems or contain extra features to secure.
43
What is the data encapsulation used with the SOAP protocol referred to? A. Packet B. Envelope C. Payload D. Object
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Simple Object Access Protocol (SOAP) encapsulates its information in what is known as a SOAP envelope and then leverages common communications protocols for transmission.
44
What is the biggest negative to leasing space in a data center versus building or maintain your own? A. Costs B. Control C. Certification D. Regulation
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: When leasing space in a data center, an organization will give up a large degree of control as to how it is built and maintained, and instead must conform to the policies and procedures of the owners and operators of the data center.
45
Which aspect of archiving must be tested regularly for the duration of retention requirements? A. Availability B. Recoverability C. Auditability D. Portability
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: In order for any archiving system to be deemed useful and compliant, regular tests must be performed to ensure the data can still be recovered and accessible, should it ever be needed, for the duration of the retention requirements.
46
Which of the following represents a minimum guaranteed resource within a cloud environment for the cloud customer? A. Reservation B. Share C. Limit D. Provision
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: A reservation is a minimum resource that is guaranteed to a customer within a cloud environment. Within a cloud, a reservation can pertain to the two main aspects of computing: memory and processor. With a reservation in place, the cloud provider guarantees that a cloud customer will always have at minimum the necessary resources available to power on and operate any of their services.
47
Which of the following is the biggest concern or challenge with using encryption? A. Dependence on keys B. Cipher strength C. Efficiency D. Protocol standards
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: No matter what kind of application, system, or hosting model used, encryption is 100 percent dependent on encryption keys. Properly securing the keys and the exchange of them is the biggest and most important challenge of encryption systems.
48
Which technology is NOT commonly used for security with data in transit? A. DNSSEC B. IPsec C. VPN D. HTTPS
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: DNSSEC relates to the integrity of DNS resolutions and the prevention of spoofing or redirection, and does not pertain to the actual security of transmissions or the protection of data.
49
Which of the following roles is responsible for gathering metrics on cloud services and managing cloud deployments and the deployment processes? A. Cloud service business manager B. Cloud service operations manager C. Cloud service manager D. Cloud service deployment manager
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: The cloud service deployment manager is responsible for gathering metrics on cloud services, managing cloud deployments and the deployment process, and defining the environments and processes.
50
What is the first stage of the cloud data lifecycle where security controls can be implemented? A. Use B. Store C. Share D. Create
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: The "store" phase of the cloud data lifecycle, which typically occurs simultaneously with the "create" phase, or immediately thereafter, is the first phase where security controls can be implemented. In most case, the manner in which the data is stored will be based on its classification.
51
QUESTION 51 What controls the formatting and security settings of a volume storage system within a cloud environment? A. Management plane B. SAN host controller C. Hypervisor D. Operating system of the host
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Once a storage LUN is allocated to a virtual machine, the operating system of that virtual machine will format, manage, and control the file system and security of the data on that LUN.
52
QUESTION 52 From a legal perspective, what is the most important first step after an eDiscovery order has been received by the cloud provider? A. Notification B. Key identification C. Data collection D. Virtual image snapshots
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: The contract should include requirements for notification by the cloud provider to the cloud customer upon the receipt of such an order. This serves a few important purposes. First, it keeps communication and trust open between the cloud provider and cloud customers. Second, and more importantly, it allows the cloud customer to potentially challenge the order if they feel they have the grounds or desire to do so.
53
QUESTION 53 Which of the following would make it more likely that a cloud provider would be unwilling to satisfy specific certification requirements? A. Resource pooling B. Virtualization C. Multitenancy D. Regulation
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: With cloud providers hosting a number of different customers, it would be impractical for them to pursue additional certifications based on the needs of a specific customer. Cloud environments are built to a common denominator to serve the greatest number of customers, and especially within a public cloud model, it is not possible or practical for a cloud provider to alter their services for specific customer demands.
54
QUESTION 54 Which of the following pertains to fire safety standards within a data center, specifically with their enormous electrical consumption? A. NFPA B. BICSI C. IDCA D. Uptime Institute
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: The standards put out by the National Fire Protection Association (NFPA) cover general fire protection best practices for any type of facility, but also specific publications pertaining to IT equipment and data centers.
55
QUESTION 55 Which technique involves replacing values within a specific data field to protect sensitive data? A. Anonymization B. Masking C. Tokenization D. Obfuscation
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Masking involves replacing specific data within a data set with new values. For example, with credit card fields, as most who have ever purchased anything online can attest, nearly the entire credit card number is masked with a character such as an asterisk, with the last four digits left visible for identification and confirmation.
56
QUESTION 56 What expectation of data custodians is made much more challenging by a cloud implementation, especially with PaaS or SaaS? A. Data classification B. Knowledge of systems C. Access to data D. Encryption requirements
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Under the Federal Rules of Civil Procedure, data custodians are assumed and expected to have full and comprehensive knowledge of the internal design and architecture of their systems. In a cloud environment, especially with PaaS and SaaS, it is impossible for the data custodian to have this knowledge because those systems are controlled by the cloud provider and protected as proprietary knowledge.
57
QUESTION 57 What type of PII is controlled based on laws and carries legal penalties for noncompliance with requirements? A. Contractual B. Regulated C. Specific D. Jurisdictional
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Regulated PII involves those requirements put forth by specific laws or regulations, and unlike contractual PII, where a violation can lead to contractual penalties, a violation of regulated PII can lead to fines or even criminal charges in some jurisdictions. PII regulations can depend on either the jurisdiction that applies to the hosting location or application or specific legislation based on the industry or type of data used.
58
QUESTION 58 Which if the following is NOT one of the three components of a federated identity system transaction? A. Relying party B. Identity provider C. User D. Proxy relay
Correct Answer: D
59
Which value refers to the amount of time it takes to recover operations in a BCDR situation to meet management's objectives? A. RSL B. RPO C. SRE D. RTO
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: The recovery time objective (RTO) is a measure of the amount of time it would take to recover operations in the event of a disaster to the point where management's objectives are met for BCDR.
60
QUESTION 60 Which of the cloud deployment models requires the cloud customer to be part of a specific group or organization in order to host cloud services within it? A. Community B. Hybrid C. Private D. Public
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: A community cloud model is where customers that share a certain common bond or group membership come together to offer cloud services to their members, focused on common goals and interests.
61
QUESTION 61 What provides the information to an application to make decisions about the authorization level appropriate when granting access? A. User B. Relying party C. Federation D. Identity Provider
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Upon successful user authentication, the identity provider gives information about the user to the relying party that it needs to make authorization decisions for granting access as well as the level of access needed.
62
QUESTION 62 What is a standard configuration and policy set that is applied to systems and virtual machines called? A. Standardization B. Baseline C. Hardening D. Redline
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: The most common and efficient manner of securing operating systems is through the use of baselines. A baseline is a standardized and understood set of base configurations and settings. When a new system is built or a new virtual machine is established, baselines will be applied to a new image to ensure the base configuration meets organizational policy and regulatory requirements.
63
QUESTION 63 Which entity requires all collection and storing of data on their citizens to be done on hardware that resides within their borders? A. Russia B. France C. Germany D. United States
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Signed into law and effective starting on September 1, 2015, Russian Law 526-FZ establishes that any collecting, storing, or processing of personal information or data on Russian citizens must be done from systems and databases that are physically located with the Russian Federation.
64
QUESTION 64 Which of the cloud cross-cutting aspects relates to the ability to easily move services and applications between different cloud providers? A. Reversibility B. Availability C. Portability D. Interoperability
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Portability is the ease with which a service or application can be moved between different cloud providers. Maintaining portability gives an organization great flexibility between cloud providers and the ability to shop for better deals or offerings.
65
QUESTION 65 Which type of audit report is considered a "restricted use" report for its intended audience? A. SAS-70 B. SSAE-16 C. SOC Type 1 D. SOC Type 2
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: SOC Type 1 reports are considered "restricted use" reports. They are intended for management and stakeholders of an organization, clients of the service organization, and auditors of the organization. They are not intended for release beyond those audiences.
66
QUESTION 66 Which of the following is the MOST important requirement and guidance for testing during an audit? A. Stakeholders B. Shareholders C. Management D. Regulations
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: During any audit, regulations are the most important factor and guidelines for what must be tested. Although the requirements from management, stakeholders, and shareholders are also important, regulations are not negotiable and pose the biggest risk to any organization for compliance failure.
67
QUESTION 67 Which value refers to the amount of data an organization would need to recover in the event of a BCDR situation in order to reach an acceptable level of operations? A. SRE B. RTO C. RPO D. RSL
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: The recovery point objective (RPO) is defined as the amount of data a company would need to maintain and recover in order to function at a level acceptable to management. This may or may not be a restoration to full operating capacity, depending on what management deems as crucial and essential.
68
QUESTION 68 What must SOAP rely on for security? A. Encryption B. Tokenization C. TLS D. SSL
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Simple Object Access Protocol (SOAP) uses Extensible Markup Language (XML) for passing data, and it must rely on the encryption of those data packages for security.
69
QUESTION 69 What type of data does data rights management (DRM) protect? A. Consumer B. PII C. Financial D. Healthcare
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: DRM applies to the protection of consumer media, such as music, publications, video, movies, and soon.
70
QUESTION 70 Which type of testing uses the same strategies and toolsets that hackers would use? A. Penetration B. Dynamic C. Static D. Malicious
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Penetration testing involves using the same strategies and toolsets that hackers would use against a system to discovery potential vulnerabilities.
71
QUESTION 71 Which of the following is NOT a focus or consideration of an internal audit? A. Certification B. Design C. Costs D. Operational efficiency
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: In order to obtain and comply with certifications, independent external audits must be performed and satisfied. Although some testing of certification controls can be part of an internal audit, they will not satisfy requirements.
72
QUESTION 72 What process is used within a clustered system to provide high availability and load balancing? A. Dynamic balancing B. Dynamic clustering C. Dynamic optimization D. Dynamic resource scheduling
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Dynamic resource scheduling (DRS) is used within all clustering systems as the method for clusters to provide high availability, scaling, management, and workload distribution and balancing of jobs and processes. From a physical infrastructure perspective, DRS is used to balance compute loads between physical hosts in a cloud to maintain the desired thresholds and limits on the physical hosts.
73
QUESTION 73 What changes are necessary to application code in order to implement DNSSEC? A. Adding encryption modules B. Implementing certificate validations C. Additional DNS lookups D. No changes are needed.
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: To implement DNSSEC, no additional changes are needed to applications or their code because the integrity checks are all performed at the system level
74
QUESTION 74 Which type of controls are the SOC Type 1 reports specifically focused on? A. Integrity B. PII C. Financial D. Privacy
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: SOC Type 1 reports are focused specifically on internal controls as they relate to financial reporting.
75
QUESTION 75 Which of the following is NOT a domain of the Cloud Controls Matrix (CCM)? A. Data center security B. Human resources C. Mobile security D. Budgetary and cost controls
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Budgetary and cost controls is not one of the domains outlined in the CCM.
76
QUESTION 76 Which security concept, if implemented correctly, will protect the data on a system, even if a malicious actor gains access to the actual system? A. Sandboxing B. Encryption C. Firewalls D. Access control
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: In any environment, data encryption is incredibly important to prevent unauthorized exposure of data either internally or externally. If a system is compromised by an attack, having the data encrypted on the system will prevent its unauthorized exposure or export, even with the system itself being exposed.
77
QUESTION 77 Which of the following is NOT a factor that is part of a firewall configuration? A. Encryption B. Port C. Protocol D. Source IP
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Firewalls take into account source IP, destination IP, the port the traffic is using, as well as the network protocol (UDP/TCP). Whether or not the traffic is encrypted is not something a firewall is concerned with.
78
QUESTION 78 Which of the cloud deployment models involves spanning multiple cloud environments or a mix of cloud hosting models? A. Community B. Public C. Hybrid D. Private
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: A hybrid cloud model involves the use of more than one type of cloud hosting models, typically the mix of private and public cloud hosting models.
79
QUESTION 79 Which of the following is NOT one of five principles of SOC Type 2 audits? A. Privacy B. Processing integrity C. Financial D. Security
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: The SOC Type 2 audits include five principles: security, privacy, processing integrity, availability, and confidentiality.
80
QUESTION 80 Which aspect of cloud computing makes data classification even more vital than in a traditional data center? A. Interoperability B. Virtualization C. Multitenancy D. Portability
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: With multiple tenants within the same hosting environment, any failure to properly classify data may lead to potential exposure to other customers and applications within the same environment.
81
QUESTION 81 What concept does the "T" represent in the STRIDE threat model? A. TLS B. Testing C. Tampering with data D. Transport
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation Any application that sends data to the user will face the potential that the user could manipulate or alter the data, whether it resides in cookies, GET or POST commands, or headers, or manipulates client-side validations. If the user receives data from the application, it is crucial that the application validate and verify any data that is received back from the user.
82
QUESTION 82 Which of the following would be a reason to undertake a BCDR test? A. Functional change of the application B. Change in staff C. User interface overhaul of the application D. Change in regulations
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Any time a major functional change of an application occurs, a new BCDR test should be done to ensure the overall strategy and process are still applicable and appropriate.
83
QUESTION 83 Which crucial aspect of cloud computing can be most threatened by insecure APIs? A. Automation B. Redundancy C. Resource pooling D. Elasticity
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Cloud environments depend heavily on API calls for management and automation. Any vulnerability with the APIs can cause significant risk and exposure to all tenants of the cloud environment.
84
QUESTION 84 Which of the following should NOT be part of the requirement analysis phase of the software development lifecycle? A. Functionality B. Programming languages C. Software platform D. Security requirements
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: Security requirements should be incorporated into the software development lifecycle (SDLC) from the earliest requirement gathering stage and should be incorporated prior to the requirement analysis phase.
85
QUESTION 85 Which of the cloud cross-cutting aspects relates to the assigning of jobs, tasks, and roles, as well as to ensuring they are successful and properly performed? A. Service-level agreements B. Governance C. Regulatory requirements D. Auditability
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Governance at its core is the idea of assigning jobs, takes, roles, and responsibilities and ensuring they are satisfactory performed.
86
QUESTION 86 Which aspect of cloud computing makes it very difficult to perform repeat audits over time to track changes and compliance? A. Virtualization B. Multitenancy C. Resource pooling D. Dynamic optimization
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Cloud environments will regularly change virtual machines as patching and versions are changed. Unlike a physical environment, there is little continuity from one period of time to another. It is very unlikely that the same virtual machines would be in use during a repeat audit.
87
QUESTION 87 Which security concept would business continuity and disaster recovery fall under? A. Confidentiality B. Availability C. Fault tolerance D. Integrity
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Disaster recovery and business continuity are vital concerns with availability. If data is destroyed or compromised, having regular backup systems in place as well as being able to perform disaster recovery in the event of a major or widespread problem allows operations to continue with an acceptable loss of time and data to management. This also ensures that sensitive data is protected and persisted in the event of the loss or corruption of data systems or physical storage systems.
88
QUESTION 88 Which of the following is NOT a function performed by the record protocol of TLS? A. Encryption B. Acceleration C. Authentication D. Compression
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: The record protocol of TLS performs the authentication and encryption of data packets, and in some cases compression as well. It does not perform any acceleration functions.
89
QUESTION 89 What concept does the "R" represent with the DREAD model? A. Reproducibility B. Repudiation C. Risk D. Residual
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Reproducibility is the measure of how easy it is to reproduce and successful use an exploit. Scoring within the DREAD model ranges from 0, signifying a nearly impossibly exploit, up to 10, which signifies something that anyone from a simple function call could exploit, such as a URL.
90
QUESTION 90 The SOC Type 2 reports are divided into five principles. Which of the five principles must also be included when auditing any of the other four principles? A. Confidentiality B. Privacy C. Security D. Availability
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: Under the SOC guidelines, when any of the four principles other than security are being audited, which includes availability, confidentiality, processing integrity, and privacy, the security principle must also be included with the audit.
91
QUESTION 91 How many additional DNS queries are needed when DNSSEC integrity checks are added? A. Three B. Zero C. One D. Two
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: DNSSEC does not require any additional DNS queries to be performed. The DNSSEC integrity checks and validations are all performed as part of the single DNS lookup resolution.
92
QUESTION 92 Which of the following is a restriction that can be enforced by information rights management (IRM) that is not possible for traditional file system controls? A. Delete B. Modify C. Read D. Print
Correct Answer: D Section: (none) Explanation Explanation/Reference: Explanation: IRM allows an organization to control who can print a set of information. This is not be possible under traditional file system controls, where if a user can read a file, they are able to print it as well.
93
QUESTION 93 What type of security threat is DNSSEC designed to prevent? A. Account hijacking B. Snooping C. Spoofing D. Injection
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: DNSSEC is designed to prevent the spoofing and redirection of DNS resolutions to rogue sites.
94
QUESTION 94 Which European Union directive pertains to personal data privacy and an individual's control over their personal data? A. 99 /9/EC B. 95 /46/EC C. 2000/1 /EC D. 2013/27001 /EC
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Directive 95/46/EC is titled "On the protection of individuals with regard to the processing of personal data and on the free movement of such data."
95
QUESTION 95 Which data point that auditors always desire is very difficult to provide within a cloud environment? A. Access policy B. Systems architecture C. Baselines D. Privacy statement
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Cloud environments are constantly changing and often span multiple physical locations. A cloud customer is also very unlikely to have knowledge and insight into the underlying systems architecture in a cloud environment. Both of these realities make it very difficult, if not impossible, for an organization to provide a comprehensive systems design document.
96
QUESTION 96 What type of host is exposed to the public Internet for a specific reason and hardened to perform only that function for authorized users? A. Proxy B. Bastion C. Honeypot D. WAF
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: A bastion host is a server that is fully exposed to the public Internet, but is extremely hardened to prevent attacks and is usually dedicated for a specific application or usage; it is not something that will serve multiple purposes. This singular focus allows for much more stringent security hardening and monitoring.
97
QUESTION 97 Which of the cloud cross-cutting aspects relates to the requirements placed on the cloud provider by the cloud customer for minimum performance standards and requirements that must be met? A. Regulatory requirements B. SLAs C. Auditability D. Governance
Correct Answer: B Section: (none) Explanation Explanation/Reference: Explanation: Whereas a contract spells out general terms and costs for services, the SLA is where the real meat of the business relationship and concrete requirements come into play. The SLA spells out in clear terms the minimum requirements for uptime, availability, processes, customer service and support, security controls and requirements, auditing and reporting, and potentially many other areas that define the business relationship and the success of it.
98
QUESTION 98 Which of the following service capabilities gives the cloud customer the most control over resources and configurations? A. Desktop B. Platform C. Infrastructure D. Software
Correct Answer: C Section: (none) Explanation Explanation/Reference: Explanation: The infrastructure service capability gives the cloud customer substantial control in provisioning and configuring resources, including processing, storage, and network resources.
99
QUESTION 99 At which stage of the BCDR plan creation phase should security be included in discussions? A. Define scope B. Analyze C. Assess risk D. Gather requirements
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Security should be included in discussions from the very first phase when defining the scope. Adding security later is likely to incur additional costs in time and money, or will result in an incomplete or inadequate plan.
100
QUESTION 100 Which approach is typically the most efficient method to use for data discovery? A. Metadata B. Content analysis C. Labels D. ACLs
Correct Answer: A Section: (none) Explanation Explanation/Reference: Explanation: Metadata is data about data. It contains information about the type of data, how it is stored and organized, or information about its creation and use.

CCSP-GratisEaxm (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions