CCSP Practice Exam Questions and Answers

Because cloud providers will not give detailed information out about their infrastructures and practices to the general public, they will often use established auditing reports to ensure public trust, where the reputation of the auditors serves for assurance.

Which type of audit reports can be used for general public trust assurances?

What masking strategy involves the replacing of sensitive data at the time it is accessed and used as it flows between the data and application layers of a service?

Which of the following best describes a cloud carrier?

When data discovery is undertaken, three main approaches or strategies are commonly used to determine what the type of data, its format, and composition are for the purposes of classification.

Which of the following is NOT one of the three main approaches to data discovery?

In attempting to provide a layered defense, the security practitioner should convince senior management to include security controls of which type?

Gap analysis is performed for what reason?

As part of the auditing process, getting a report on the deviations between intended configurations and actual policy is often crucial for an organization.

What term pertains to the process of generating such a report?

Whereas a contract articulates overall priorities and requirements for a business relationship, which artifact enumerates specific compliance requirements, metrics, and response times?

In addition to whatever audit results the provider shares with the customer, what other mechanism does the customer have to ensure trust in the provider’s performance and duties?

Identity and access management (IAM) is a security discipline that ensures which of the following?

Limits for resource utilization can be set at different levels within a cloud environment to ensure that no particular entity can consume a level of resources that impacts other cloud customers.

Which of the following is NOT a unit covered by limits?

Which data sanitation method is also commonly referred to as "zeroing"?

Best practices for key management include all of the following, except:

Which of the following best describes the Organizational Normative Framework (ONF)?

What is the concept of isolating an application from the underlying operating system for testing purposes?

All of the following are terms used to described the practice of obscuring original raw data so that only a portion is displayed for operational purposes, except:

In a federated identity arrangement using a trusted third-party model, who is the identity provider and who is the relying party?

Which of the following is a management role, versus a technical role, as it pertains to data management and oversight?

Which of the following are attributes of cloud computing?

What must be secured on physical hardware to prevent unauthorized access to systems?

Which of the following roles is responsible for peering with other cloud services and providers?

Which protocol does the REST API depend on?

Which United States program was designed to enable organizations to bridge the gap between privacy laws and requirements of the United States and the European Union?

How is an object stored within an object storage system?

Which aspect of archiving must be tested regularly for the duration of retention requirements?

What are the two protocols that TLS uses?

Which of the following attempts to establish an international standard for eDiscovery processes and best practices?

Which of the following is not a risk management framework?

Which type of audit report does many cloud providers use to instill confidence in their policies, practices, and procedures to current and potential customers?

Which of the following roles is responsible for preparing systems for the cloud, administering and monitoring services, and managing inventory and assets?

Which of the following roles is responsible for gathering metrics on cloud services and managing cloud deployments and the deployment processes?

Which of the following roles is responsible for overseeing customer relationships and the processing of financial transactions?

Which of the following concepts refers to a cloud customer paying only for the resources and offerings they use within a cloud environment, and only for the duration that they are consuming them?

Which of the following pertains to fire safety standards within a data center, specifically with their enormous electrical consumption?

Which of the following pertains to a macro level approach to data center design rather than the traditional tiered approach to data centers?

Which of the following cloud aspects complicates eDiscovery?

Which of the following statements accurately describes VLANs?

What type of PII is regulated based on the type of application or per the conditions of the specific hosting agreement?

Which of the following is NOT an application or utility to apply and enforce baselines on a system?

Which regulatory system pertains to the protection of healthcare data?

Which of the following does NOT fall under the "IT" aspect of quality of service (QoS)?

Which of the cloud cross-cutting aspects relates to the requirements placed on the cloud provider by the cloud customer for minimum performance standards and requirements that must be met?

Which security concept is based on preventing unauthorized access to data while also ensuring that it is accessible to those authorized to use it?

At which stage of the BCDR plan creation phase should security be included in discussions?

What concept does the "I" represent with the STRIDE threat model?

Which of the cloud cross-cutting aspects relates to the requirements placed on a system or application by law, policy, or requirements from standards?

What does dynamic application security testing (DAST) NOT entail?

Which of the following is NOT part of a retention policy?

Which of the following is NOT a function performed by the handshake protocol of TLS?

Which type of audit report is considered a "restricted use" report for its intended audience?

What concept does the "T" represent in the STRIDE threat model?

Which of the following is NOT a function performed by the record protocol of TLS?

Which security concept is focused on the trustworthiness of data?

What concept does the "R" represent with the DREAD model?

Which of the cloud cross-cutting aspects relates to the ability to reuse or move components of an application or service?

What type of data does data rights management (DRM) protect?

Which of the following is NOT a factor that is part of a firewall configuration?

Although the REST API supports a wide variety of data formats for communications and exchange, which data formats are the most commonly used?

Which one of the following threat types to applications and services involves the sending of requests that are invalid and manipulated through a user's client to execute commands on the application under the user's own credentials?

With a cloud service category where the cloud customer is responsible for deploying all services, systems, and components needed for their applications, which of the following storage types are MOST likely to be available to them?

Many tools and technologies are available for securing or monitoring data in transit within a data center, whether it is a traditional data center or a cloud.

Which of the following is NOT a technology for securing data in transit?

Which of the following is not a risk management framework?

What does a cloud customer purchase or obtain from a cloud provider?

Where is a DLP solution generally installed when utilized for monitoring data in transit?

With finite resources available within a cloud, even the largest cloud providers will at times need to determine which customers will receive additional resources first.

What is the term associated with this determination?

Which of the following aspects of cloud computing would make it more likely that a cloud provider would be unwilling to satisfy specific certification requirements?

An SLA contains the official requirements for contract performance and satisfaction between the cloud provider and cloud customer. Which of the following would NOT be a component with measurable metrics and requirements as part of an SLA?

Which of the following is considered an internal redundancy for a data center?

If a company needed to guarantee through contract and SLAs that a cloud provider would always have available sufficient resources to start their services and provide a certain level of provisioning, what would the contract need to refer to?

Implementing baselines on systems would take an enormous amount of time and resources if the staff had to apply them to each server, and over time, it would be almost impossible to keep all the systems in sync on an ongoing basis.

Which of the following is NOT a package that can be used for implementing and maintaining baselines across an enterprise?

Which cloud storage type requires special consideration on the part of the cloud customer to ensure they do not program themselves into a vendor lock-in situation?

Which of the following tasks within a SaaS environment would NOT be something the cloud customer would be responsible for?

You are working for a cloud service provider and receive an eDiscovery order pertaining to one of your customers.

Which of the following would be the most appropriate action to take first?

During which phase of the cloud data lifecycle is it possible for the classification of data to change?

Firewalls are used to provide network security throughout an enterprise and to control what information can be accessed--and to a certain extent, through what means.

Which of the following is NOT something that firewalls are concerned with?

A DLP solution/implementation has three main components.

Which of the following is NOT one of the three main components?